Coinbase Account Breach Phone Theft shotford11

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Coinbase

shotford11 reports losing a significant amount of money through Coinbase after their phone was stolen. The theft appears to have happened in early November 2021. Apparently, an adversary with their phone was able to get into the account within "5 minutes" and withdraw all funds. From all accounts, it appears that they haven't been helped at all to recover their funds.

This exchange or platform is based in United States, or the incident targeted people primarily in United States.

About Coinbase

"Just trying to keep the paychecks comin and putting $50/week into btc in @coinbase on autopilot"

"I looked at cold storage never pulled the trigger or dipped a toe in."

"Had my coinbase account username and password reset after my phone got stolen. Lost 1/2 my net worth had been building for 5 years." "a bad actor got access to my coinbase account and just sent everything offsite to themselves. No recourse."

"They reset my username and password" "They figured out the passcode to the phone so they owned the phone. They used forgot username and password with coinbase and coinbase sent text verification which they received and used to “verify.” Within 5 minutes everything was sent to wallets that are being split and sent"

"Yes, phone was stolen and got into. Went thru my email saw i was a Coinbase customer and had my credentials reset then sent all btc and eth to offsite wallets just created. Sent to another wallet that is now splitting and sending to other wallets"

"Hey @coinbase @CoinbaseSupport how about reversing the transaction that wiped out my entire account when I got hacked? Notice how I never made a trade again? That good for business?"

"Lmk if u could use some help. Tbh I think we need to be doing this ‘across the board’ not just crypto but everywhere tech is disrupting traditional norms to a degree that people / customers (I don’t like the word users or consumers seems like addicts or dehumanizing)"

"Same kinda photos when phone stolen and accessed and Coinbase pass reset and transferred offsite.."

"Sorry Seth. If it’s any consolation I had 3 years of savings in Coinbase swiped after my phone was stolen and password reset. Being unable to reverse fraud in any way is extremely dangerous. Hope folks smarter than me are working on it.."

"Friendly reminder to periodically move assets to other wallets or offsite when % of Nw is so focused in one account/exchange."

This exchange or platform is based in United States, or the incident targeted people primarily in United States.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Coinbase Account Breach Phone Theft shotford11

Date	Event	Description
August 26th, 2020 12:01:00 PM MDT	Job Loss Tweet	"Lost my job in May. Still haven't received a dime of unemployment from @GovPritzker IDES. Been an IL resident for 25 years. No health insurance. No unemployment insurance. Thank god for $penn @jimcramer"
January 3rd, 2021 4:01:00 PM MST	Investment Plan	"Me too Raoul. Just trying to keep the paychecks comin and putting $50/week into btc in @coinbase on autopilot TY for your content"
November 11th, 2021 9:37:00 AM MST	Anthony Pompliano Reply	In response to a tweet from Anthony Pompliano about a potential bitcoin dividend for citizens of Florida, shotford11 asks "what happens if those wallets are compromised and assets sent offsite". He complains that "[n]o one wants to talk about the risk and [there is] no recourse for fraud".
November 12th, 2021 12:53:00 PM MST	Coinbase Wallet Idea	shotford11 agrees it's a "[g]ood idea" to "use the coinbase wallet" as "the wallet provides private key capability so someone can’t just reset coinbase credentials and send assets offsite".
November 13th, 2021 11:18:00 AM MST	Michael Batnick Reply	Reply to Michael Batnick with many details of the incident, including that half his net worth was lost, built up over 5 years, and that he wishes he had used a cold storage device instead of leaving it on the exchange.
November 13th, 2021 8:21:00 PM MST	Scammers Contacting	"Every time u tweet or post about an account that was lost you will get scammers saying they will help you recover x y z. Scammers everywhere"
November 13th, 2021 8:35:00 PM MST	Caitlin Cook Question	"Do you have another form of 2FA besides SMS (in case ur phone is lost/stolen)"
November 15th, 2021 9:43:00 PM MST	Explanation Tweet	"They figured out the passcode to the phone so they owned the phone. They used forgot username and password with coinbase and coinbase sent text verification which they received and used to “verify.” Within 5 minutes everything was sent to wallets that are being split and sent"
November 28th, 2021 5:58:00 PM MST	Peter Schiff Debate	In a debate between Peter Schiff and his son Spencer Schiff, shotford11 responds with a question for Spencer "about when people get hacked or compromised and there’s no recourse". It appears that Spencer doesn't have any time to answer this question.
December 5th, 2021 11:34:00 AM MST	Adriana Mendez Tweet	"Yes, phone was stolen and got into. Went thru my email saw i was a Coinbase customer and had my credentials reset then sent all btc and eth to offsite wallets just created. Sent to another wallet that is now splitting and sending to other wallets"
January 26th, 2022 2:22:00 PM MST	Anything But CoinBase	shotford11 asks Onrampinvest "where to purchase btc and eth that’s not Coinbase"
February 4th, 2022 1:04:00 PM MST	Apparent Cash Photos	shotford11 reports finding photos of cash on their phone or in connected profiles after their phone was stolen and used to steal from their CoinBase account.
May 13th, 2022 7:07:00 PM MDT	Request To CoinBase Twitter	"Hey @coinbase @CoinbaseSupport how about reversing the transaction that wiped out my entire account when I got hacked? Notice how I never made a trade again? That good for business?"
December 21st, 2022 1:58:00 PM MST	CoinBase Help Offer	To the CoinBase legal employee, "Lmk if u could use some help. Tbh I think we need to be doing this ‘across the board’ not just crypto but everywhere tech is disrupting traditional norms to a degree that people / customers (I don’t like the word users or consumers seems like addicts or dehumanizing)"

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

January 3rd to November 11th = 10 months + 1 week = 45 weeks x 50 = 2250, estimate $3k.

The total amount lost is unknown.

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.