BlockTower founder presses $25m Coinbase loss claim

BlockTower Capital founder Ari Paul has accused Coinbase of failing to return about $25 million belonging to his firm, while alleging that similar security breaches affected at least a dozen institutions and involved more than $1 billion.

Paul, BlockTower’s founder and chief investment officer, made the claims in a social-media post on September 28, saying the loss occurred “a couple years ago”. He alleged that what initially appeared to be a loss of his firm’s money was connected to repeated hacks and said multiple legal processes were under way, limiting what he could disclose.

Coinbase has rejected the broader accusation. The cryptocurrency exchange said it was not concealing a series of hacks and “certainly didn’t lose $1B”. It declined to discuss specific customers, leaving Paul’s $25 million claim unresolved publicly. No publicly available evidence identified so far independently establishes either Paul’s $25 million figure or his assertion that losses across other firms exceeded $1 billion.

The dispute emerged as Coinbase and Citi announced an expanded payments collaboration on September 28, linking traditional banking infrastructure with stablecoin payment rails for corporate and institutional customers. Citi said Coinbase had selected its Virtual Account Wallet, offered through banking-as-a-service, to support Coinbase Virtual Accounts and automatic conversion of incoming fiat money into stablecoins.

Under the arrangement, Spring by Citi will also enable institutional clients to accept stablecoin payments at checkout through Coinbase Payments, with conversion into fiat currency and settlement by Citi as bank of record. The companies presented the collaboration as a way to reduce the operational complexity of connecting conventional banking services with blockchain-based payments.

Paul’s allegations therefore landed as Coinbase was highlighting deeper integration with a major global bank, sharpening attention on security and counterparty risk surrounding digital-asset infrastructure. The allegations concern past events and have not been linked publicly to the Citi arrangement.

Paul said BlockTower had traced what it believed was a wider pattern to at least a dozen other affected firms. He did not identify those institutions, specify when the alleged breaches occurred or release documents supporting the aggregate loss figure. He said Coinbase had still not returned BlockTower’s money.

Coinbase said it advises customers to follow security practices, including safeguarding application programming interface keys. The company said that, as with many businesses offering API-key access, it does not retain information needed to transact on customer accounts. That response did not establish the cause of the loss alleged by Paul.

The claims are distinct from a data-theft incident Coinbase disclosed to US regulators in May 2025. In that episode, the company said criminals paid contractors or employees working in overseas support roles to obtain customer information from internal systems. Exposed information included names, addresses, contact details, masked bank information, identification images and transaction histories.

Coinbase said passwords and private keys were not compromised in that incident. Its regulatory filings show that it paid $311.2 million during 2025 in voluntary customer reimbursements and direct legal costs connected with the data theft. The company’s annual filing said it had not identified other cybersecurity risks during that fiscal year, apart from the disclosed episode, that materially affected operations, strategy, results or financial condition.

There is no verified public evidence tying the 2025 data-theft incident to the losses Paul alleges. His statement places the purported BlockTower loss several years earlier but gives no exact date, mechanism or account-level details that would allow the claim to be independently matched to a disclosed Coinbase incident.

BlockTower itself no longer operates as a standalone business under its former name. Digital-asset manager Arca acquired the firm, with Arca stating that BlockTower became part of Arca effective April 30, 2025. Paul nevertheless referred to the disputed funds as belonging to his firm when describing the alleged Coinbase loss.