Coinbase is facing a lawsuit in California federal court over frozen crypto assets allegedly linked to a $55 million Dai phishing theft from August 2024.
Filed in a San Francisco federal court, the complaint claims that after laundering the stolen funds through Tornado Cash, the attacker deposited a portion of the traceable assets into a Coinbase retail account, where they have since been frozen.
The Puerto Rico-based plaintiff is seeking a court declaration recognizing him as the rightful owner of the funds and ordering Coinbase to release them. The lawsuit also names an unidentified “John Doe” defendant accused of carrying out the theft.
At the center of the case is the question of how crypto exchanges should handle stolen funds that can be traced to their platforms. The complaint alleges that Coinbase has acknowledged holding the assets and indicated that a court ruling is required before they can be returned.
The dispute highlights a broader challenge in crypto theft recovery: while exchanges may freeze suspicious funds upon detection, they often require legal adjudication before releasing them to claimants.
The case stems from a sophisticated phishing attack nearly two years ago, in which the victim was tricked into interacting with a fake DeFi Saver login, inadvertently granting the attacker access to his wallets and enabling the theft of $55 million in DAI.
The $55 million exploit was carried out using Inferno Drainer, a scam-as-a-service platform that enables attackers to steal digital assets without exploiting protocol-level vulnerabilities.
After reporting the incident to authorities, the victim enlisted blockchain analytics firms Zero Shadow and Five Stones Intelligence to trace the stolen funds. Their investigation allegedly linked the laundering activity to Ukrainian national Okelsiy Oleksandrovych Gorelikhin.
On Nov. 30, 2024, Zero Shadow notified Coinbase that a portion of the stolen assets had been deposited into a Coinbase address, requesting that the exchange freeze the funds. By Dec. 2, Coinbase confirmed the address belonged to a retail user and implemented “friction measures” to prevent the funds from being moved while the case was investigated.
The lawsuit argues that the assets held in the Coinbase account are clearly traceable to the victim’s stolen funds and should be returned, noting that the plaintiff had previously demanded their release.
The case also underscores the rapid rise of scam-as-a-service tools in 2024. According to Blockaid, usage of Inferno Drainer surged in the first half of the year, with the number of malicious decentralized applications increasing from around 800 to more than 2,400.
