ewsba.se
A mysterious trader has sued Coinbase (NASDAQ: COIN) just days before it reports its first-quarter 2026 earnings.
Identified only as "D.B.," who is a citizen of Puerto Rico, the lawsuit was filed under seal on May 4, 2026, in the U.S. District Court for the Northern District of California.
Coinbase, the largest crypto exchange in the United States, will report its earnings on May 7, after the market close, with a live earnings webcast at 5:30 p.m. ET.
Related: Coinbase announces layoff ahead of earnings
The complainant alleges that on Aug. 20, 2024, D.B. fell victim to a sophisticated cryptocurrency theft while using DefiSaver, a non-custodial DeFi management tool on the Ethereum (ETH) network.
According to the filing, an international cybercriminal, identified only as "John Doe" and potentially more than one person, tricked D.B. into clicking a link to a fake DefiSaver login page. The site mimicked the real platform but used a ".app" domain instead of ".com."
Once D.B. logged in, the attacker gained access to their hardware wallet and drained a redacted amount of DAI stablecoins, using a web of complex transactions designed to launder and conceal the stolen assets.
Stablecoins are a type of cryptocurrency designed to maintain a stable value, typically by being pegged to a real-world asset like the U.S. dollar.
DAI is a stablecoin pegged to the U.S. dollar and issued by the protocol formerly known as MakerDAO, which rebranded to Sky in August 2024. DAI is in active circulation as a legacy token despite the rebranding.
Michael Saylor's Strategy reports $12.54B net loss in Q1
Eric Trump unveils new logo as his father's brand takes over U.S. Government
BlackRock reveals surprising new asset class
D.B. retained two blockchain intelligence firms, Zero Shadow and Five Stones Intelligence, to trace the stolen crypto. Their investigation led directly to a Coinbase retail-user account.
On Nov. 30, 2024, Zero Shadow notified Coinbase, which confirmed the funds were still in the account and implemented what it described as "friction measures" to prevent the assets from being moved.
As of the filing date, those funds remain frozen, but Coinbase has reportedly declined to return them to D.B. without a court order adjudicating ownership.
The investigators also identified a Ukrainian national, Oleksiy Oleksandrovych Gorelikhin, as potentially having a significant role in laundering the stolen assets.
The attack itself was executed using "Inferno Drainer," a scam-as-a-service platform that has allegedly stolen at least $87 million from over 137,000 victims globally.
D.B. is pursuing eight counts against Doe and Coinbase, including RICO violations, Computer Fraud and Abuse Act claims, conversion, unjust enrichment, and declaratory relief and is seeking treble (triple) damages against Doe under federal racketeering law.
The plaintiff demands a jury trial on all counts.
TheStreet Roundtable reached out to Coinbase and DefiSaver for comments and has not received responses at the time of publication.
At press time, COIN stock was trading 0.91% lower at $195.99 during market hours.
Related: Analyst with 72% success rate revamps Coinbase price target
This story was originally published by TheStreet on May 6, 2026, where it first appeared in the MARKETS section. Add TheStreet as a Preferred Source by clicking here.