Consumer complaint received 2025-08-13 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Other transaction problem — 
Company: Coinbase, Inc.
State: TX

Complaint narrative:
b'I am reporting a sophisticated fraud scheme involving both unauthorized banking accounts created in my name and security failures at Coinbase that enabled the theft of XXXX from my cryptocurrency account.\nPhase 1: Identity Theft and Fraudulent Bank Account Creation\nOn XXXX XXXX XXXX criminals created multiple bank accounts in my name without my knowledge or consent:\n\nXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXn\nThese accounts were created without any SSN verification or proper identity authentication. I received the physical cards at my home address on XXXX XXXX XXXX which is how I discovered this identity theft.\nPhase 2: Coinbase Security Breach and Unauthorized Transfers\nOn XXXX XXXX XXXX XXXX XXXX XXXX PST, my Coinbase account was compromised and three unauthorized withdrawals totaling XXXXXXXX  were made:\n\nXXXX withdrawn tXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  withdrawn to XXXX XXXXThe funds were transferred directly to the fraudulent bank accounts created in my name. Additionally, unauthorized cryptocurrency trades were executed without my consent.\nCritical Security Failures:\nDespite having two-factor authentication enabled on both my Coinbase and email accounts, I received no authentication codes during the breach. Upon investigation, I discovered numerous API calls from internal IP address XXXX during the unauthorized access period. This is a private IP address (XXXX XXXX XXXX) that cannot access the internet directly, indicating the attack originated from within Coinbase\'s internal network infrastructure. I never created any API keys for my account.\nCompany Responses and Lack of Resolution:\nImmediately upon discovering the unauthorized transactions, I contacted Coinbase at approximately XXXX XXXX XXXX XXXX XXXX XXXX XXXX requesting immediate cancellation of the pending withdrawals. Coinbase support representatives specifically told me that if I deactivated my account, the transactions would be canceled and would not proceed. Based on this assurance, I immediately deactivated my account as instructed. However, despite following Coinbase\'s guidance and deactivating the account within hours of the unauthorized access, all three withdrawals still completed and the funds were transferred to the fraudulent bank accounts on XXXX XXXX XXXX\nThis represents a critical failure on Coinbase\'s part - they either provided false information about their ability to cancel transactions, or they failed to implement the cancellation despite having multiple days to do so before the XXXX XXXX  transfer date. Coinbase acknowledged the breach XXXX XXXX but has failed to provide the detailed information I requested, including:\n\nComplete transaction logs showing exactly where my funds were transferred\nDetailed explanation of how their internal systems were compromised (specifically the API access from private IP XXXX\nInvestigation report explaining how attackers bypassed two-factor authentication\nClear explanation of why the promised transaction cancellation failed\nCurrent location and status of my stolen funds\n\nInstead, Coinbase has only provided vague acknowledgments and refused to give substantive details needed for recovery or understanding of the security breach. In their official response, Coinbase claimed the attack originated from IP address XXXXXXXX XXXX XXXX XXXX  contradicting my earlier findings of internal API calls from private IP XXXX.\nMost concerning, Coinbase has attempted to shift all responsibility to me, claiming in their response that "users are responsible for the security of their devices and credentials" and that "digital currency transactions cannot be reversed." However, they have failed to explain:\n\nHow attackers bypassed two-factor authentication without any codes being sent to me\nWhy their promised transaction cancellation (made during my phone call) was never executed\nHow internal API calls from private IP addresses were possible\nWhy no security alerts were triggered during the breach\nHow attackers gained access to both my account credentials AND my email account simultaneously\n\nCoinbase\'s response essentially dismisses their own security failures and places blame on the victim, despite clear evidence of internal system compromise. They have closed my case and refused further investigation, claiming the matter is "irreversible" while providing no meaningful assistance or explanation for their security lapses.\nWhen I contacted the fraudulent banks:\n\XXXX  confirmed transactions occurred but provided minimal assistance\nStepXXXX XXXX  was uncooperative and terminated calls when I requested dispute assistance\XXXX  XXXX acknowledged the fraudulent accounts but resolution has been insufficient\n\nFinancial Impact:\nThe XXXX  account showed a balance XXXX XXXX XXXXefore closure, confirming receipt of stolen funds. Despite requesting chargebacks and disputes from all involved financial institutions, I have not recovered any stolen funds.\nThis represents a coordinated attack involving identity theft for fraudulent account creation, exploitation of banking system weaknesses, and critical security failures within Coinbase\'s infrastructure. I am seeking full reimbursement of stolen funds and proper investigation into how multiple financial institutions failed to prevent this fraud.'

Company response to consumer: Closed with explanation