A São Paulo state court ordered Coinbase to refund approximately R$507,000 , roughly $99,000 at current exchange rates , to a user whose Coinbase Wallet was drained in unauthorized transactions. The ruling, handed down by the TJSP, rejected Coinbase's core defense: that self-custody wallets, where the user alone holds the private keys, generate no liability for the software provider.

Under Brazil's Consumer Protection Code, the evidentiary burden falls on the business, not the consumer. Coinbase was required to prove the user authorized the transactions and to demonstrate adequate security measures existed. It did neither. The court did not need to establish how the loss occurred. The absence of proof from Coinbase was sufficient.

Brazil's consumer protection law just did what US class actions have not: it told a self-custody wallet provider that 'not our keys, not our problem' is not a defense when the consumer can prove the product failed.

CoinBatmi Newsroom

Brazilian cryptocurrency attorney Raphael Souza told local outlet Livecoins that Coinbase had every opportunity to prove the investor authorized the transaction, explain the technical records, and show where the funds went, but chose not to do any of that. The ruling also dismissed a second common industry defense: submitting technical documentation without explanation does not constitute an adequate legal defense.

The decision lands as a direct challenge to the structural assumption underpinning every non-custodial wallet on the market. The industry has long operated on the premise that if the user holds the keys, the provider holds no responsibility. The TJSP just ruled that premise does not override consumer protection law in Brazil.

Coinbase has not publicly stated whether it will appeal. If this is a first-instance ruling, appeal would be available. The outcome at the appellate level determines whether this becomes a binding template or an isolated event. For now, every wallet developer with Brazilian users or a Brazilian legal presence is exposed to the same logic.

The mechanism of the loss was never established. The user could have been phished, rekt by malware, or fallen for a social engineering attack. Under the court's reasoning, none of that matters. Coinbase Wallet is a product distributed by Coinbase. The product failed. Coinbase pays. That framing, if upheld, rewrites the liability map for self-custody software in the region's largest economy.

Key takeaways

• A São Paulo court ordered Coinbase to refund ~$100K after rejecting its self-custody defense, ruling that Brazil's Consumer Protection Code…
• The ruling threatens the foundational legal assumption of the self-custody industry: that holding private keys means the provider bears no…
• Coinbase has not announced an appeal. If the ruling stands, it could reshape liability exposure for every non-custodial wallet operating in…

Live multi-source prices on CoinBatmi Markets. Research only — not financial advice.