Coinbase User Agreement Update: Why It Matters After a Hack

On December 17, 2025, Coinbase introduced an updated version of its User Agreement.

While many users expected major changes to arbitration and dispute‑resolution rules, those provisions were not amended and continue to govern how hacked‑account and stolen‑funds disputes must be resolved in 2026.​

For victims whose crypto was stolen from Coinbase, understanding how these terms allocate risk, limit liability, and channel claims into arbitration is critical to planning an effective recovery strategy.

New Services, Same Arbitration Framework

The update primarily adds and clarifies new services rather than changing the core dispute‑resolution mechanics.​

• Coinbase introduced a Token Sale Platform that lets users purchase newly issued digital assets directly from third‑party developers, with Coinbase acting only as a platform provider.​

• The agreement clarifies that U.S. equities trading is conducted through Coinbase Capital Markets Corporation, a registered broker‑dealer affiliate that is legally separate from Coinbase’s digital asset services.​

Even with these additions, the mandatory arbitration provisions and class‑action waiver that apply to most crypto‑related disputes remain in place.

Limitation of Liability

The User Agreement continues to impose significant limitations on Coinbase’s liability.

In most circumstances, a user’s potential recovery is capped at the value of the supported digital assets held in the user’s wallet at the time the claim arises.

Users also generally waive the right to recover lost profits, loss of business opportunities, diminution in value, data loss, or other indirect or consequential damages.

Coinbase also provides its services on an “as is” and “as available” basis, disclaims most warranties, and does not guarantee that transactions will be executed accurately or at all.

Liability beyond these limits is permitted only if a court makes a final determination that the harm resulted from Coinbase’s gross negligence, fraud, willful misconduct, or intentional violation of law.

Coinbase’s allocation of responsibility for account security remains unchanged. The User Agreement places responsibility on users for safeguarding login credentials and expressly disclaims liability for losses resulting from compromised credentials, unauthorized access, or misuse of the Trusted Contacts feature.

Coinbase’s Formal Complaint Process remains unchanged

The User Agreement’s Formal Complaint Process remains unchanged.

Under Section 7.2, users must first attempt to resolve any dispute by contacting Coinbase Support.

If the dispute is not resolved through Coinbase Support, users are required to complete Coinbase’s Formal Complaint Process before filing any arbitration claim under Section 7.3.

Failure to complete the Formal Complaint Process may result in dismissal of the arbitration.

If a dispute proceeds to the Formal Complaint Process, users must submit a complaint using Coinbase’s designated complaint form (or request the form from Coinbase Support), describing the dispute, the requested resolution, and any relevant information.

The Formal Complaint Process is deemed complete when Coinbase responds to the complaint or forty-five (45) business days after Coinbase receives it, whichever occurs first.

Because arbitration cannot be initiated until this process is completed, the Formal Complaint Process serves as a mandatory procedural prerequisite to arbitration under the User Agreement.

For a step-by-step overview of how to comply with Coinbase’s Formal Complaint Process, see:

Arbitration Process Remains Unchanged

The User Agreement’s arbitration provisions also remain unchanged.

Once the Formal Complaint Process is completed, disputes that are not resolved must continue to be pursued through binding arbitration in accordance with the procedures set forth in the User Agreement.

For a detailed, step-by-step overview of how Coinbase arbitration works in practice – including filing requirements, timelines, and procedural considerations – see our previously published guide:

Users should also be aware that the User Agreement continues to include a broad waiver of procedural rights.

Claims against Coinbase must be brought on an individual basis only, and users waive the right to participate in class, collective, or representative actions.

In addition, the User Agreement expressly includes a jury trial waiver, meaning that if any dispute were to proceed in court, it would be resolved by a judge rather than a jury.

The arbitration provisions further permit fee-shifting in limited circumstances. A user may be required to pay Coinbase’s attorneys’ fees and costs if an arbitrator determines that a claim was frivolous or brought for an improper purpose, or if a court finds that the user failed to satisfy required pre-arbitration conditions.

Contact Us

If your Coinbase account was hacked and your crypto was stolen, contact Dilendorf Law Firm to discuss your recovery options and case strategy.

​Our team has represented victims in 130+ crypto cyber-theft arbitrations across major forums (AAA, JAMS, NAM), including cases against Coinbase and other leading U.S. exchanges.

​The firm focuses on stolen-crypto recovery, SIM-swap and account-takeover cases, and User Agreement–based arbitration claims, integrating blockchain forensics and coordinated law-enforcement engagement where appropriate.

Led by crypto attorney Max Dilendorf (practicing in this space since 2017), the firm represents clients nationwide and internationally in high-stakes exchange disputes.

Email info@dilendorf.com or call (212) 457-9797 to schedule a confidential consultation about your Coinbase theft case.