Coinbase faces a 170,874 euro lawsuit threat in the Netherlands over account issues

Why did a Coinbase customer threaten legal action?

Coinbase is facing the prospect of filing a civil lawsuit in the Netherlands. Previously, a customer issued a formal notice of default seeking damages of 170,874.18 euros, alleging that his account was hijacked and funds were transferred without authorization in 2024. The notice, which was made public on September 12, gave Coinbase a 14 calendar day period to pay the claimed amount or provide a commitment to unconditional performance. If this requirement is not met, the client stated that it will instruct the Dutch litigation lawyer to serve a summons (dagvaarding). It has not yet been shown that a formal case has been filed, so the document is a pre-litigation escalation measure rather than an existing Dutch court case.

The dispute allegedly began with a cyber attack on Coinbase's personal account on January 27, 2024. The attacker allegedly gained access by hijacking session cookies and caused 53,674.95 euros of fiat funds to flow out of Coinbase in less than two minutes through four transactions. The customer pointed out that Coinbase refused to accept responsibility in its final reply on July 4, 2024, and blamed the incident on the disclosure of customer credentials. The response has not yet been independently reviewed.

Why are Dutch payment laws important?

The new claims rely mainly on Dutch payment services rules that regulate unauthorized transactions. Article 7:522 of the Dutch Civil Code stipulates that payment transactions are considered authorized unless the payer agrees. Section 7:527 adds that simply recording the use of payment instruments is not sufficient to prove that the customer approved the transaction or that there was fraud and gross negligence. This distinction can be crucial if the case enters the court stage.

If Coinbase claims that customers should bear the loss, evidence such as valid account credentials or authenticated sessions may not be enough to exempt them. Section 7:528 generally requires payment service providers to promptly refund money after becoming aware of unauthorized transactions, but there are exceptions. However, Section 7:529 allows the customer to bear losses in the event of established fraud or a deliberate or significant breach of security obligations. Therefore, the core factual controversy will still revolve around how Coinbase's account was compromised and whether the customer's behavior met the legal threshold of gross negligence.

Investor revelation

Legal risk is not determined solely by the claim amount of € 170,874. If litigation is filed, the dispute could force a detailed review of Coinbase's certification record, transaction controls and the process for handling unauthorized payment claims under European legal frameworks.

Will Coinbase's security controls be reviewed?

The plaintiffs also questioned Coinbase's transaction monitoring mechanisms, alleging that the platform failed to respond to sudden geographical changes and four rapid high-value transfers, and did not require strong customer certification (SCA) associated with transactions. European payment rules typically require SCA to be implemented when the payer initiates electronic payments, while remote payments require authentication linked to the amount and payee. Although exemptions exist, including certain transactions that are assessed as low-risk, this does not mean that the SCA argument will depend solely on whether additional authentication has been performed. Instead, courts may need to determine the payment process, whether exemptions apply, and risk signals available when handling disputed transfers.

If litigation begins, potentially important evidence may include login records, device fingerprints, session token history, IP data, SCA events, withdrawal authorization records, and internal fraud monitoring alerts generated during this brief transaction sequence. The plaintiff claimed that Coinbase itself identified the Cookie hijacking as part of the accident. If confirmed by Coinbase records, this claim may become important, but until independence is established, it will remain an allegation.

Why is a claim of € 170,874 more complex than the original loss?

The amount sought by the customer far exceeded the € 53,674.95 allegedly removed from the account. The claim also includes a loss of expected portfolio profits of EUR 106,397.02, which relates to 1.40402148 BTC and 12,031.26215895 DOGE, assets that the client alleges were forcibly liquidated. The calculation uses the highest value claimed by the portfolio on October 6, 2025. Although Dutch law allows for the recovery of missed profits, proving that a client will retain assets to a later market high is far more difficult than establishing a loss of original cash. Causality, trading history and lost opportunity methods used for valuations are likely to be reviewed.

In addition, statutory interest of EUR 9,990.91 is included in the claim. Since the letter applies a fixed 7% interest rate from January 2024 to September 2026, and the Dutch consumer statutory interest rate changed during this period, this calculation may be controversial. Another issue is which Coinbase entity was legally responsible for providing customers with euro payment services at the time of the accident in January 2024. Coinbase later reorganized some of its European operations, but any litigation would require a review of the contract and physical structure at the time of the disputed transaction.

Coinbase can respond within a 14-day period, questioning the calculation of damages, the entity to which the dispute applies or maintaining its earlier rejection position. But if the subpoena is served, what was originally a customer support dispute could turn into an evidence-intensive Dutch litigation process over authorization, certification, gross negligence and payment security controls. Currently, the September 12 notice brings the dispute closer to the court, but has not yet truly placed it above the court.