A São Paulo state court applied Brazil’s Consumer Defence Code to a non-custodial wallet, placing the burden of proof on Coinbase for a transaction the company neither authorised nor executed.
A São Paulo state court has ordered Coinbase to refund approximately $100,000 to a user who had deposited funds in a self-custody wallet managed through the platform. The case stems from the unauthorised disappearance of those funds. Coinbase argued that, as a non-custodial wallet, the private key was under the user’s exclusive control and the company was not a party to the transaction.
Magistrate Ju Hyeon Lee rejected that defence by applying Brazil’s Consumer Defence Code, which places the burden of proof on the service provider. According to the court, Coinbase neither demonstrated that the wallet holder had authorised the movement of funds, nor documented the existence of security measures capable of preventing the incident. Because the amount claimed by the user was not disputed, the company was ordered to repay it in full, plus statutory interest.
Specialist lawyer Raphael Souza commented on the ruling for the Livecoins portal, identifying two arguments the decision dismantles. The first concerns software producer liability: “Anyone who develops and brings a product to market is responsible for its security, regardless of how the underlying technical architecture works,” Souza said. The second concerns procedural communication: technical documentation submitted without adequate explanation to aid the court’s understanding does not constitute sufficient evidence. According to Souza, “Coinbase had every opportunity to demonstrate that the investor had authorised the transaction, to explain the technical logs and to indicate where the funds had gone. It chose not to.”
The precedent’s reach extends beyond this single case. If the court’s reasoning were consolidated on appeal or adopted by other courts, wallet software providers – including those operating on open, non-custodial protocols – could find themselves exposed to compensation claims for events over which they have no operational control.
