Consumer complaint received 2024-01-03
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Other transaction problem — 
Company: Coinbase, Inc. (FL)

Subject : Urgent : Unauthorized access & BTC transfer from Coinbase account. 

I am writing to report a serious security breach on my Coinbase account that resulted in the unauthorized transfer of Bitcoin ( BTC ). Please consider this email and the attached evidence a formal request for a Continued investigation and restitution. Coinbase has also been contacted and responded to the Cyber Crime Unit Detective XXXX of the XXXX XXXX, FL police department. Detective XXXX is also working with Federal Authorities on my behalf for this theft and breach of Coinbase security. 

Evidence of unauthorized access : Double-factor authentication : My account is protected by both SMS text code and XXXX XXXX XXXX for logins. Despite this, Coinbase security failed to recognize an unknown device used to access my account. Both my phone and computer, devices associated with my account for years, displayed " Not My Device '' warnings upon unauthorized login attempts ( see attached screenshots ). 

Coinbase Chat transcript ( XXXX XXXX, XX/XX/XXXX ) : During a chat, a Coinbase employee confirmed that transferring BTC requires a XXXX Authenticator code, impossible without access to my phone or a SIM swap. 

Restaurant receipt and XXXX location data : At the time of the transfer ( confirmed by transaction details ), I was at a restaurant ( verified by receipt, available upon request ) and my phone was with me away from home and my computer was turned off ( XXXX data available upon request ). 

Questions and concerns : How did the hacker bypass Coinbase 's " Not My Device '' security measure and initiate a transfer with an unrecognized device? 
The failure of Coinbase 's device recognition system alone suffice as evidence of a security breach and Coinbase 's liability for this loss. 
If the XXXX Authenticator code was used to verify the transfer of the XXXX BTC, please supply me, my attorney 's and Detective XXXX with proof of the XXXX Authenticator code used. 
I request a CONTINUED thorough investigation of this incident and a full refund of the stolen XXXX BTC. Please contact me, or XXXX XXXX or my attorneys XXXX XXXX XXXX which you have already have been contacted to discuss this matter further and provide any additional information you may require. 


My name is XXXX XXXX XXXX. I was scammed out of {$100000.00} of Bitcoin BTC from Coinbase and I believe it was an inside job. On XX/XX/XXXX, in the evening XXXX XXXX eastern time, I tried to log into my Coinbase account to transfer some Bitcoin ( BTC ) from my XXXX XXXXXXXX XXXX hard wallet. I was unable to log in, so I tried to reset my password. I entered a new password and tried to log in again several times, but I was still unable to sign in. I was not locked out of my account, but I didn't want to continue entering incorrect passwords in order to avoid locking it. I proceeded to click on the Coinbase support chat. I am certain that I was on the Coinbase chat page, and I did not leave the site to open another page, XXXX search for Coinbase support, or search for a Coinbase phone number. I continued on chat, and since my new password wasn't working, the Coinbase chat person provided me with a phone number to call : XXXX. 
I called this number from my office landline Voice over IP ( VoIP ) phone and spoke with support for 1 hour and 18 minutes. We proceeded to work on my password. I did not disclose the new password, and the support person did not ask for it on this call. All the while I was on the phone with the support person, I was also still on the Coinbase chat. The chat person would ask once in a while if I was still active, and I replied yes. I got disconnected from the XXXX number on my office phone, and almost immediately the same support person called my mobile. I did not disclose to the support person on the office phone what type of phone I was on, nor did he ask. I have no idea how the fake support person from XXXX could have known my mobile number and my tenure as a Coinbase customer. The guy on the phone already knew that information. With that, I had no reason to distrust him. Once the support person on the XXXX number called my mobile, we were able to log into my account along with the chat person. The fake support person on the phone knew of my long account history and proceeded to tell me that for IRS reasons, I needed to transfer the XXXX BTC back onto Coinbase that I moved from Coinbase in XX/XX/XXXX due to my long inactive account history. Once I gained access into the Coinbase account with my hard wallet plugged in, I proceeded to transfer the XXXX BTC into the Coinbase Vault. The support person on the phone acknowledged that was the safe thing to do. But, the support person on the phone said I should approve the transfer from the BTC Vault that same night, XX/XX/XXXX, XXXX. I trusted him because he knew things about my account that I did not disclose. He asked about my Ethereum ( ETH ) assets as well, and I informed him that I was not transferring those, nor would I remove various other assets from the Coinbase Vault to the Coinbase exchange. I was on the phone for a total of XXXX hours from my office phone and mobile phone. After the transfer of my BTC from hard wallet to Coinbase Vault was complete, and my authorization from Vault to Exchange was complete, we hung up. I did not 4 speak with him or chat since that final time on XX/XX/XXXX, XXXX. I returned home on XX/XX/XXXX at XXXX XXXX from the restaurant to transfer my needed XXXX BTC to USDC and move the remaining BTC back to my hard wallet. To my stupidity and shock, I saw that my XXXX BTC had been transferred out 10 minutes prior to my arrival home. I then spent more hours on chat and voice support regarding my issue. Over the proceeding weekend with XXXX chats, I have found that this similar issue has happened to others and the sophisticated hack, knowledge of accounts, history, other assets, has to be a partial inside job within Coinbase relaying information to attackers.