Consumer complaint received 2021-12-17
Company: Coinbase, Inc.
State: CA
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Fraud or scam

Complaint:
On XX/XX/2021 my Coinbase account was hacked as was my cell phone through XXXX and email through XXXX. {$2000.00} worth of cryptocurrency was sold on the Coinbase exchange converted to Bitcoin and dozens of XXXX dollar transferres out of my accout was made. XXXX was overdrafted from my linked XXXX XXXX account that I was able to freeze the very next morning upon discovery. Also contacted Coinbase to Freeze the account and investigate the fraud takeover. Coinbase customer service phone support and email support both walked me through resetting my account password, but I could not get the account to reactive during the ID verify session. Now Coinbase says I'm restricted and they can't do anything because the account has a different email. I had {$2000.00} dollars in staked XXXX that could not be sold, therefore Coinbase is stealing those funds from me making this a double victimization situation. I requested a detailed report of all transaction on my account dated XX/XX/2021, but they have yet to comply with that request. This was the last email XXXX sent me : XXXX XXXX, Thanks for your response. 

The activity took place on a regular XXXX XXXXXXXX device from a VPN protected IP address XXXX - XXXX, IL. This XXXX device and IP address have been used before with this Coinbase account. This indicates the attacker had access to your authenticated Coinbase session via your device. This suggests the compromise may have been the result of a malware or virus infection on your device. 

Your account may have been accessed during a compromised sign-in session using your verified device from the IP address we provided. " Session cloning '' or " session hijacking '' is an attack where a user session is taken over by an attacker. A session starts when you log into a service, for example your Coinbase account, and ends when you log out. 

We recommend you immediately disconnect the infected computer from your local network, consult an IT security specialist, and scan for malware on your device. 

The transactions in question are : XXXX XXXX PM XXXX to XXXX XXXX PST with 21 offsite sends, a total of XXXX XXXX sent to an external account XXXX As a safety precaution, we would strongly encourage reviewing any recently installed browser extensions, remote access applications, and run a malware scan of your devices and network. If you installed any cryptocurrency related software resulting in this infection, let us know the hyperlinks to the application. Please also send us any detections you find in your antivirus/malware scans. 

Unfortunately the email address linked to your original account was changed by the attacker during the compromise therefore the account is now inaccessible. It also appears your account is restricted due to reversed transactions with your bank and an outstanding balance owed to Coinbase. 

For additional information regarding reversals, please contact your bank directly. Coinbase is not responsible for crediting your bank account for any fees incurred by your bank due to reversals. 

We understand that your account may have been compromised and unauthorized activity occurred. We cant prevent an attacker from gaining access to your personal devices or your personal email account used to access your Coinbase Account. However, we do recommend that all customers use unique passwords for all their important logins, enable enhanced 2-factor authentication ( like XXXX XXXX or XXXX XXXX ) if available, and ensure you do not click on any suspicious links from emails you do not recognize. These tips can help you maintain your device and email security. 

Please note, our User Agreement specifically states that users are responsible for creating strong passwords and maintaining adequate security and control of any and all access methods and codes used to access Coinbase. Additionally, Coinbase is not responsible for any loss suffered due to compromise of account login credentials due to no fault of Coinbase. Please visit our security page for more information : XXXX XXXX XXXX We do recognize the difficult position this puts you in. However, this does not change the current status of the account. Therefore, while we are sympathetic to your situation, Coinbase is unable to reimburse you for your loss nor are we able to reverse cryptocurrencies sent off the platform due to the inherent nature of it. 

If you have not already done so, it is imperative that you report this incident to law enforcement agencies in your jurisdiction immediately including the FBI XXXX XXXX XXXX XXXX ( XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX Be sure to include as much detail as possible in your report. Coinbase is willing to offer full cooperation with all law enforcement investigations pertaining to your account 's compromise. 

We hope this information is helpful to you in showing why Coinbase came to this decision. 

Regards, Coinbase Support

Company response to consumer: Closed with explanation