In This Article
You opened the Coinbase app and the balance is wrong. A withdrawal you didn't make. An email about a session from somewhere you've never been. The shock is identical whether $500 or $50,000 is gone.
This guide is the exact recovery sequence after a Coinbase account compromise: the first 15 minutes that matter most, what Coinbase will actually do, and where independent forensic work picks up the case if reimbursement is denied.
The First 15 Minutes
Speed determines whether the withdrawal even clears. Coinbase has hold periods, withdrawal limits, and risk-flag escalations that can interrupt an attacker mid-transaction — but only if you trigger them in time. The first 15 minutes do more than the next 15 days.
-
1
Lock the account immediately
Use Coinbase's account lock tool from the login page (not the app). This freezes withdrawals and trading while you regain access. Don't try to "fight" the attacker by logging in repeatedly — you'll trigger fraud locks against yourself.
-
2
Change every linked credential
Email password first (the email is the recovery vector), then your phone carrier PIN if SIM-swap is possible, then any reused passwords on other exchanges. Revoke all active sessions on Coinbase and on the email account. Move 2FA from SMS to a hardware key or authenticator app.
-
3
Document everything
Screenshot the unauthorized transaction, the destination address, the timestamp, the IP and device of the unfamiliar session if visible, and the email notification thread. This is the evidence Coinbase support will need and the foundation for every later step.
-
4
File a Coinbase support case
Open a formal unauthorized-access case through Coinbase support, not just a generic ticket. Reference the specific withdrawal hash, the destination, and your account-lock confirmation. Save the case number.
-
5
Police report and IC3 within 24 hours
File a local police report (the report number is required by Coinbase's review process) and an IC3 complaint at IC3.gov. Both timestamps matter. Speed signals that this wasn't a buyer's-remorse case.
What Actually Happened to Your Account
Most Coinbase compromises fall into one of four categories. Identifying yours sharpens both the support case and the forensic trace.
1. Credential Theft — Phishing Site or Reused Password
You typed your Coinbase password into a fake login page (often reached through Google ad spoofing, fake support emails, or fake "security alert" SMS), or you reused the password on a site that was breached. The attacker logs in normally with valid credentials.
2. SIM Swap
An attacker convinced your mobile carrier to port your number to a SIM they control. SMS-based 2FA codes go to them. They reset your email password using SMS recovery, then your Coinbase password using email recovery. By the time you notice your phone has no service, the withdrawal is in progress.
3. Session Token Theft
Malware, a malicious browser extension, or a compromised device exfiltrated an active Coinbase session cookie. The attacker rides your existing logged-in session and bypasses 2FA entirely because the session is already authenticated.
4. Approval Fraud / Authorized Withdrawal
You authorized the withdrawal yourself, believing you were sending to your own wallet, a "verification" address, or an investment platform. Coinbase logs show your IP, your device, your 2FA code. They will treat this as user-authorized and deny reimbursement — but the funds are still traceable. We cover this scenario in First 24 Hours After a Crypto Scam.
The Coinbase Review Process
Once your case is open, Coinbase's internal review looks at session logs, device fingerprints, IP geolocation, login behavior, withdrawal patterns, and your account's security configuration. The process typically takes 2-6 weeks. The outcome lands in one of three categories:
Reimbursed. Coinbase concludes the access was unauthorized and you followed reasonable security practices. Reimbursement is typically partial-to-full at the dollar value at time of theft.
Partially reimbursed. Some recovery, often when there's mixed responsibility — you had 2FA but it was SMS-based, or you missed a security warning that should have been actionable.
Denied. Coinbase concludes you authorized the action, your security posture was deficient, or the loss falls outside what their unauthorized-access policy covers. Most authorized-withdrawal scams end here.
A denied reimbursement isn't the end — it's the start of the independent recovery path. Coinbase's review is internal and policy-bounded. Forensic tracing operates outside it, follows the funds wherever they go, and produces evidence that supports civil action and exchange subpoenas.
Why an Independent Trace Matters
The withdrawal transaction lives on the blockchain regardless of whether Coinbase reimburses you. From that destination address, three things become possible:
- Identification of the attacker's pattern. Account-takeover crews tend to reuse infrastructure — same destination clusters, same laundering services, same eventual cash-out venues. A trace can connect your case to known crews when the patterns match.
- Tracking the funds to a cash-out exchange. Most attackers eventually convert stolen crypto to fiat at a centralized exchange. That exchange has KYC records on the receiving account.
- Producing actionable forensic evidence. A formal forensic report supports subpoenas, civil filings, and law enforcement referrals. The bare on-chain timeline is information; the forensic report is admissible evidence.
The cash-out point is the actionable handle. We cover what subpoenas to that exchange require in Subpoenaing Coinbase, Binance & Kraken for Stolen Crypto.
Legal Paths After Coinbase Decides
Three tracks remain open whether or not Coinbase reimburses:
Civil action against an identified recipient. If forensic tracing identifies the recipient via a cooperating exchange, civil suit becomes viable. Default judgments are common because the defendants rarely appear, and judgments support exchange-side asset freezes.
Criminal referral and federal investigation. SIM-swap cases, in particular, often involve organized rings the FBI is already tracking. A forensic report turns your case from a single complaint into a piece of pattern evidence. We cover this path in How to Report a Crypto Scam to the FBI.
Tax loss documentation. US victims may qualify for theft loss deductions on Form 4684 in qualifying years. A forensic report substantiates the loss in a way bare exchange statements typically cannot.
Preventing the Next Compromise
- Hardware-key 2FA, not SMS. A YubiKey or equivalent eliminates SIM-swap and most phishing. SMS 2FA is materially weaker and known to be SIM-swap exposed.
- Carrier port-out PIN. Set a unique PIN with your mobile carrier that's required for any port or SIM change. Verbal-only protections are routinely social-engineered.
- Bookmark the real Coinbase login URL. Don't ever reach Coinbase through a Google search ad. Spoofed ads are a primary credential-theft vector.
- Withdrawal address allowlist. Coinbase supports allowlisting destination addresses with a 48-hour delay on additions. Use it — the delay window is itself a defense.
- Review device permissions and active sessions monthly. Revoke anything you don't recognize. Sessions persist longer than people realize.
- Move long-term holdings off the exchange. A hardware wallet you control eliminates exchange-takeover risk entirely for any balance you're not actively trading.
Coinbase Account Compromised? Don't Wait on the Internal Review.
We trace the withdrawal independently of Coinbase's process — identifying the destination cluster, tracking the funds toward cash-out, and producing a forensic report you can act on with or without reimbursement. Free initial review.