A Puerto Rico-based plaintiff filed a legal action against cryptocurrency exchange Coinbase on May 4, 2026, in a San Francisco federal court. The litigation seeks to recover a batch of digital assets currently locked on the platform, which are directly linked to a $55.43 million DAI theft executed during the third quarter of 2024. The lawsuit demands that the United States justice system declare the plaintiff as the rightful owner of the funds to compel their release.
The legal conflict exposes the operational protocols applied by centralized platforms upon receiving capital derived from decentralized finance (DeFi) exploits. According to the complaint, Coinbase agreed to freeze the assets deposited in a retail account after receiving notifications from forensic analysis firms, but the company indicated that a court order adjudicating the ownership of the funds is required before proceeding with any return to the affected user.
Origin of the phishing attack and malicious infrastructure
🚨 $55.43M DAI Phished 🚨
A victim lost $55.43M in DAI after signing a phishing transaction. The drainer re-assigned the ownership of the DeFi Saver Proxy, and within hours, all funds were drained. The stolen assets are now in 5 intermediate wallets.
Here's a breakdown of what… pic.twitter.com/5FEp7ACxWI
— Global Ledger Alerts (@GlobalLedger) August 21, 2024
The origin of this capital traces back to August 21, 2024. On that date, the plaintiff was the victim of a highly sophisticated phishing attack. The perpetrator deceived the victim into authorizing a transaction through a fraudulent login associated with the DeFi Saver platform. Records from the security alert regarding the malicious transaction confirm that the attacker reassigned the ownership of the user’s proxy smart contract and drained the entirety of the DAI reserves within hours. Following the initial attack, the funds were transferred to 5 intermediate wallets to obscure their traceability on the Ethereum network.
To execute the extraction of the assets, the attacker utilized a malware infrastructure known as Inferno Drainer. This software operates under a scam-as-a-service model, allowing malicious actors to facilitate the theft of digital assets without the need to identify or exploit code-level vulnerabilities in a protocol. According to data from blockchain security firm Blockaid, this malicious tool tripled its usage during the first half of 2024, scaling from operating in approximately 800 fraudulent decentralized applications at the beginning of the year to over 2,400 malicious platforms.
Forensic tracking and retention of funds
Following the loss of the capital, the victim notified law enforcement agencies and contracted cryptocurrency intelligence platforms Zero Shadow and Five Stones Intelligence to execute an on-chain analysis. The firms tracked the funds through the cryptocurrency mixer Tornado Cash, identifying money laundering patterns that led to linking the assets with a Ukrainian citizen identified as Okelsiy Oleksandrovych Gorelikhin.
On November 30, 2024, Zero Shadow issued a formal notification to Coinbase. The technical report indicated that a fraction of the stolen capital had bypassed obfuscation processes and was deposited into a specific address hosted on the exchange’s infrastructure. The forensic firm requested the platform to apply the corresponding due diligence procedures.
On December 2, 2024, Coinbase confirmed the receipt of the notice and verified that the receiving address belonged to a retail client of its platform. As an immediate response, the company implemented friction measures on the user’s account to prevent the dissipation of the funds while an internal investigation was executed.
Despite the retention of the capital, the recovery process stalled at the release stage. The filed documents detail that the exchange acknowledged the holding of the traced capital but maintained a strict compliance stance. The platform requires a judicial order adjudicating ownership to mitigate any legal risks derived from a unilateral transfer of the retained balances.
The official case docket also includes an anonymous defendant categorized as “John Doe,” who is designated as the direct entity responsible for executing the original theft. The plaintiff argues that the retained cryptocurrency in the Coinbase account constitutes identifiable property traceable to the originally stolen capital.
The judicial process awaits the scheduling of the preliminary hearing calendar in the California federal court. During the upcoming weeks, the court must determine whether to issue the declaration of ownership requested by the plaintiff, which would establish the legal mandate for the final release of the assets held by Coinbase.
This article is for informational purposes only and does not constitute financial advice.
