Your Coinbase Account Got Hit. Now What? A Guide to Getting Back in Control
Get Legal Help Now!
You wouldn’t guess it from all the polished Coinbase ads flashing across screens during the 250th U.S. Army Military Parade, but beneath all the feigned public confidence, things have been messy. In May 2025, Coinbase confirmed that scammers stole sensitive data from nearly 70,000 users. The Coinbase data breach included names, addresses, account balances, and even government IDs.
It wasn’t even due to a smart contract exploit or blockchain vulnerability. It was an old-fashioned case of corporate betrayal complete with insider leaks, a brazen $20 million dollar attempt at extortion, and large-scale social engineering.
If you’re a Coinbase user, this guide is for you. Maybe you were one of the users affected or just trying to make sure you’re not next. Either way, now is the time to start taking account security seriously and to understand when legal help might just be necessary.
The Anatomy of the Coinbase Breach
In May 2025, Coinbase found itself the target of a calculated extortion attempt. An email message from an unknown threat actor landed in their inbox, claiming to have stolen customer data. The attackers demanded $20 million and threatened to publicly leak the information if the demand wasn’t met.
However, Coinbase refused to yield. Instead, it took a step that’s becoming increasingly uncommon for breached platforms and publicized the details of the breach. Included was a reward of $20 million for any help leading to the identification of the scammers.
The ransom wasn’t the only thing that made this incident different. It was also the method by which it was carried out. According to Coinbase, the scammers had bribed and recruited overseas customer support contractors and paid them off to leak specific internal data. This data typically included government IDs, names, phone numbers, addresses, masked bank accounts and Social Security numbers, and account balances.
Armed with a plethora of personal data, the scammers launched an aggressive campaign consisting of impersonation scams, posing as Coinbase support agents to trick users into handing over access.
Between December 2024 and January 2025, these scams drained over $65 million from Coinbase users. Many of the victims fell prey to phishing links or had their mobile services hijacked through a process called SIM swapping.
Why SMS-Based 2FA Isn’t Safe Enough Anymore
Two-factor authentication (sometimes referred to as multi-factor authentication) is often touted as the first line of defense when it comes to account security. However, SMS-based 2FA/MFA is one of the weakest links in digital security today.
Criminals can exploit a tactic known as SIM swap fraud, where attackers convince a mobile carrier to transfer your number to a SIM or eSIM they control. Once they hijack your phone number, they can intercept any text messages that were meant for you, including 2FA login codes.
Users who become victims of this type of attack are often completely unaware. That is, until they receive correspondence from their carrier stating that SIM porting was successful. By then, it’s too late.
This is not a rare tactic. The FTC has repeatedly warned about it, and mobile carriers have been criticized for their lackluster protections.
Beyond hacking, relying on SMS 2FA means you can find yourself locked out of your accounts when you’re in a no-service area, or when traveling to a country where roaming isn’t supported. Given how outdated and vulnerable the system is, it’s difficult to justify still using it.
If your crypto was stolen through a SIM swap scam, you may have legal recourse. Learn more about SIM card swap loss recovery and how these cases are handled.
Set Up Stronger Coinbase 2FA
If you’re still using SMS for two-factor authentication, it’s time to upgrade. The good news is that switching to a much safer option only takes a few minutes.
Option One: Authenticator Apps
Coinbase supports several Time-based One-Time Password (TOTP) apps, including Google Authenticator, Authy, Microsoft Authenticator, and 1Password. Using a TOPT means inputting a code from your authenticator app after logging in with your username and password.
Choose an authenticator app that includes cloud backup. This way, if you break or lose your phone, you won’t lose access to your one-time codes. That backup should also use two-factor, not just the SMS kind. It might feel like overkill and a burden, but if your money is online, it deserves this level of protection.
Option Two: Hardware Security Keys
USB-based devices like YubiKey are now supported by Coinbase and offer physical confirmation when logging in. Using a physical key means that, rather than inputting a code from an app, you insert the key into a USB slot and press the sensor to provide the additional layer of authentication.
If you use this route for Coinbase 2FA, it’s best to purchase and add multiple YubiKeys in case one is lost. Secure the second in a locked safe or geographically separate location.
Setting Up Non-SMS-Based 2FA in Coinbase
Setting up TOTP or hardware keys in Coinbase is easy:
- Log in to your Coinbase account
- Select the main menu by clicking on the circle with nine dots next to your profile icon in the top right-hand corner.
- Select Accounts.
- Select the Security tab (the shield icon) on the left-hand side menu.
- Select the 2FA Settings tab.
- Under the Available methods section, choose either Authenticator app or Security key, then click Set up.
- Follow the prompts to complete the setup.
Note: You will be asked for your SMS login code before adding these 2FA options. If you have been a victim of the Coinbase scams and are trying to re-secure your account, make sure that your mobile number is still activated under your SIM card before proceeding.
Coinbase’s official 2FA help guide includes a full video walkthrough of adding these additional 2FA security authenticators.
Extra Locks Worth Installing: Vaults, Whitelisting, and Password Hygiene
Many Coinbase users may think that once 2FA is enabled, their job is done. However, if your crypto is sitting in your Coinbase balance, it’s ready to move at a moment’s notice. It’s a quality of crypto platforms that attackers count on.
In saying this, there are a few more simple tools beyond 2FA that make your Coinbase account a much harder target. Coinbase has several features to harden account security, one of which is Coinbase vaults.
A vault adds a 48-hour withdrawal delay, and you will receive multiple notifications during that window. Not even Coinbase itself can speed up this process, even in an emergency. You can also assign additional signers to approve each transaction, making it much harder for someone to sneak funds out without you knowing.
To create a vault, you can log into Coinbase using a browser, go to My Assets, choose which crypto balance you want to protect, and then select the vault option. From there, you can transfer funds from your Coinbase balance to the vault, or even receive incoming deposits straight into it.
Note: Vaults are for long-term protected storage and not staking assets.
Another Coinbase feature you should enable is withdrawal address whitelisting. This locks withdrawals to addresses you have in your address book. Turning on the feature requires 2FA to add or remove addresses from your address book. Even if someone breaks into your account, they won’t be able to redirect crypto to their own wallet.
Lastly, clean up your password habits. Last year, 78% of Americans reused the same password across at least two sites. This is an absolute gift to hackers. Reusing the same password on smaller websites that are more likely to be breached means your username and password “combo” will inevitably end up on a combo list.
These lists are published in well-known hangouts for cyber criminals who then use them to try these combinations on your more valuable accounts (like Coinbase). This is precisely how an old weak password on a forgotten website can cost you thousands.
Use a long, unique password. Better yet, use a password manager to generate and store them. It’s a one-time effort that pays off.
How Most Accounts Get Hacked (and How to Avoid It Happening to You)
Real life isn’t a Hollywood thriller, and most people don’t get hacked because of some zero-day exploit. It usually comes down to either falling for a deceptive link or trusting the wrong person. Here’s what to watch out for:
Fake Emails That Seem Real Enough: Scammers send emails pretending to be from a platform like Coinbase, often with messaging designed to induce panic, like “Your account is at risk!”
Always check the sender’s address carefully. Never click links directly from emails. Instead, log in to the website first, then look for the notification there.
Spoofed Support Sites: One common scam is a fake support page that looks just like the real thing. Victims Google “Coinbase support” and click on the first result (which might be an advertisement).
A few clicks later, they log into the fake site with their credentials, leading to their capture. Coinbase recommends only contacting them via the phone number or email listed on their Contact Us page.
Red Flags People Just Brush Off: Spelling errors, off phrasing, or being asked to identify your identity by sending crypto are all signs that something is wrong. If you have even the slightest doubt, play it safe and leave the situation.
If you were scammed by someone pretending to be Coinbase, there is still a path forward. Learn more about help for victims of the Coinbase support impersonation scam and explore what can be done next.
Caught in the Crosshairs? What to Do if Your Account Has Been Compromised
If you think your account may have been accessed without permission, don’t wait to confirm it. Act immediately.
The first thing to do is lock your account. Coinbase has a dedicated account compromise page with steps to freeze activity and prevent further loss.
Do this the moment something doesn’t feel right.
Next, reset your email and Coinbase passwords and remove any suspicious devices from your login history. Then, report the incident directly to Coinbase support.
Note: Coinbase will never ask you for your password or 2FA codes. If someone does, hang up or disconnect immediately.
Once you have taken action, file a report with the Internet Crime Complaint Center. Even if the losses aren’t substantial, this helps establish a record and may support future investigations. You can report cybercrime directly through their site.
Finally, monitor your accounts regularly. Keep a close eye on new login locations, unfamiliar attempts at withdrawals, and profile changes. These are often early warning signs.
You Can’t Undo a Hack, But You Can Do Something About It
Remember, even the most cautious users aren’t immune to sophisticated social engineering scams. Attacks like phishing emails, SIM swaps, and insider leaks are designed to slip past even the best of us.
Coinbase showed the world that no platform is untouchable.
The good news is that you’re not helpless. Locking down your account with stronger tools can prevent further damage. If you’ve already suffered a loss, you don’t have to face it alone.
Take two steps today:
- Secure your Coinbase account using the protections outlined in this guide.
- Speak with a lawyer if you have lost crypto through fraud, platform negligence, or a SIM swap.
Our digital asset litigation attorneys are ready to review your case and explore your legal options.
If your Coinbase account was hacked or funds were lost in a support scam or SIM swap, call the attorneys at Marin & Murphy at (888) 348-2735 for an urgent and no-obligation case review.