A Puerto Rico-based crypto investor identified in court documents only as "D.B." (the plaintiff's identity is redacted in the federal filing) filed a lawsuit against Coinbase in May 2026, demanding the return of approximately $55.47 million in DAI stablecoin that the exchange has held frozen since early December 2024. The suit, filed in the U.S. District Court for the Northern District of California, argues that Coinbase's refusal to release assets it already acknowledges as stolen is unjust, and names Oleksiy Oleksandrovych Goreliikhin, a Ukrainian national, as the alleged hacker responsible for the original theft.

The attack took place on August 20, 2024. The plaintiff was using DeFi Saver, a legitimate Ethereum-based portfolio management tool, when a phishing site impersonating the service redirected them to a near-identical fraudulent domain registered under a ".app" address rather than the real ".com" site. The fake site used Inferno Drainer, a criminal toolkit sold as a subscription service to phishing operators, to trick the victim into authorizing a malicious smart contract. That contract transferred ownership of the victim's MakerDAO vault to the attacker, who then minted roughly 55.47 million DAI directly into it. On-chain investigator ZachXBT flagged the attack publicly shortly after it occurred.

The plaintiff hired two blockchain forensics firms, Zero Shadow and Five Stones, which traced the stolen funds through Tornado Cash (a cryptocurrency mixing service used to obscure transaction trails) to one or more accounts held at Coinbase. Coinbase confirmed it had identified and frozen the assets in early December 2024. According to the lawsuit, the plaintiff then provided sworn proof of ownership to the exchange. The filing states: "While Coinbase acted reasonably in freezing the stolen cryptocurrency, its refusal to return the frozen funds...became unreasonable when plaintiff provided sworn proof that he is the rightful owner." Coinbase still declined to return the funds, with its stated position being that it would not act without a court order compelling it to do so. Coinbase did not respond to Decrypt's request for comment at the time of publication. The lawsuit brings five counts against Coinbase, including unjust enrichment, and seven counts against the alleged hacker, including fraud, theft, and racketeering.

The choice of DAI as a theft target is worth noting. Unlike centralized stablecoins such as USDC or USDT, whose issuers (Circle and Tether, respectively) can blacklist or freeze specific wallets at the protocol level, DAI is governed by a decentralized protocol and has no equivalent freeze mechanism. Blockchain intelligence firm Whitestream, as cited by Chainalysis, has described DAI as having "gained a reputation as a preferred stablecoin for illicit actors, serving as a 'parking place' for illegally sourced funds." Once stolen DAI moves through a mixer and lands at a regulated exchange, legal compulsion is effectively the only available recovery path, as civil negotiation or voluntary compliance remain theoretical but rarely realized alternatives. Inferno Drainer, the toolkit behind this attack, has caused lifetime losses exceeding $215 million across more than 200,000 victims. It was briefly reported as shut down in late 2023, then relaunched in May 2024 with expanded support for 28 blockchains and hundreds of DeFi protocols. The attack on D.B. fell squarely within Inferno Drainer's most destructive stretch: the toolkit caused an estimated $110 million in losses in August and September 2024 alone, the same two-month window in which the theft occurred.

The case exposes a structural gap that affects crypto users far beyond the United States. Blockchain forensics can now locate stolen funds with considerable precision, but no automatic legal mechanism compels a regulated exchange to return those funds on that evidence alone. For users in South Asia and Africa, this gap is even wider. In countries such as India, Nigeria, Kenya, Pakistan, and Bangladesh, where DeFi adoption is growing rapidly, victims of comparable thefts have no direct jurisdiction over U.S.-based entities. India's evolving crypto framework, which includes a 30% flat tax on gains and a 1% TDS (tax deducted at source) applied at the point of crypto transfer or sale, does not yet include formal channels to compel foreign exchange cooperation. Mutual legal assistance treaty (MLAT) processes between countries can take years. Africa's situation is more acute: INTERPOL reported a 112% surge in crypto fraud rates across the continent in 2025, and Zambian authorities alone identified 65,000 victims who lost an estimated $300 million to crypto-linked fraud schemes. INTERPOL's Operation Serengeti dismantled major cybercrime networks, but recovering funds already sitting frozen at a U.S. exchange remains, practically speaking, a matter for U.S. federal courts.

The lawsuit arrives at a pointed moment for Coinbase. The exchange's European subsidiary was fined 21.5 million euros by Ireland's Central Bank in November 2025 for anti-money laundering monitoring failures covering the period from 2021 to 2025. At the same time, the U.S. Treasury Department is pressing Congress to grant exchanges the legal authority to freeze suspicious funds without a court order. That proposal addresses the initial freeze phase of an investigation; it is less directly relevant to the refusal at the center of this case, which concerns funds Coinbase has already frozen and declines to return. Americans lost more than $11.4 billion to crypto fraud in 2025 alone, a 22% year-on-year increase according to FBI figures. Whether this case results in a court order forcing Coinbase to act, or prompts the exchange to settle, the outcome will carry practical weight: it will either confirm or complicate the assumption that frozen stolen funds at a regulated exchange can eventually be returned to their rightful owner.