Consumer complaint received 2026-05-24 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: Coinbase, Inc.
State: FL

Complaint narrative:
On XX/XX/year>, my regulated cryptocurrency account with Coinbase , Inc. was severely compromised, resulting in an unauthorized internal transfer and total asset loss of {$70000.00} XXXX. According to a recent formal communication issued by Coinbase Support, the company confirmed that the security breach occurred via a malware exploit that targeted an established device session ( Session Hijacking / Cookie Theft ). This allowed the unauthorized threat actors to completely duplicate an active, pre-authenticated session state directly from the local browser environment. As a result, the attackers successfully bypassed all standard multi-factor authentication ( MFA ) prompts and 2-Step Verification ( 2FA ) protocols natively integrated into the user interface. Once inside the account, the attackers executed rapid, unauthorized maneuvers to consolidate assets, which Coinbase 's internal logs record as follows : At XXXXXXXX XXXX XXXXXXXX : An unauthorized on-chain receive transaction of XXXX XXXX hit the account ( used by the attackers to activate/fuel the compromise ). At XXXXXXXX XXXX XXXX : Unauthorized liquidation and conversion orders took place to accumulate funds into stablecoins ( {$2800.00} XXXX ). At XXXXXXXX XXXX XXXXXXXX : Additional unauthorized conversions took place ( {$1000.00} XXXX ). At XXXXXXXX XXXX XXXXXXXX : The total combined balance of {$70000.00} XXXX was swept and moved out of the user 's view. CRITICAL COMPLIANCE AND FRAUD MONITORING FAILURE : I am filing this complaint because Coinbase attempts to entirely absolve themselves of institutional liability under their User Agreement by shifting 100 % of the fault to local device security. However, a sudden, rapid on-chain transfer and consolidated velocity of {$70000.00} XXXX represented an extreme, flagrant departure from the historical transaction volume, velocity, and established behavioral user profile of the account. As a regulated financial entity under federal oversight, Coinbase has a fundamental duty of care to maintain functional, automated behavioral monitoring and risk-mitigation algorithms. Coinbase 's systems completely failed to halt, flag, or delay this life-changing transaction for secondary out-of-band identity verification ( such as biometric checks or live cooling-off periods ). Furthermore, public blockchain ledger forensics reveal that the stolen {$70000.00} XXXX was not routed to an unhosted anonymous wallet. Instead, the funds were sent directly into Coinbase 's own centralized institutional omnibus wallet address : XXXX ( Publicly labeled on the ledger as " Coinbase 10 '' ). Because the stolen assets settled within Coinbase 's native ecosystem, the platform maintains immediate corporate, technical, and administrative control over the infrastructure. They possess the capability to audit the internal destination account that received the ledger sweep, freeze the illicitly obtained funds, and execute a reversal. Their boilerplate defense of blockchain irreversibility is technically non-applicable to internal omnibus settlements. DESIRED RESOLUTION : I request that the CFPB mandates a formal executive compliance review of this incident. Coinbase must look beyond basic automated login parameters, audit the internal transaction routing paths leading into the Coinbase 10 institutional address, cooperate fully with the federal criminal complaint filed concurrently via the FBI 's IC3 portal, and provide a fair resolution or reimbursement due to their systemic failure to prevent institutional-scale velocity fraud within their network.

Company response to consumer: Closed with explanation