Coinbase Sued Over $55M Frozen Funds Tied to DeFi Saver Exploit

Joerg Hiller May 06, 2026 12:26

Coinbase faces lawsuit for withholding crypto linked to a $55M DeFi Saver hack, raising questions about exchanges' roles in handling stolen funds.

Crypto exchange Coinbase is facing a lawsuit in California federal court over its alleged withholding of frozen cryptocurrency linked to a $55 million exploit of the DeFi Saver platform. The funds, reportedly stolen in August 2024 through a sophisticated phishing scam, were traced to a retail Coinbase account and remain frozen, according to court documents filed on May 6, 2026.

The plaintiff, based in Puerto Rico, is seeking a court order to establish ownership of the frozen assets and compel Coinbase to release them. The lawsuit also names a John Doe defendant, accusing the unidentified individual of carrying out the phishing attack, which leveraged the "Inferno Drainer" scam-as-a-service platform. This tool allows bad actors to steal digital assets without needing to exploit vulnerabilities in blockchain protocols.

The exploit, which targeted the DeFi Saver platform, tricked a victim into providing access to their account via a fraudulent login page. The stolen funds were subsequently laundered through the Tornado Cash mixer before being deposited into the Coinbase account. According to the complaint, Coinbase acknowledged holding the "traceable stolen funds" but stated it would only release them following a court order adjudicating ownership.

Broader Issues in Crypto Theft Recovery

The case underscores a recurring challenge in crypto theft recovery: exchanges often freeze assets flagged as stolen but require legal judgments before returning them. This approach, while intended to prevent further dissipation of illicit funds, can leave victims in legal limbo, navigating protracted court battles to reclaim their assets.

Crypto hacks are on the rise, with 2026 already seeing over $1 billion stolen in 68 incidents, including 29 attacks in April alone. The DeFi Saver hack is emblematic of a growing trend in scams targeting decentralized finance (DeFi) users. Platforms like Inferno Drainer, which create malicious decentralized applications, have tripled their activity since early 2024, according to blockchain security firm Blockaid.

Coinbase's Role and Legal Precedent

Coinbase's handling of the case could set a legal precedent for how exchanges address stolen funds. While freezing flagged assets may prevent further laundering, victims argue that exchanges have a responsibility to expedite resolution processes. The lawsuit alleges Coinbase has been aware of the frozen funds since December 2024, when it received evidence linking the assets to the DeFi Saver exploit. Despite implementing "friction measures" to freeze the account, the exchange has yet to facilitate their recovery.

This isn't an isolated incident for Coinbase or the broader industry. Exchanges frequently find themselves caught between compliance obligations, protecting users, and legal complexities tied to stolen crypto. How Coinbase navigates this lawsuit could influence future protocols for handling flagged funds.

Implications for DeFi and Investors

The DeFi Saver exploit highlights risks inherent in decentralized finance, where users bear significant responsibility for securing their assets. Despite undergoing multiple security audits, DeFi Saver fell victim to a phishing attack that bypassed its core protocol's defenses. For investors, the case serves as a reminder of the importance of vigilance in securing private keys and verifying the authenticity of platforms they interact with.

As the lawsuit progresses, other exchanges and DeFi platforms will be watching closely. A court ruling could provide clarity on the responsibilities of exchanges in recovering stolen funds, offering some relief to victims navigating a system notorious for its lack of recourse.

Coinbase has yet to comment publicly on the case. Meanwhile, the legal battle adds another layer of complexity to the already fraught intersection of crypto theft, decentralized finance, and regulatory oversight.

• coinbase
• defi saver
• crypto theft
• frozen funds
• phishing attack