A high-stakes legal battle has landed on the doorstep of one of the world’s largest cryptocurrency exchanges. Coinbase is currently facing a lawsuit in a San Francisco federal court over its refusal to release frozen assets allegedly tied to a massive $55 million phishing exploit from August 2024. The case brings a critical question to the forefront of the industry: What is the legal responsibility of an exchange when it is holding “traceable” stolen property?
The plaintiff, a resident of Puerto Rico, claims that after a sophisticated “scam-as-a-service” attack drained his wallets of DAI stablecoins, a portion of those funds was laundered through the mixer Tornado Cash and eventually deposited into a Coinbase retail account. While Coinbase acted quickly to freeze the assets following an alert, they have reportedly refused to hand them back to the victim without a formal court order adjudicating ownership.
The Inferno Drainer Exploit: How $55 Million Vanished
The theft itself was a masterclass in modern digital asset exploitation. In late 2024, the victim was targeted by a phishing campaign utilizing Inferno Drainer, a notorious malware platform that allows bad actors to bypass protocol vulnerabilities by tricking users into signing away their own permissions. By clicking a malicious link disguised as a legitimate DeFi Saver login, the victim unknowingly authorized the attacker to access his account, resulting in the immediate loss of $55 million in DAI.
Following the breach, the victim didn’t just wait for law enforcement. He hired specialized crypto analytics firms, Zero Shadow and Five Stones Intelligence, to track the movement of the digital loot. Their investigation allegedly traced the funds through various obfuscation layers—including the sanctioned mixer Tornado Cash—and identified a trail leading directly to a specific account on Coinbase. By November 2024, the exchange was notified of the stolen funds’ location, leading them to implement “friction measures” to prevent the user from withdrawing the assets.
The Legal Deadlock: Why Exchanges Require a Court Order
The core of this lawsuit isn’t about whether the funds were stolen, but rather the process of recovery. Coinbase has reportedly acknowledged that it is holding the traced funds but insists that it cannot simply hand them over based on a third-party claim. This highlights a persistent “Catch-22” in the crypto recovery space: exchanges are willing to freeze suspected illicit funds to prevent further laundering, but they often demand a judicial decree before transferring those assets to a claimant to protect themselves from potential liability.
The plaintiff’s filing argues that because the cryptocurrency is “identifiable property” directly traceable to the original theft, he is the rightful owner. By naming both Coinbase and an unknown “John Doe” (the suspected attacker) in the suit, the victim is seeking a legal declaration of ownership that would force Coinbase’s hand. As the industry watches this case unfold, the outcome could set a significant precedent for how centralized exchanges manage “tainted” deposits and the speed at which victims of phishing can reclaim their lost wealth.
