Consumer complaint received 2026-02-11 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Other transaction problem — 
Company: Coinbase, Inc.
State: WA

Complaint narrative:
On the XXXX of XX/XX/2026 I accidentally and unknowingly downloaded A virus and although I ran A virus scan it came back clean. On the XXXX of XX/XX/2026 I woke up to find that several accounts of mine had been compromised, specifically every one of them that had A password saved in my browser. After downloading Malware-bytes and running A scan it found a XXXX  that was disguising itself as my browser. After successfully removing the virus and changing the passwords to all accounts that had their passwords saved on my browser. Coinbase was not an account that I had my password saved on and neither was my email. After completely turning off my computer and disconnecting it from the electricity I thought that was the end of it. I then wake up on the XXXX of XX/XX/2026 sometime in the afternoon to four messages in my phone indicating that I had sold XXXX $ of Bitcoin at XXXX XXXX XXXX $ of Etherium at XXXX, and have successfully initiated a withdrawal to a XXXX account for XXXX $ at XXXX. The fourth notification was one that I received in the afternoon about my account being locked after all the actions had taken place. I was able to confirm latter that the message was sent right after the withdrawal request at XXXX but I didn't receive it until a couple hours latter. I got in contact with a representative of Coinbase at XXXX the same day through the request a call feature. I informed them that my account had been hacked and that I needed to cancel the pending withdrawal as soon as possible. They informed me that as long as my account was locked no withdrawals could happen, and that any pending withdrawals would be canceled. The call was disconnected several times during these attempts, of witch I received different pieces of info in regards to if they would be able to cancel a pending withdrawal. My case was eventually escalated to the specialist support team and I received an email at XXXX on the XXXX acknowledging the problem and that they are reviewing my concern. I responded at XXXX the same day questioning how they where able to get in without 2fa verification since I never received any 2fa codes from my phone or email and bother where uncompromised, and if they where able to cancel the withdrawal. On the XXXX of XXXX at XXXX I received an email from Coinbase stating that their records show that on XXXX, my account was accessed from a device and the IP address XXXX/ XXXX XXXX XXXX  XXXX I live in the state of XXXX. I also didn't catch it at first, but this is the first time they don't actually say the correct date of the unauthorized transactions, as they refer to the 13th but the unauthorized activity only happened on the 14th. They then claim that it was likely due to a third party who had physical or remote access to my device or web browser session. They then go on to say that a session begins when I log in and ends when I log out and that I am responsible for my device 's security. My computer was disconnected from electricity and also virus free at the time of unauthorized activity. I reply on the XXXX at XXXX thanking them for the detailed response, and that I understand their stance on device security, but that ultimately it none of what they have said explains how the activity was allowed to happen in the first place. Its clear the activity happened in a completely different state and yet there was no 2fa request, I then mention a Coinbase representative ( XXXX ) had informed me that reimbursement is possible when safeguards fail. On the XXXX of XXXX I received another email that they aren't able to protect my email account, devices, passwords, 2-step verification codes, or other credentials for me, and claim that due to this they cant take responsibility for any activity on my account. They also encourage me to file with the IC3. I respond on the same day at XXXX once again acknowledging their position on device security, but that I'm referring to authorization safeguards. I ask that they do one of the following, reconsider reimbursement due to the failed and or lacking security that resulted in my funds lost, Written confirmation that Coinbase 's position is final, so I may pursue external review and document my experience accurately. I received no response by the end of the XXXX so I sent an email informing them that I will be filing with the IC3 and will be providing a case number as soon as possible. On the XXXX I filed with the IC3 at XXXX EST and had taken a screenshot of such completed form. I had been waiting to receive the confirmation email from IC3 but as of the time of writing i have not received said email. On the XXXX of XXXX I sent an email to Coinbase again with the screenshot of the completed form as well as asking them to add the report to my case file and to escalate it to the next level for further review. I have yet to receive a reply to this email. On the XXXX of XXXX I decided to take a more direct approach to solving this issue, I made a XXXX account as it was required to contact their customer support team. The same bank that my funds where withdrawn too. After completing my account creation at XXXX I called the support line and asked if they where able to tell if anyone had ever made an account in my name before, they responded with a firm no, and that they looked not only at my name but my social security number as well and found no records of any account under them ever having such credentials. I then went to call Coinbase again with the new info as how could a bank account that doesn't even have my name or social be linked so fast without a waiting period. They then explained that they outsource the security to XXXX or ( XXXX  ). They then go on to say that XXXX securely connects to my bank to verify that the account exists and retrieves limited data like my account and routing numbers, and the bank account owner details ( name, address, etc. They then go on to say that my banking username and password are never shared with Coinbase and that they stay with XXXX for verification only. They then explain that Coinbase uses the info XXXX provides to confirm the bank details are valid and that the owner information matches my Coinbase profile, Decide whether the bank can be added as a payment method or needs manual review if there is a name mismatch, and apply security controls such as encryption of my bank details, strict internal access controls, and holds on certain bank deposits ( for example, ACH/EFT ) so those funds cant be immediately cashed out or sent off the platform until the transfer fully clears. Rather take their word on it I decide to contact XXXX directly and get their side of the story. I make a Data protection Rights Request in an attempt to find out if the unauthorized XXXX account that was linked to my Coinbase account had any matching credentials of mine. After asking XXXX  several questions in regards to their roll with Coinbase I am told that Coinbase is a client of XXXX  and XXXX will verify the users credentials, and then in the case of Coinbase we'll share the required information with Coinbase such as account numbers, balance, name, email, phone, etc. It is then up to Coinbase to verify the information shared and take any fraud and security steps to verify the user. This contradicts with Coinbase 's statement, ( Your actual online banking username and password are never shared with Coinbasethey stay with XXXX for verification only. ) I then try to create another case on the XXXX of XXXX with the new info I have. On the XXXX of XX/XX/2026 I receive an email from Coinbase of which they reference that their records show on XX/XX/2026 my account was accessed from a XXXX  XXXX device and the IP address XXXX- United States. That results in an address in XXXX, a full XXXX miles away from where I live and contradicts their previous statement about their records showing it was in XXXX/ XXXX, XXXX. They also once again talk about the XXXX and not the XXXX when the unauthorized activity happened. On the same day at XXXX I respond to the email addressing the date mismatch and attribute it to a mistake on their end similar to a typo. I then make note of the incorrect IP address and provide them with my public IP address, XXXX as well as a screenshot of the website XXXX  for proof of my public IP address. I make a point that they don't have any knowledge of where it actually was that my account was accessed from, the fact I have XXXX stating that there has never been an account in my name at the time of unauthorized activity, and that I've proven they have several security flaws and I ask them that they reimburse me. They then respond stating that they understand my concern regarding the sign-in IP address matching my location, witch it doesn't and never implied that it did. They then go on to acknowledge that the bank that was used to withdraw the funds did not match my personal info on file with Coinbase, and that it was deleted from my account shortly after the withdrawal was completed. They then state that this is a common pattern they see in cases where a third party may have gained access and removed traces of the payment method afterward. The reason why the account was deleted from my account was because my account was locked, this happened right after the withdrawal due to suspicious activity, witch according to Coinbase deletes any connections the account may have with any other accounts in an attempt of security, this of course only happened after the withdrawal was irreversibly initiated. They then acknowledge that because of these findings they cant treat the withdrawal as if it was initiated from a bank that clearly belongs to me, then again incorrectly claim that the IP addresses match. They then say their decision must be based on the full set of signals they see, because of the mismatch in credentials and the banks quick removal are significant risk indicators. They then go right back to blaming the device that was virus free and turned off at the time of the unauthorized activity, say that account holders are responsible for security. I respond on the same day, the XXXX of XX/XX/2026, and simply ask them to actually read my previous email and point out that not just one piece of security failed on their end, but several all at once. With no response to my reply the case was closed at XXXX on the first of XXXX. Nearly XXXX hours before they even sent their last message, they closed it before I could even respond. On the XXXX of XXXX I created another case, to witch they responded on the XXXX at XXXX. Now they claim their records show that on XX/XX/2026 my account was accessed from a XXXX XXXX device and the IP address XXXX XXXX XXXX. This is the exact info I gave them in the previous case that they never had in the past, they then go on to once again blame me and the device that wasn't even connected to electricity at the time of unauthorized activity. I respond by copying my final message I gave in the last case on the same day at XXXX alongside screenshots of their previous statements about the devices location and IP addresses, the entirety of my final message from the previous case proving I'm the one that told them my IP, and a screenshot of XXXX  response to me inquiring about their connection with Coinbase XXXX They respond on the XXXX with an email that doesn't address any of the points I brought up and once again blames me and my computer for the unauthorized activity. I respond on the same day calling them out for not reading anything and informing them that I will be filing with the CFPB due to lack of security and accountability from Coinbase. Few minutes after I then also send an email requesting the recorded phone records from Coinbase. I have yet to receive a response as their final message was received on the XXXX at XXXX, the case was closed on the XXXX at XXXX. I have several calls with them but due to my poor memory and my inability to obtain the recorded phone calls I felt it best to omit them for the time being. However, though I am unable to recall some notable phone calls, one of witch the representative read through my case and openly admitted with me that Coinbase is partially at fault for all this, and on the XXXX of XXXX I was able to verify they they are unable to reference other case numbers in their own cases. At the time of writing I have XXXX open cases, and two closed cases with Coinbase, apparently each time you call Coinbase they open a new case, I have 3 different cases that exist simply because the call dropped, 3 different cases that simply exist because I called asking for updates on my cases, and 5 open cases about unauthorized access on my account. I have uploaded 26 screenshots of every relevant email conversation I have had with Coinbase and XXXX, arranged to match the timeline presented above. Due to my poor memory and the volume of messages, it is possible that a screenshot was inadvertently uploaded twice or that one may have been omitted. I have made every effort to provide a complete and accurate record. Should one be missing, please inform me as I am more than willing to send the missing image. Also upon request I am in possession o of an audio recording involving a XXXX representative confirming that no bank was created with my name before the XXXX of XXXX.

Company response to consumer: Closed with monetary relief