Cryptocurrency Stolen From a Coinbase Account?
Unauthorized access to a Coinbase account can result in cryptocurrency being transferred before the account holder understands what happened. If assets were removed following a phishing attack, SIM swap, compromised email account, stolen credentials, or another suspected account takeover, Coin Counsel can help evaluate the evidence and possible legal options.
Coinbase publishes security and reporting procedures for compromised accounts. Following those procedures promptly can help secure remaining assets and preserve a record, but it does not guarantee that an irreversible cryptocurrency transfer can be recovered or reimbursed.
If an intrusion may still be active, use Coinbase's official account-locking process, secure the connected email and telephone accounts, and contact appropriate law enforcement. Never give a supposed recovery service your password, two-step verification code, or wallet seed phrase.
Request a confidential case review or call (646) 450-1214.
Immediate Steps After a Coinbase Account Takeover
Coinbase's compromised-account guidance says an account holder who believes someone gained unauthorized access can lock the account. Locking an account signs it out on all devices. Follow the current instructions on Coinbase's official website rather than links or telephone numbers provided by an unsolicited caller.
When it is safe to do so:
- Secure the email account connected to Coinbase
- Contact the mobile carrier if a SIM swap or telephone-port attack is suspected
- Change compromised passwords from a trusted device
- Preserve login alerts, security emails, and two-step verification messages
- Lock the Coinbase account through Coinbase's official process
- Report unauthorized transactions through Coinbase Support
- Contact local law enforcement when a theft or other crime occurred
- Record support case numbers and the date of every report
Do not delete suspicious emails, text messages, browser history, or call records until useful evidence has been preserved.
Evidence to Preserve
The evidence in an account-takeover matter can disappear quickly. Save original electronic records where possible, not only cropped screenshots.
Relevant materials may include:
- Coinbase account statements and transaction history
- The date, time, amount, asset, and destination of each unauthorized transfer
- Wallet addresses, transaction hashes, and blockchain explorer records
- New-device, password-reset, and login notification emails
- IP-address or device information shown in account records
- Text messages or calls received during the incident
- Mobile-carrier records concerning a SIM change or number port
- Email-provider security logs and forwarding-rule changes
- Phishing messages, fraudulent websites, or fake support communications
- Coinbase support tickets, chats, complaint records, and decisions
- Bank records for any unauthorized cash purchase or withdrawal
- Police, FBI IC3, identity-theft, or other official reports
A clear timeline can help distinguish an unauthorized transfer from a transaction the account holder initiated after being deceived. That distinction may affect contractual, legal, or program-specific options.
SIM Swaps and Coinbase Accounts
Coinbase describes a SIM swap or telephone-port attack as an attacker transferring the victim's telephone number to a device controlled by the attacker. A compromised telephone number may expose text-message authentication and account-recovery functions.
If a SIM swap is suspected, preserve carrier notices, loss-of-service timing, account PIN changes, store visits, telephone calls, and any record identifying when the number was transferred. Legal analysis may involve conduct by more than one party and will depend on the specific evidence.
Learn more about SIM swap fraud and the role of mobile carriers.
Phishing and Fake Coinbase Support
Some attackers use websites, emails, search advertisements, telephone calls, or social-media accounts that impersonate Coinbase. Others persuade a victim to disclose credentials or move assets to a wallet under the attacker's control.
Coinbase and Coin Counsel are separate organizations. Coin Counsel cannot log in to a client's Coinbase account and will never request a password, seed phrase, or two-step verification code. Anyone demanding those items or an advance cryptocurrency payment to “reverse” a transaction should be treated with caution.
Unauthorized Transfers and Scam-Induced Transfers
An unauthorized account takeover generally involves a third party accessing an account and initiating a transaction without the account holder's approval. A scam-induced transfer may involve the account holder personally authorizing a transaction because of deception.
The practical and legal issues may differ. Preserve exactly who pressed the final confirmation, what representations were made, what security prompts appeared, and whether account credentials or a device were compromised. Do not change the facts to fit a preferred characterization.
Can Stolen Cryptocurrency Be Recovered?
Sometimes stolen assets can be traced on a public blockchain, but tracing does not by itself provide control of the destination wallet or guarantee recovery. The usefulness of tracing depends on the asset, blockchain, transaction path, exchanges or services involved, timing, jurisdiction, and available legal process.
Possible steps may include evidence preservation, blockchain tracing, reports to exchanges or law enforcement, subpoenas or other legal process when available, claims involving responsible parties, and evaluation of the Coinbase agreement or any applicable account-protection terms. Every matter is different.
Coinbase One Account Protection
Coinbase publishes an account-protection program for certain eligible Coinbase One members. Coinbase states that availability, eligibility, coverage limits, security requirements, exclusions, and claims review apply. Its materials distinguish certain unauthorized third-party transfers from transactions the customer authorized after being deceived.
If the account may have been eligible, preserve the membership status, security settings, claim submission, and Coinbase's response. Coin Counsel does not administer the program and cannot promise coverage or reimbursement.
Legal Review of a Coinbase Theft Matter
Coin Counsel may evaluate:
- How the account was accessed
- Whether the connected email or telephone account was compromised
- Which transactions were and were not authorized
- What Coinbase security notifications or controls appeared
- How quickly the incident was reported
- Where the cryptocurrency moved after leaving Coinbase
- Whether other exchanges or identifiable services received the assets
- Which contracts, deadlines, complaint procedures, or legal claims may apply
- Whether the amount at issue justifies the likely cost of legal action
No attorney can guarantee recovery, reimbursement, or a particular result. A candid early assessment can help avoid spending additional money on ineffective or fraudulent recovery offers.
If the assets remain in the account but withdrawals or sends are unavailable, see Coin Counsel's guide to a restricted Coinbase account or inaccessible funds.
Request a Confidential Case Review
Send Coin Counsel the date of the incident, approximate loss, relevant transaction hashes, support case numbers, and a short description of how access was compromised.
Contact Coin Counsel or call (646) 450-1214.
Frequently Asked Questions
What should I do first if my Coinbase account was hacked?
Use Coinbase's official process to lock the compromised account, secure the connected email and telephone accounts, preserve evidence, report unauthorized transactions to Coinbase, and contact appropriate law enforcement when a theft occurred.
Can Coinbase reverse a cryptocurrency transfer?
Cryptocurrency transfers may be irreversible. Reporting quickly is still important for account security, investigation, evidence preservation, and evaluation of any available claim or program.
Can a lawyer trace cryptocurrency stolen from Coinbase?
Blockchain tracing may help follow certain assets and identify services that received them. Tracing is not the same as recovery, and results depend on the transaction path and available legal process.
Is Coin Counsel affiliated with Coinbase?
No. Coin Counsel and Franco Law PLLC are independent of Coinbase. Coinbase is a trademark of its respective owner. References to Coinbase identify the platform involved and do not imply affiliation, endorsement, or sponsorship.
Does contacting Coin Counsel create an attorney-client relationship?
No. Viewing this page or submitting an inquiry does not create an attorney-client relationship. Representation begins only through a written engagement agreement.