Crypto Theft and Exchange Hack Lawsuits: Coinbase, Bybit, FTX, and Your Options

Crypto theft cases come in three main types:

• Account takeovers. Someone gets into your exchange account through a stolen password, a SIM swap that hijacks your text codes, or a fake support call, and moves your crypto out. Claims argue the exchange's security, alerts, or response fell short.
• Exchange data breaches. Customer data leaks, and criminals use it to run convincing impostor scams. Claims argue the exchange failed to protect data it promised to guard.
• Exchange failures and hacks. The platform itself is hacked or collapses, and customers cannot withdraw.

Coinbase

In May 2025, Coinbase disclosed that criminals had paid contractors and employees working in support roles outside the U.S. to pull customer information from internal systems. The stolen data included names, addresses, phone numbers, and emails, and Coinbase said login credentials and passwords were not taken. Coinbase refused a $20 million ransom demand and said it would reimburse customers who were tricked into sending funds to the attackers. In its filing with regulators, it estimated remediation and reimbursement costs of $180 million to $400 million.

Proposed class actions followed quickly. One law firm filed a complaint in the U.S. District Court for the Northern District of California on the day of the disclosure, alleging Coinbase failed to protect customers' personal information. Coinbase disputes these claims, and none has been proven.

Coinbase customers have also brought individual claims. In December 2025, an American Arbitration Association panel awarded a Coinbase customer $618,000 in damages and costs after a 2024 account takeover, according to InvestmentNews.

SIM swaps and phone carriers

Many account takeovers start not at the exchange but at the phone company. In a SIM swap, a criminal convinces or bribes a carrier employee to move your phone number to a SIM card they control, then uses the text message codes to reset your exchange password. Victims have sued carriers as well as exchanges, arguing that the carrier failed to verify the person requesting the change. If your phone suddenly lost service shortly before your crypto disappeared, ask your carrier for the account change records right away; they are often the most important evidence in the case.

Bybit

On February 26, 2025, the FBI announced that North Korea was responsible for the theft of about $1.5 billion in virtual assets from the Bybit exchange on or about February 21, 2025, activity the FBI calls "TraderTraitor." State-sponsored hackers are effectively beyond the reach of U.S. civil courts, so claims arising from hacks like this focus on the platform's responsibilities to its customers and on freezing and tracing stolen assets.

FTX

After FTX collapsed in November 2022, customer lawsuits against insiders, promoters, and professional firms were centralized as In re FTX Cryptocurrency Exchange Collapse Litigation, MDL No. 3076, in the U.S. District Court for the Southern District of Florida. In May 2026, the law firm Fenwick & West, which advised FTX, agreed to pay $54 million to settle claims brought by former FTX customers, subject to court approval. Fenwick denies wrongdoing.

• Coinbase breach suits: pending as proposed class actions. Coinbase's user agreement contains an arbitration clause, so whether customers can proceed as a class in court is a central fight in cases like these.
• FTX: the MDL continues in Miami against third parties, while the bankruptcy estate pays customers directly. The FTX Recovery Trust began its fifth distribution, about $900 million, on July 31, 2026, bringing cumulative recoveries for U.S. and international customer claims to 105% of their allowed amounts under the plan. Those amounts are based on crypto values on the November 2022 bankruptcy date, not today's prices.
• Bybit: recovery efforts center on tracing and freezing stolen assets rather than U.S. consumer lawsuits.
• Individual arbitration: ongoing across exchanges, and usually private, so outcomes rarely become public.

Arbitration shapes almost every exchange case. When many customers file individual arbitration claims at once, the exchange usually has to pay most of the filing fees for each one, which can push it toward settlement. On the other hand, an arbitration award does not create precedent for anyone else, and arbitrators' reasoning is rarely published. That is why the handful of public awards, like the $618,000 Coinbase decision, get so much attention: they are some of the only visible signals of how these claims are being valued.

Your case is stronger if:

1. The platform had a role. Its data leaked, its support staff were compromised, it ignored alerts or your calls, or its security settings did not work as promised.
2. You acted quickly. You reported the theft promptly and asked the exchange to freeze the account.
3. You can trace the funds. Blockchain records showing where your assets went help prove what was taken and when.
4. The loss is meaningful. Arbitration and litigation take time; larger losses justify the effort more easily.

Who probably does not qualify: people who gave their seed phrase or password to a scammer with no involvement by the exchange, people who sent crypto voluntarily in an investment scam, and people who held assets in a self-custody wallet that was compromised on their own device. Those losses are real, but there is usually no platform to hold responsible. Report them to the FBI's Internet Crime Complaint Center and your local police anyway.

Timing matters in account takeover cases. Exchanges often point to their user agreement to argue that customers are responsible for losses caused by compromised credentials. Your strongest facts are usually the ones showing the exchange had a chance to stop the theft: unusual logins it did not flag, a withdrawal to a new address with no added verification, a support call that went unanswered while funds were moving, or a breach of the exchange's own systems that handed criminals your details.

If you received a Coinbase breach notice but lost nothing, you may still be a member of a proposed class, though data-only claims usually produce small payments. See how much a data breach settlement is worth.

There are no statutory damages specific to crypto theft. Recoveries come from ordinary legal claims:

Claim	What it can recover
Negligence	The value of stolen assets and related losses
Breach of contract	Losses caused by broken security or service promises
State consumer protection law	Damages, sometimes multiplied, plus fees in some states
Data breach laws	Varies; some states allow statutory damages for breaches

Real results vary widely. The $618,000 Coinbase arbitration award shows an individual can recover a full loss plus costs. Data breach class settlements, by contrast, often pay modest amounts per person unless a class member can document an out-of-pocket loss. FTX customers are receiving their recoveries through the bankruptcy, not through the MDL.

How assets are valued matters. A claim may be measured by the value on the date of theft, not today's price, which can cut either way. Keep a record of the market price at the time of each unauthorized transfer, and of any fees or tax consequences that followed, so a lawyer can present a complete damages figure.

• Duty to protect data and accounts. Exchanges hold customer identity documents and funds. Plaintiffs argue that creates a duty of reasonable security, especially against known threats like insider bribery and SIM swaps.
• Contract terms. User agreements set out security features and often limit the exchange's liability. Courts and arbitrators look closely at whether a limitation is enforceable.
• Arbitration and class waivers. Most exchange agreements require individual arbitration and include a class action waiver. That can block a class case but also gives individual victims a faster, private forum.
• State privacy and breach statutes. Some states, such as California, allow statutory damages when a business's failure to maintain reasonable security leads to a breach of certain personal information.

Criminal cases against hackers can lead to forfeiture of seized assets, and victims can sometimes seek restitution there. Those processes are separate from any civil claim against the exchange.

Deadlines depend on the claim, the state, and your user agreement:

• State statutes of limitations for negligence and contract claims typically range from about 2 years to 6 years.
• User agreements may require you to give the exchange written notice and try informal resolution before filing arbitration, with a set waiting period.
• Bankruptcy claims such as FTX have their own bar dates that have long passed for most customers.

Because exchange agreements often require a notice and waiting period before arbitration, starting the process early protects your deadline. A statute of limitations generally keeps running while you go back and forth with support tickets.

1. Lock everything down. Change passwords, move remaining assets, remove SMS as a two-factor method, and add a carrier PIN or port-out lock.
2. Report it. File with the exchange, the FBI's Internet Crime Complaint Center, and local police. Keep the report numbers.
3. Preserve the trail. Download transaction histories, save support chats, and record the wallet addresses that received your funds.
4. Beware of "recovery" services. People who promise to recover stolen crypto for an upfront fee are a common second scam. See how to spot settlement and recovery scams.
5. Find your user agreement. The version in effect when you opened or last used the account controls arbitration and notice rules.
6. Talk to an attorney. Independent attorneys who handle exchange and data breach cases can tell you whether you belong in a pending class case or should pursue arbitration.

The claims in pending cases against Coinbase and others are allegations until decided. If an exchange's failure cost you crypto, a free case review takes about two minutes. For breach notices more generally, read what to do after a data breach notice, and see our data breach lawsuit page.