Coinbase on hook for $618,000 to investor who lost cryptocurrency after cyber-attack

Coinbase Inc. lost a private arbitration complaint with damages and costs totaling $618,000 to a client who claimed to lose funds after a 2024 cyber-attack.

The complaint of Ashok Maini versus Coinbase Inc. was heard in private arbitration in the forum of the American Arbitration Association, commonly referred to as Triple A arbitration in the industry.

Arbitration complaints involving cryptocurrencies are outside the purview of FINRA Dispute Resolution because digital assets are not legally deemed to be securities.

Coinbase is a subsidiary of Coinbase Global Inc., a leading exchange for crypto assets.

Maini held a variety of cryptocurrencies, including Ethereum and Bitcoin, in his Coinbase account when the account in January 2024 “was the subject of a socially engineered cyberattack resulting in his account being taken over,” according to the arbitration award, which is dated December 11.

Coinbase knew of a data breach involving an overseas, third-party vendor TaskUs in January 2025 but clients were not told of the breach until this May, according to the arbitration award.

Coinbase did not respond to an email Monday seeking comment about the arbitration award and the data breach.

“These crypto platforms are where broker-dealers were in the 1980s in terms of supervision,” said Andrew Stoltmann, Maini’s attorney and a longtime plaintiff’s attorney in the securities industry. “The is no FINRA or Securities and Exchange Commission to create rules and then enforce them.”

He added he has another 140 similar private arbitration claims involving Coinbase clients.

According to the arbitration award, Maini won $330,000 in damages for value of the cryptocurrencies; $150,000 for the loss of the use of his own funds; $96,000 for attorney’s fees; and $42,000 for general costs.

Triple A arbitration is more expensive than arbitration claims heard by FINRA panels, thus making them potentially out of reach for less than wealthy clients, Stoltmann noted.

The arbitrator in the claim, Steven M. Ruffalo, held Coinbase accountable and used strong language to do so in the decision.

“The witness it presented as the Head of Investigations on the Coinbase Trust and Safety Team appeared to have selective amnesia as he was evasive and not forthcoming, having no recollection of critical facts that may if revealed be harmful to its defenses,” Ruffalo wrote.

“It is almost as if [Coinbase’s] refusal to investigate this incident is being relied upon by it to evade accountability, which are badges that no reputable asset custodian should want to be associated with much less impose upon its customers,” he wrote.

Ruffalo added that the company “utterly failed in its duty to protect and maintain as private, [Maini’s] and many other of its own customers’ confidential account information.”