Consumer complaint received 2021-12-20
Company: Coinbase, Inc.
State: VA
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Fraud or scam

Complaint:
Sir, I am XXXX XXXX XXXX living at XXXX XXXX XXXX XXXX XXXX VA XXXX. My cell phone number is XXXX. I am reporting an incident where my XXXX cell account and Coinbase crypto account ( www.coinbase.com ) were both hacked enabling the theives to steal almost {$10000.00} from my Coinbase crypto currency account. In this regard neither Coinbase nor XXXX are accepting any responsibility for this theft with each attempting to place blame on me for the compromise of my accounts on their systems. My passwords in both systems were very strong ( very long having upper and lower case with numbers and special characters ). Both XXXX and Coinbase have had multiple incidents of data breaches and I believe this is the souce of my account compromise. My XXXX phone number was linked to my Coinbase account for two step verification. Once my XXXX account was taken over and transferred to a cell phone in XXXX, that criminal in possesion of that phone was able to use that phone to circumvent the two step sign in verification.

Following is the list of incidents that happened : 1. On XX/XX/2021 my Coinbase account ( www.coinbase.com ) had a cash of {$25000.00} dollars which I had transferred from my linked XXXX XXXX savings account. This was the entire balance in my account on that date and this was the only transer I initiated. This was the balance of the account prior to the theft on XX/XX/2021. 
2. On the morning of XX/XX/2021 while I still was sleeping, around XXXX I suddenly started to receive a lot of emails and text messages. 
3. Around XXXX on my XXXX cell phone there was message saying your XXXX password changed. 
4. At the same time around XXXX another text message came if from my Coinbase account saying my Coinbase password had been changed. 
5. I immediately attempted to get in to my Coinbase account but system no longer accepted my password. Now I was scared that this definitely hacking. 
6. Within a few minutes I received a message from XXXX saying my SIM Card is SWAPPED/Disabled and I will lose service on this phone and I lost service. I never requested any SIM card change and I was sleeping at that time.

7. I immediately tried to reach Coinbase support but their customer service is very bad and long waiting queues and I could not get hold of them. So in order to further stop any damage I requested the Coinbase automated system to lock my Coinbase account.

8. I immediately contacted XXXX to ask why I lost service and why had my SIM been disabled. They told me that there was a SIM swap had been requested by someone in XXXX. I dont know how they allowed it as I am in Virginia and the request was from XXXX XXXX I told them that I never requested this. 
9. Next I went through my emails on XXXX that came from Coinbase account to find out the damage is going on since I dont have access to system any more. Coinbase sends email for each transaction. Following are the transactions that the hacker on XX/XX/2021 did during the timeframe of XXXX to XXXX as per the emails I got : a ) Emails on XX/XX/2021 at XXXX XXXX says hacker initiated a {$5000.00} dollars transaction to my coinbase account from my linked XXXX XXXX savings account ( this was in addition to already available cash of {$25000.00} on my account ) 1. This should have been subject to a 5 day wait period per Coinbase policy. 
2. In spite of that the hacker was able to convert that amount to Bitcoin which became immediately available for the hacker to send out, which he did. 
3. My XXXX XXXX Savings account had only cash around {$1000.00} dollars, and so XXXX XXXX refused the transfer. In spite of this Coinbase credited {$5000.00} dollars towards my compromised account. 
b ) Email at XXXXXXXX XXXX  says hacker converted my {$25000.00} which was already available as cash on my coinbase account. 
c ) Next email from coinbase at XXXXXXXX XXXX is saying that the cash transfer of {$5000.00} failed from XXXX XXXX savings. 
d ) Next email at XXXX is saying hacker successfully sent out externally around {$9500.00} dollars worth of Bitcoin ( XXXX ). As well he sent out another {$120.00} dollars bitcoin. Seems total close to {$10000.00} dollars bitcoin was sent out from my account by hacker. 

I might have missed few more lower amount transactions as well. All above transactions are done from XXXX on XX/XX/2021 by hacker. This is the chain of events that happened as I was able to confirm once I got access to my Coinbase locked account and I am able to see all of them. 

In reference to above chain of events : Opened case with coinbase XXXX Coinbase responsibility ( Case number : XXXX ) : 1. I am not sure how user was able to hack my Coinbase password which was 16 characters base containing numbers, special characters and upper case and lower case characters. Not sure how the hacker was able to get into coinbase system and was able to change the password. Coinbase had multiple breaches of data earlier might have caused this. 
2. Even though I keep on specifying on multiple email communication with Coinbase support stating that the hacker stole around {$10000.00} worth from my Coinbase account, Coinbase is not acknowledging that intentionally ( As on multiple emails skipping to answer my questions ) ignoring any amounts that are lost from my account. As on XX/XX/2021 I had {$25000.00} cash on my account and I did not make any transactions after that. So my account should have {$25000.00} dollars cash and I asked them to reinstate my account to that and they are not answering. 

3. Another most significant event is that coinbase stopped my ability to do any transactions on my coinbase account until I pay the hacker initiated {$5000.00} dollars transaction on XX/XX/2021 for which Coinbase already gave credit of {$5000.00} dollars. Because coinbase allowed hacker to send that XXXX dollars out even before 5 day limit period, he was able to send out. Later XXXX XXXX savings denied that XXXX dollars but Bitcoin already gave credit of XXXX dollars to hacker which he took out. It is coinbase software glitch. Coinbase is making me responsible for that {$5000.00} dollars transaction and stopped my ability to do any transactions on my account which unfair practice. Clearly it is their software issue where it allowed hacker to take out that money even before it is confirmed from XXXX XXXX savings. As well Coinbase initiated automatic recovery of {$5100.00} dollars from my account already for the hacker initiated transaction where their system failed to limit within 5 day period. They are trying to save their money at the cost of customer. Please do not allow this unfair deal. 

XXXX responsibility : Somehow this hacker was able to initiate a SIM transfer from my phone in XXXX to his phone in XXXX. My XXXX  account is supposedly protected not only by a password but also by a personal PIN code which is supposed to protect my account. It is possible the password and PIN were compromised from the XXXX data breach this past XXXX, or it is possible they were able to make this transfer without my password and PIN code. Either way XXXX  allowed a highly suspicious SIM transfer of my phone number to the criminals in XXXX to occur without my knowledge or authorization. I have opened an incident with them as they were not giving any reference number for this. The incident number is : XXXX. 

In summary with all above events, both Coinbase and XXXX are responsible for my loss. They have both had multiple breaches of data and specifically XXXX in XXXX of this year. I had {$25000.00} dollars cash on my account prior to hacker got on to coinbase system. As well coinbase unfairly locked my ability to transact as their system allowed failed {$5100.00} dollars transaction and recovering that from me. 

I request you to investigate on both Coinbase and XXXX  and help me to reinstate my account {$25000.00} cash as was there prior to hacking. 

Enclosures : 1. Attached XXXX is the PDF document with set of emails of my conversation with Coinbase support in PDF evidencing how cleverly they are not acknowledging any of the above. 
2. Attached XXXX is the document with set of emails showing the list of transactions that hacker did including he sent out nearly {$10000.00} dollars of Bitcoin and the failed XXXX XXXX transaction of {$5100.00} for which Coinbase is making me accountable and recovering from my account I appreciate your help in this regard. 

Thank you, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX VA XXXX USA CELL : XXXX EMAIL : XXXX XXXX

Company response to consumer: Closed with explanation