Consumer complaint received 2021-12-02
Company: Coinbase, Inc.
State: NV
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Fraud or scam

Complaint:
I am writing to seek your assistance in recovering the {$170000.00} USD that were stolen from my Coinbase XXXX account on XX/XX/2021. I believe Coinbase should be held accountable for my losses based on their lack of security measures and non-existent customer service which allowed the attacker the time to execute the theft. 

On XX/XX/2021, I was the victim, when my Coinbase pro investing account was drained of over {$170000.00} in U.S. Dollar assets comprised of XXXX Bitcoin and XXXX Etherium tokens. In trying to stop the hack, lock my account, and gain knowledge of what happened, Coinbase was unresponsive. Their lack of security measures resulted in a total loss of the account and minimal contact for almost 7 days. 

The lack of security measures and ability of Coinbase to take proper action when requested allowed the attacker to steal {$170000.00} from my family. 

The sequence of events is as follows. 

I received a new XXXX XXXX XXXX  from XXXX on XX/XX/2021. While setting the device up, I was unable to link the two-factor authenticator application to my Coinbase XXXX  XXXX  investing account. I then went to the Coinbase website to trouble shoot and contact customer support for assistance. While doing so I was sent to a site with a phone number that I contacted. The procedure that followed was nearly identical to one in which I performed just a few weeks prior to rectify a similar issue for my other employer, XXXX XXXX. Nothing seemed out of the ordinary. 

The individual had me log into my accounts to relink the device to the authenticator application. At some point the individual was able to transfer funds without my knowledge to their own XXXX wallet. I did not authenticate any device as my new device was not receiving the security codes to do so. At no point did I give out my device password or Coinbase password. I was never queried to enter my two-factor authentication code to confirm a transfer. 

I received a single email stating that a transfer of XXXX XXXX ( approximately {$56000.00} USD at that time ) was transferred to a XXXX  address : XXXX. 

When I received this email, I immediately went to the Coinbase website to lock my account on fear of a compromise. I sent 5 lock attempts and support request emails to Coinbase. I did not receive any further notification or correspondence from Coinbase, and the account was not locked for nearly 12 hours or more. Coinbase had no information for me on the status of my account and what had happened for 7 days. This is unsatisfactory from a major investing firm and publicly traded company. This negligence allowed the attacker to empty the rest of my hard-earned assets. 

It took Coinbase 7 days to finally respond to my over 15 support requests about what happened to my account. They stated that the attacker was able to gain access to my account in some unknown way and change all my security settings without my knowledge or verification and further transfer the remaining balance of my account to a total of two crypto addresses. Coinbase never verified the change of the email address on my account or any other security settings that I was told by Coinbase were changed. Coinbase allowed all my account information to be changed and my account to be drained without ever verifying these settings changed with the original email or phone number. Their system is very easily hacked, and this should NOT BE ALLOWED. 

In total the resulting transfer of my assets without my knowledge was as follows : XX/XX/2021, XXXX XXXX was sent to the external wallet : XXXX XX/XX/2021, XXXX XXXX was sent to the external wallet : XXXX I have since contacted Coinbase on countless occasions since the theft without resolution. Coinbase responds in a short generic email offering no assistance or resolution. 

I have filed a police report with my local XXXX, NV Police department, filed a complaint with the FBI XXXX XXXX, the SEC, and the Federal Trade Committee to gain some form of resolution on the incident.

Coinbase lacks adequate security measures and customer support capability to maintain its status without regulation or oversight in the Crypto investing sector. Something must be done for personal investors to ensure their safety going forward. It is more difficult to login to my email account than it is for an attacker to gain access to my Coinbase account and change my settings without knowledge and steal my assets.

Coinbase has almost no customer service or ability to prevent a hack. I notified them after I was first alerted that malicious activity was occurring. It wasn't for another XXXX hours before they finally locked my account. It was far too late at that point. There is no ability to contact them to stop this from happening again and again. 

The fact that I was never notified of account changes or asked to confirm them, the attacker was able to circumvent the two-factor authentication process and transfer my assets without my knowledge, their inability to take swift action when requested to lock the account, and lack of communication and customer support to rectify the theft is criminal and they should be required to rectify these issues immediately. 

This should have never been able to happen to me and should never be allowed to happen to another investor going forward. In doing minimal research on Coinbase and this incident I was easily able to find that their negligence extends to over thousands of clients. Over 6000 investors of Coinbase were hacked in a similar fashion resulting in the theft of thousands of clients hard earned money.

Coinbase should be subject to further regulation and oversight going forward. They should be required to increase their security measures and be accountable for my losses in this theft as well as other investors losses going forward. 

The crypto currency sector should be regulated for the United States citizens protection. 

It is criminal that Coinbase has done nothing to protect my account, offer and customer support, take appropriate security measures when notified by me, and resolve the loss of my {$170000.00} USD. It is criminal that I have the addresses of where my funds were transferred to yet can do nothing about it.

Company response to consumer: Closed with explanation