According to Coinbase, the attack was most likely carried out by 0ktapus. They are highly skilled cybercriminals that also target Twillio, Cloudflare, and at least 130 other companies with identical spoofed SMS-based text messages.