Consumer complaint received 2026-03-05 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: Coinbase, Inc.
State: WA

Complaint narrative:
On XX/XX/year>, my Coinbase account was compromised by an unauthorized third party who gained access via my hacked XXXX account. The attack began at approximately XXXX XXXX PST and I reported it to Coinbase within XXXX minutes. The attacker executed the following unauthorized transactions in sequence : XXXX. Sold my XXXX and XXXX holdings and immediately used the proceeds to purchase a fraudulent scam token called XXXX ( Contract : XXXX ) which has no legitimate value and is flagged as malicious on Coinbase XXXX own platform ( screenshot attached ). The XXXX token was created on XX/XX/year>, consistent with a coordinated pump-and-dump scheme. XXXX. Executed an unauthorized ACH pull of {$4200.00} from my XXXX XXXX XXXX account and used those funds to purchase additional quantities of the same malicious token. XXXX. Sold my remaining XXXX holdings into XXXX ( ~ {$4200.00} ), which remained in my account as Coinbase blocked it from being transferred or withdrawn. All transaction emails confirming this exact sequence including timestamps, reference numbers, and the XXXX balance sitting in my account after all other activity are attached. I had multiple active security measures on my account including an XXXX Passkey ( hardware-backed XXXX ), satisfying Coinbase XXXX Account Protection requirements. The attacker used a different unrecognized device to access the account. I have filed the following official reports : - XXXX Report ID : XXXX - XXXX Police Department Report : XXXX XXXX XXXX XXXX confirmed the {$4200.00} ACH as unauthorized fraud and reversed it on XX/XX/year>. I have the XXXX confirmation documentation available upon request. The ~ {$4200.00} XXXX in my account was the direct proceeds of my stolen XXXX holdings and is completely unrelated to the fraudulent ACH transfer. These are XXXX distinct criminal acts : ( XXXX ) theft and conversion of my XXXX into a worthless scam token flagged as malicious by Coinbase XXXX own platform, ( XXXX ) an unauthorized ACH pull from my bank to buy more of the same malicious token, and ( XXXX ) theft and conversion of my XXXX into XXXX which Coinbase themselves blocked from leaving my account. Coinbase placed this XXXX on an explicit fraud protection hold, which they extended to XX/XX/year> for security review purposes. However, on the same day they extended that fraud protection hold ( XX/XX/year> ), Coinbase 's automated system simultaneously swept the entire ~ {$4200.00} XXXX balance to cover the ACH reversal directly contradicting their own fraud hold on the same funds. Both emails are attached confirming this occurred on the same day. This means Coinbase treated the same funds as both protected fraud evidence AND collectable debt simultaneously. This is internally contradictory and constitutes an unfair and deceptive business practice under the Washington Consumer Protection Act ( RCW 19.86 ). Under Regulation XXXX ( XXXX CFR XXXX ), my liability for the unauthorized ACH transfer is strictly capped at {$50.00} as I reported the unauthorized activity within XXXX business days ( reported it next day, when I saw it processing in my bank account ). I am not liable for a debt created by a criminal using my compromised account without my consent. I am a Coinbase XXXX member ( $ XXXX ) with an active Account XXXX warranty claim for this verified third party breach. At the time of the incident my account was protected by an XXXX XXXX ( hardware-backed authentication ), satisfying the reimbursement requirements. Coinbase opened a fraud case and assigned a case XXXX ( XXXX ) who confirmed the investigation was active and ongoing. Despite this, Coinbase XXXX automated system executed the asset XXXX while the manual fraud investigation was open and before any finding of fault was made against me. When I followed up, I received a completely generic template response from a different agent ( XXXX ) that ignored all prior documented correspondence, my detailed legal summary citing applicable law, my law enforcement reports, and my Coinbase XXXX warranty claim entirely.

Company response to consumer: Closed with explanation