Crypto Whale Sues Coinbase to Recover $55M Stolen in Phishing Attack

An anonymous cryptocurrency investor residing in Puerto Rico has filed a lawsuit against the Coinbase exchange in the U.S. District Court for the Northern District of California. The plaintiff, identified in court documents as "D.B.," is seeking the return of approximately $55.4 million in digital assets that were stolen during a sophisticated phishing attack in August 2024. Although Coinbase successfully froze the funds shortly after the incident, the exchange has reportedly refused to release them to the owner without a formal court order.

Details of the $55 Million DAI Exploit

The legal dispute stems from a security breach on August 20, 2024, when the plaintiff fell victim to a phishing scheme while attempting to use DefiSaver, a popular DeFi management application. The attackers utilized a spoofed website with a". app" domain, mimicking the legitimate service. By tricking the user into signing a malicious transaction, the hackers gained control over a Maker vault and drained approximately 55.47 million DAI stablecoins.

• Malware used: The attack was linked to Inferno Drainer, a notorious "scam-as-a-service" tool.
• Laundering attempt: The stolen DAI was moved through the Tornado Cash mixer and eventually converted into Ethereum (ETH).
• Discovery: On-chain investigator ZachXBT initially flagged the massive movement of funds, which were later traced to a specific account on Coinbase.

Coinbase's Stance on Frozen Assets

According to the filing, the plaintiff hired multiple forensic investigation firms, including Zero Shadow and Five Stones Intelligence, to track the assets. By early December 2024, Coinbase confirmed it had identified and frozen the relevant funds using its internal security measures. However, despite the plaintiff providing sworn proof of ownership, the exchange has maintained that it cannot unilaterally return the assets.

While Coinbase acted reasonably in freezing the stolen cryptocurrency, its refusal to return the frozen funds to plaintiff became unreasonable when plaintiff provided sworn proof that he is the rightful owner and Coinbase refused to act.

The lawsuit includes five counts against Coinbase, such as unjust enrichment, and seven counts against the unknown hackers (referred to as "John Doe"). The plaintiff is asking the court to officially declare his ownership of the funds and compel Coinbase to execute the transfer.

The case highlights the ongoing challenges faced by victims of high-value crypto thefts. Even when assets are successfully tracked and frozen on centralized platforms, the legal hurdles required to reclaim them can lead to prolonged disputes, leaving millions of dollars in limbo for years.