COIN

Northern

Zero

A mysterious trader has sued&nbsp;Coinbase (NASDAQ: COIN)&nbsp;just days before it reports its first-quarter 2026 earnings.
Identified only as "D.B.," who is a citizen of Puerto Rico, the <a href="https://www.courtlistener.com/docket/73294035/1/b-v-coinbase-global-inc/" rel="noopener noreferrer nofollow">lawsuit </a>was filed under seal on May 4, 2026,&nbsp;in the U.S. District Court for the Northern District of California.
Coinbase, the largest crypto exchange in the United States, will report its earnings on May 7,&nbsp;after the market close, with a live earnings webcast at 5:30 p.m. ET.
<a href="https://www.thestreet.com/crypto/markets/coinbase-announces-layoff-ahead-of-earnings" rel="noopener noreferrer nofollow">Related: Coinbase announces layoff ahead of earnings</a>
<h2 id="whale-claims-for-lost-stablecoins">Whale claims for lost stablecoins</h2>
The complainant alleges that on Aug. 20, 2024, D.B. fell victim to a sophisticated cryptocurrency theft while using DefiSaver, a non-custodial DeFi management tool on the <a rel="noopener noreferrer nofollow">Ethereum </a>(ETH) network.
According to the filing, an international cybercriminal, identified only as "John Doe" and potentially more than one person, tricked D.B. into clicking a link to a fake DefiSaver login page.&nbsp;The site mimicked the real platform but used a ".app" domain instead of ".com."
Once D.B. logged in, the attacker gained access to their hardware <a href="https://www.thestreet.com/crypto/explained/explained-what-is-a-hot-wallet" rel="noopener noreferrer nofollow">wallet</a> and drained a redacted amount of DAI stablecoins, using a web of complex transactions designed to launder and conceal the stolen assets.
<a href="https://www.thestreet.com/crypto/explained/explained-what-is-a-stablecoin" rel="noopener noreferrer nofollow">Stablecoins </a>are a type of cryptocurrency designed to maintain a stable value, typically by being pegged to a real-world asset like the U.S. dollar.&nbsp;
DAI is a stablecoin pegged to the U.S. dollar and issued by the protocol formerly known as MakerDAO, which rebranded to Sky in August 2024.&nbsp;DAI is in active circulation as a legacy token despite the rebranding. 
<h3 id="popular-on-thestreet-roundtable">Popular on TheStreet Roundtable:</h3>
<ul>
 <li><a href="https://www.thestreet.com/crypto/markets/michael-saylors-strategy-reports-12-54b-net-loss-in-q1" rel="noopener noreferrer nofollow">Michael Saylor's Strategy reports $12.54B net loss in Q1</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/eric-trump-unveils-new-logo-as-his-fathers-brand-takes-over-u-s-government" rel="noopener noreferrer nofollow">Eric Trump unveils new logo as his father's brand takes over U.S. Government</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/blackrock-reveals-surprising-new-asset-class" rel="noopener noreferrer nofollow">BlackRock reveals surprising new asset class</a></li>
</ul>
<h2 id="the-trail-leads-to-coinbase">The trail leads to Coinbase</h2>
D.B. retained two blockchain intelligence firms, Zero Shadow and Five Stones Intelligence, to trace the stolen crypto. Their investigation led directly to a Coinbase retail-user account.
On Nov. 30, 2024, Zero Shadow notified Coinbase, which confirmed the funds were still in the account and implemented what it described as "friction measures" to prevent the assets from being moved.
As of the filing date, those funds remain frozen, but Coinbase has reportedly declined to return them to D.B. without a court order adjudicating ownership.
The investigators also identified a Ukrainian national, Oleksiy Oleksandrovych Gorelikhin, as potentially having a significant role in laundering the stolen assets.&nbsp;
The attack itself was executed using <a href="https://www.group-ib.com/blog/inferno-drainer/" rel="noopener noreferrer nofollow">"Inferno Drainer,"</a> a scam-as-a-service platform that has allegedly stolen at least $87 million from over 137,000 victims globally.
D.B. is pursuing eight counts against Doe and Coinbase, including RICO violations, Computer Fraud and Abuse Act claims, conversion, unjust enrichment, and declaratory relief and is seeking treble (triple) damages against Doe under federal racketeering law.&nbsp;
The plaintiff demands a jury trial on all counts.
TheStreet <a rel="noopener noreferrer nofollow">Roundtable</a> reached out to Coinbase and DefiSaver for comments and has not received responses at the time of publication.
At press time, COIN stock was trading&nbsp;0.91% lower at $195.99 during market hours.
<a href="https://www.thestreet.com/crypto/markets/analyst-with-72-success-rate-revamps-coinbase-price-target" rel="noopener noreferrer nofollow">Related: Analyst with 72% success rate revamps Coinbase price target</a>

Mysterious trader files lawsuit against Coinbase ahead of earnings

Table of Contents

TheStreet Roundtable

Other articles published on May 6, 2026

Join our free newsletter for daily crypto updates!