Why is Coinbase being sued over frozen crypto funds?

Coinbase is being sued by a Puerto Rico-based plaintiff who claims the exchange froze crypto tied to a $55 million DAI phishing theft but refused to release the assets without a court order. The plaintiff wants a federal court to confirm ownership and force Coinbase to return the funds.

What happened in the $55 million DAI phishing attack?

The lawsuit alleges a scammer used a fake DeFi Saver login page to trick the victim into approving wallet access. That allegedly allowed the attacker to steal roughly $55 million in DAI stablecoins in August 2024.

How were the stolen crypto funds traced to Coinbase?

Blockchain intelligence firms Zero Shadow and Five Stones Intelligence reportedly tracked part of the stolen crypto after it moved through Tornado Cash. Investigators later identified deposits into a Coinbase retail account and alerted the exchange in November 2024.

Why did Coinbase freeze the crypto assets instead of returning them?

According to the lawsuit, Coinbase implemented “friction measures” to stop the funds from being moved while ownership was investigated. The exchange allegedly said it needed a court order confirming who legally owns the assets before releasing them.

What does this lawsuit mean for crypto exchanges handling stolen funds?

The case highlights a growing issue for crypto exchanges that freeze suspicious funds but face legal uncertainty over who should receive recovered assets. Exchanges risk criticism whether they release funds too quickly or hold them for too long.

What is Inferno Drainer and why is it important in this case?

Inferno Drainer is a scam-as-a-service platform that helps attackers steal crypto through phishing tools instead of hacking protocols directly. The lawsuit says the attacker used the platform during the $55 million exploit.

How risky are phishing attacks for crypto investors right now?

Phishing remains one of the biggest threats in crypto because users can unknowingly approve malicious wallet transactions themselves. Scam-as-a-service tools like Inferno Drainer have made these attacks easier to launch at scale.

Does Tornado Cash make stolen crypto impossible to trace?

Not completely. Although Tornado Cash is designed to obscure transaction trails, blockchain investigators can still sometimes trace funds using wallet behaviour, exchange records and forensic analysis.

Coinbase sued over frozen $55M crypto haul

Written by Isaac FrancisPublished May. 7 2026Last Updated May. 7 2026

Coinbase has been sued in California federal court by a Puerto Rico-based plaintiff seeking the return of crypto allegedly tied to a $55 million DAI phishing theft from August 2024.

The complaint filed in San Francisco alleges that after laundering funds through Tornado Cash, the attacker deposited part of the traceable stolen assets into a Coinbase retail account where the funds remain frozen pending investigation.

The plaintiff asked the court to declare him the rightful owner of the frozen assets and order Coinbase to release the crypto, while also naming an unidentified John Doe defendant accused of carrying out the theft.

The lawsuit said Coinbase acknowledged holding the traced funds and indicated that a court order confirming ownership was required before the exchange could release the assets to any claimant.

The case stems from a sophisticated phishing exploit nearly two years ago in which an attacker allegedly used a fake DeFi Saver login page to trick the victim into authorising access to crypto wallets holding roughly $55 million in DAI stablecoins.

Blockchain intelligence firms Zero Shadow and Five Stones Intelligence later traced portions of the stolen crypto to accounts allegedly connected to Ukrainian citizen Okelsiy Oleksandrovych Gorelikhin before notifying Coinbase in November 2024 about deposits linked to the exploit.

The lawsuit also highlighted growing concerns around scam-as-a-service tools including Inferno Drainer, whose malicious decentralised applications reportedly tripled during the first half of 2024 according to blockchain security firm Blockaid.