Crypto Whale Sues Coinbase Alleging Exchange Refuses to Return Stolen Funds

In brief

• An anonymous crypto whale sued Coinbase, alleging the platform refused to return their stolen funds.
• The stolen funds in question appear to trace to a $55 million DAI phishing attack in 2024.
• The victim says sleuths linked the stolen assets to Coinbase, which allegedly won't release them without a court order.

An anonymous crypto whale based in Puerto Rico sued Coinbase this week, accusing the crypto exchange of failing to release funds stolen from the user in a 2024 hack.

Though key details in the lawsuit are redacted, information in the filing regarding the hack closely resembles a massive exploit in August 2024 that saw a single crypto user lose over $55 million worth of an Ethereum stablecoin, DAI, after falling for a phishing scam.

The lawsuit, filed Monday in a federal court in San Francisco, claims that after the hack, the whale hired multiple on-chain investigation firms to track the crypto down. Ultimately, the suit alleges, the sleuths traced the stolen funds back to a Coinbase account, and by early December of 2024, the crypto exchange confirmed it had identified the funds, which would be frozen pending an investigation.

The crypto whale now claims, however, that a year and a half later, they still have not received their crypto back, and that Coinbase has said it will not return the funds until compelled to do so by a court order.

Coinbase did not immediately respond to Decrypt’s request for comment.

The $55 million DAI hack in 2024 was first identified by pseudonymous on-chain crypto sleuth ZachXBT. Hackers used a platform called “Inferno Drainer” to create a fake login page for DeFi Saver, a crypto management tool used by the victim.

The victim, thinking they were signing into the site, unintentionally handed control of their wallet over to the hackers, who immediately sent the DAI to other crypto wallets and began laundering the funds with coin mixing services.

In the lawsuit filed against Coinbase this week, the plaintiff said they had failed to notice that the fake login page, which should have been DefiSaver.com, instead ended in “.app.”