Ari Paul accuses Coinbase over $25 million
Ari Paul says the case dates back “a few years.” According to him, Coinbase allegedly lost approximately $25 million belonging to BlockTower, then refused to return the money. His team later discovered that the incident was not isolated.
The accusation puts the risks of holding crypto with an intermediary back at the center of the debate, even when the intermediary is a leading institutional platform.
Paul claims to have traced comparable incidents involving at least 12 other companies, with more than $1 billion in combined losses allegedly concealed.
For now, however, these figures are based on his statements.
The BlockTower founder has not published the names of the other institutions, the transactions involved, the precise dates of the attacks or documents that would make it possible to reconstruct the losses. He attributes the lack of detail to several ongoing legal proceedings.
This is an important limitation. An institutional fund claiming to have lost $25 million clearly deserves attention. Moving from that case to the existence of a hacking campaign exceeding $1 billion, however, requires more evidence.
Coinbase Support initially responded publicly to Paul, saying it had sent him a private message to review his case.
Since then, the company has gone much further.
Coinbase denies hiding hacks
Coinbase directly disputes the core of the accusations.
In a response issued on September 29, a spokesperson said the company “is not hiding a series of hacks” and certainly had not lost $1 billion. Coinbase said it could not publicly discuss individual clients.
The exchange added an interesting technical detail: institutional clients can use API keys to connect their trading systems. Coinbase recommends strongly protecting these access credentials and says it does not retain the information needed to execute transactions when that information remains under the client’s control.
This could become a key issue if the proceedings mentioned by Ari Paul become public: will it be necessary to determine whether some compromises originated in Coinbase’s infrastructure, client accounts or external API keys?
For now, it is impossible to say.
Coinbase has already experienced a major cybersecurity incident, but one that was publicly documented, in May 2025. Overseas-based support agents had been bribed to extract information about certain users.
In its official filing with the SEC, Coinbase said that names, contact details, images of identity documents, transaction histories and certain banking data had been exposed. The company said, however, that passwords, private keys and Coinbase Prime accounts had not been compromised.
There is currently no public evidence linking this 2025 incident to BlockTower’s accusations.
The $1 billion claim remains unproven
This case puts Coinbase in an unusual position.
On one side, the accuser is not an anonymous account. Ari Paul runs BlockTower Capital, an institutional crypto fund founded in 2017, and says he is speaking about a loss directly suffered by his company.
On the other, the two figures circulating across the market—$25 million and more than $1 billion—have not yet been independently corroborated.
No public court filing identified so far documents $1 billion in losses. None of the 12 other entities mentioned by Paul has publicly identified itself in the sources reviewed.
Coinbase’s denial is also significant: the company acknowledges neither a concealed hacking campaign nor cumulative institutional losses of $1 billion.
The episode stands in sharp contrast to Coinbase’s recent involvement in operations targeting international crypto scam networks. The exchange regularly works with authorities and has a significant institutional custody business. This obviously does not rule out Paul’s allegation, but it makes particularly solid documentation necessary before presenting his account as established fact.
The case also comes at a time when attacks targeting wallets, exchanges and users are becoming increasingly industrialized. For institutions, attack surfaces extend well beyond the custodian’s infrastructure alone: APIs, employees, internal systems, social engineering and credentials all represent potential entry points.
At this stage, the conclusion can be stated in two sentences. Ari Paul accuses Coinbase of losing $25 million belonging to BlockTower and links the case to more than $1 billion in institutional losses. Coinbase formally denies hiding a series of hacks or losing that amount.
The legal proceedings mentioned by Paul may now be the only way to determine which of the two accounts is accurate.
