Consumer complaint received 2021-10-03
Company: Coinbase, Inc.
State: DC
Product: Money transfer, virtual currency, or money service
Sub-product: Mobile or digital wallet
Issue: Unauthorized transactions or other transaction problem

Complaint:
I have had a Coinbase account since XXXX of XXXX. At that time, I bought several different cryptocurrencies. In early XXXX ( XXXX and XXXX ), I sold about half my holdings. After that, there was no activity on my account since I planned to be a long-term holder rather than a trader. Early this year, I transferred {$10000.00} into my coinbase account to buy a few cardano/ADA coins . Since then, there has been no activity until XX/XX/XXXX. Here is a summary of the events that transpired on XX/XX/XXXX. 
1. At about XXXX XXXX., an email was sent to my XXXX address notifying me that the change had been instituted on the 2-factor authentication ( 2FA ) settings of my Coinbase account [ 1 ]. I should note that I do not use SMS notification for generating the 6-digit codes, since the literature states that these are less secure than dedicated authenticators. I use XXXX authenticator. I do not check my email very often, and therefore did not see this email until much later. No text was sent to my phone at this time. 
2. At XXXX XXXX I received a text message on my phone stating that my 2FA settings had been changed and if I did not make these changes, I should freeze my account [ 2 ]. Since my phone alerts me when I get a text, I immediately responded to it, unlike the earlier email that I had not noticed.

3. I tried to log into my account using my XXXX XXXX laptop computer. My first two or three attempts to enter the 2FA code generated by my XXXX authenticator were not accepted. I found this puzzling and did not understand what was going on. Around XXXX XXXX, suddenly the XXXX authenticator-generated six digit code was accepted by my Coinbase account and I was able to get into my account. I found that my balance, which had been {$280000.00} earlier that day was now only {$0.00}. I placed a freeze on my account, even though the money had clearly already been moved out [ 3 ].

4. From what I have been able to reconstruct, around XXXX XXXX, my account was accessed from IP address XXXX, using a XXXX device [ 4 ]. This IP address is located in XXXX XXXX, XXXX. I have never been to XXXX, do not know anyone in XXXX. I do not use a XXXX device and never have. Over the past 4 years that i have had a Coinbase account, I have never accessed it from outside the US. So this activity was clearly suspicious but Coinbase did not block further activity. 
XXXX. The hacker sent XXXX XXXX coins I owned to a wallet outside Coinbase ( XXXX : : : ucl : XXXX ) [ 5 ]. They then converted all my other altcoins to bitcoin [ 6 ] and transferred all the bitcoins that resulted from these transactions in addition to my own long held bitcoins to an outside wallet at XXXX XXXX  ( XXXX ) [ 7 ].

6. The hacker transferred {$1000.00} from my bank account at XXXX XXXX XXXX  XXXX  to the Coinbase account [ 8 ]. They bought XXXX BTC with this money [ 9 ] and immediately transferred the BTC to an external account [ 10 ]. This is counter to Coinbase regulations that cryptocurrency bought on an account can not be moved for 5 days. 
7. I checked with XXXX XXXX, my cell phone service provider and they assure me that there is no evidence of a SIM-swap. The SIM card associated with my phone number is the one that is physically in my phone. Both XXXX  and Coinbase accounts are protected by secure passwords that are unique to those sites. 2FA is used for both of these sites. I have checked the activity on my XXXX  account and there has been no suspicious activity over the past 28 days [ 11 ].

8. Coinbase refuses to take any responsibility for the hacking incident [ 12 ].

9. I have kept my account locked since then. I have no idea what is happening in the account since I have not been able to get any further information from Coinbase. I have asked them to close out my account, but they have not done so, despite my repeatedly asking the to over the past several days [ 13 ].

Company response to consumer: Closed with explanation