Consumer complaint received 2026-04-30 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Other transaction problem — 
Company: Coinbase, Inc.
State: FL

Complaint narrative:
This is the most important field in the CFPB form. Important guidance first : Note the warning : " Do not include personal information, such as your name, account number, address, Social Security number, etc. '' So this version needs to be different again no personal identifiers. About the " publish on consumerfinance.gov '' checkbox : This is a personal choice. Here 's the tradeoff : Check it : Your complaint becomes public on CFPB 's database ( with personal info redacted ). This adds public pressure on Coinbase and helps other potential victims of similar issues find your case. Some plaintiffs ' attorneys actively monitor these databases looking for class-action patterns. Don't check it : Your complaint is still investigated and Coinbase still has to respond it just isn't public. I'd recommend checking it. The CFPB redacts personally identifying details, and a public record of Coinbase failing to flag a clear account-takeover pattern can help others ( and potentially benefit you if a class action ever materializes ). But it's your call. Paste this into the description box : The CFPB framing is different from IC3 and FTC here, the focus is on Coinbase 's conduct as a regulated financial company, not just describing the theft. So the narrative emphasizes what Coinbase failed to do. On XX/XX/year> at XXXX XXXX, an unauthorized change was made to my Coinbase account 's XXXX verification settings. I did not initiate this change. I retained the email Coinbase sent confirming the XXXX change. Approximately XXXX hours later, on XX/XX/year> at XXXX XXXX, an unauthorized withdrawal of XXXX XXXX ( approximately {$9100.00} USD ) was executed from my Coinbase account and sent to an external XXXX address. I did not authorize this transaction. I was traveling out of state at the time, attending a family wedding. The XXXX gap between the unauthorized XXXX change and the unauthorized withdrawal corresponds to Coinbase 's XXXX XXXX withdrawal hold period. This pattern - XXXX change followed by full account drain at the moment the security hold expires- is a textbook indicator of account takeover. Coinbase 's automated fraud detection systems should reasonably be expected to flag this pattern, particularly when the withdrawal occurs at XXXX XXXX and constitutes the entire account balance. To my knowledge, Coinbase did not pause, hold, or seek verification on this withdrawal despite these red flags. Aside from the XXXX email, I did not receive any of the standard Coinbase notifications that should have accompanied this activity ( new device sign-in alert, withdrawal authorization request, withdrawal confirmation email ). This indicates either that the attacker was able to modify notification settings on my account without further security checks, or that Coinbase failed to send these standard alerts. I contacted Coinbase to report the unauthorized activity and request investigation, recovery, and a refund. Coinbase declined to refund the funds and, to my knowledge, did not conduct or share with me a detailed investigation of how the perpetrator gained access, what IP addresses were used, or what device fingerprints were associated with the unauthorized activity. I have not received any meaningful information from Coinbase about the security failure that allowed this theft. I have since traced the stolen XXXX across the public blockchain through multiple intermediary " burner '' wallets to what appears to be a custodial cryptocurrency service. I have filed reports with the FBI 's IC3, the FTC, and the XXXX XXXX XXXX XXXX XXXX ( Report XXXX ). WHAT I AM REQUESTING FROM CFPB : That Coinbase be required to provide a complete copy of the account access logs, login history, IP addresses, device fingerprints, and account-change records for my account covering XXXX XXXX XXXX That Coinbase explain why their fraud detection did not flag a XXXX change followed by a full account drain occurring at XXXX XXXX as a high-risk pattern requiring additional verification. That Coinbase explain why standard withdrawal notifications were not received. That Coinbase be required to participate in good-faith investigation alongside law enforcement to identify the perpetrator, given that they hold records that I as a customer can not access. Consideration of refund or partial refund given the security failures involved.

Company response to consumer: Closed with monetary relief