BlockTower's Ari Paul Accuses Coinbase of Hiding $25 Million Loss and $1 Billion in Concealed Hacks

BlockTower Capital founder and chief investment officer Ari Paul posted on X on September 28 accusing Coinbase of covering up a security breach that cost his firm roughly $25 million years ago, and of concealing a pattern of hacks across the industry totaling more than $1 billion.

Paul's claim, reported by Crypto Briefing, TechFlowPost, ChainCatcher, Phemex, PANews and ABAB News, breaks down like this: Coinbase originally attributed a $25 million loss of BlockTower's funds to some other cause. Paul now says his own investigation points to a different explanation, that Coinbase was actually covering up repeated large-scale hacking attacks and never returned the money.

Paul went further, saying his team tracked at least a dozen other affected institutions, with total concealed losses exceeding $1 billion. He said he can't share more specifics because multiple legal proceedings tied to the matter are still active.

What exists right now is an allegation made on social media by a party who says litigation prevents him from showing his work.

What's Proven, What's Not

No court filing, regulatory action, or independent audit has surfaced to confirm the $25 million figure, the $1 billion industry-wide total, or the identities of the other alleged victims. As of September 29, according to Crypto Briefing, no credible third-party evidence had been published corroborating any part of Paul's timeline or scope.

Coinbase's customer support account reached out to Paul by direct message after his post went live, according to TechFlowPost and ABAB News. The company has not issued a press release, made an on-record statement to media, or offered a public denial.

Companies routinely decline to litigate disputes in public, especially when the other party says his own lawyers have him boxed in on disclosure. But it also means Coinbase hasn't offered its side of this specific accusation, and readers should treat both the accusation and the silence as exactly what they are: unresolved.

The Breach Coinbase Has Actually Disclosed

Separate from Paul's new claims, Coinbase has previously disclosed a real security incident, according to ABAB News. The company said overseas customer-service contractors were bribed to steal customer data, that Coinbase refused to pay a $20 million ransom demand, and that it estimated repair and voluntary compensation costs between $180 million and $400 million. Coinbase has emphasized that prime accounts, hot wallets, and cold wallets were not directly breached in that incident.

A 2025 arbitration ruling, also detailed by ABAB News, found that a Coinbase customer lost approximately $328,700 in crypto assets to a social-engineering attack in 2024. The arbitration tribunal ordered Coinbase to pay the customer roughly $618,000. The ruling noted that data issues tied to contractor TaskUs were known internally in January 2025, but the affected customer wasn't notified until May 2025, a four-month gap. Class-action filings referenced in the same report allege outsourced employees sold customer records for about $200 per photo, with as many as 200 records taken in a single day.

These facts are on the record: a known breach, a specific dollar figure, an arbitration award, a documented notification delay. Paul's $25 million and $1 billion claims are something else entirely, unverified allegations layered on top of a company that has already admitted to one serious lapse.

The Fair Read on Both Sides

A reasonable Coinbase defender would point out that the company has already been transparent about a real breach, paid out a real arbitration award, and stated plainly that core wallet infrastructure wasn't touched. On that view, Paul's newer claims could be an attempt to fold an old, already-litigated dispute into a bigger, scarier narrative without new proof.

A reasonable skeptic would counter that Coinbase sat on the TaskUs data issue for four months before telling an affected customer, according to the arbitration record cited by ABAB News, and that a company with that track record doesn't get the benefit of the doubt on a fresh accusation just because it hasn't been proven yet. Legal gag orders make allegations like Paul's hard to verify by design, which cuts both ways: it protects against unproven smears, but it also means genuine victims can be stuck unable to show their evidence.

Neither the $25 million figure nor the $1 billion industry total has independent corroboration as of this writing. Whether that changes depends on what the ongoing legal proceedings Paul referenced eventually produce, and whether Coinbase moves from private messages to a public, on-record response.