Your phone lost service, and when it came back, your Coinbase account was drained. A scammer SIM-swapped your phone number, intercepted SMS 2FA, and withdrew your crypto from Coinbase. As a US publicly traded company (NASDAQ: COIN) regulated by FinCEN, SEC, and subject to CFPB oversight, Coinbase has strong consumer protection obligations. We trace the withdrawals, file emergency requests with Coinbase's legal team, and leverage CFPB complaints for faster response.
A SIM swap attack (also called SIM hijacking or port-out fraud) is when a scammer convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your phone number, they intercept SMS-based 2FA codes and gain access to your Coinbase account — bypassing SMS verification, changing the password, and withdrawing your crypto. The attack often happens at night, and victims discover it when they wake up to a dead phone and an empty Coinbase account.
Why Coinbase is targeted for SIM swap attacks: Coinbase is the most trusted US exchange — users often hold significant balances. Coinbase offers SMS 2FA as an option (though Authenticator app is recommended). If you had SMS 2FA enabled, the SIM swap bypassed it. However, Coinbase is US-regulated — we can leverage SEC, FinCEN, and CFPB oversight to pressure Coinbase for faster response. Coinbase also has withdrawal address whitelisting and a 48-hour withdrawal hold for new addresses.
The attack sequence: First, the scammer gathers your personal information (name, email, phone number, date of birth) through data breaches, social media, or phishing. Then they contact your mobile carrier (or bribe an insider at the carrier) to port your number to their SIM. Once they have your number, they intercept the Coinbase SMS 2FA code, log into your account, change the password and 2FA settings, and withdraw your crypto to addresses they control. The entire attack takes 2-6 hours — usually while you sleep.
Regulatory structure: Coinbase is regulated by FinCEN (MSB), SEC (public company), and subject to CFPB oversight. Coinbase's legal team handles requests through the Coinbase Legal Portal. Response times: 3-10 business days. We file CFPB complaints in parallel to accelerate response — this is a unique leverage point for Coinbase cases.
Freeze capability: Coinbase can freeze the scammer's receiving account (if funds went to another Coinbase account) and flag the withdrawal addresses. Requires a police report or court order. Response: 3-10 business days. Coinbase cooperates with FBI and Secret Service for SIM swap cases.
KYC disclosure: Coinbase discloses account holder information to law enforcement or through a subpoena/court order. Coinbase's KYC includes: SSN or government ID, selfie verification, proof of address, and IP address history. Coinbase also records bank withdrawal destinations — if the scammer withdrew to a bank, we can trace it.
The CFPB escalation: As a US financial institution, Coinbase is subject to CFPB (Consumer Financial Protection Bureau) oversight. A CFPB complaint creates a regulatory obligation for Coinbase to respond within 60 days. In practice, it accelerates response by 3-5 business days. We file CFPB complaints in parallel with legal freeze requests — this is unique to Coinbase and other US-regulated exchanges.
A client (a Coinbase Pro user) discovered at 6 AM that their phone had no service since 1 AM. When they restored service, they found 4 unauthorized Coinbase withdrawals totaling €72,000 — 3 in BTC and 1 in USDC. The scammer had SIM-swapped their T-Mobile number, intercepted Coinbase SMS 2FA, and withdrawn to 2 external BTC wallets and 1 bank account (via Coinbase's fiat withdrawal).
Our response: We traced the withdrawal transactions on-chain, identified the destination addresses, and filed freeze requests with the receiving exchanges. We also filed a police report and coordinated with the mobile carrier's fraud department.
Outcome: 58% recovery (€42,000 of €72,000). We traced the withdrawals: €18,000 in USDC went to a Coinbase account (frozen in 5 business days), €24,000 in BTC was on a personal wallet (traced to a Kraken deposit address — frozen), €30,000 in BTC was on an untraced wallet. The fiat withdrawal (€6,000) to a Chase bank account was reversed by Coinbase within 48 hours (CFPB complaint accelerated). The scammer's Coinbase KYC revealed a resident of Texas. The mobile carrier (T-Mobile) was found liable for the unauthorized port-out and settled out of court.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
How does a SIM swap differ from phishing? In a SIM swap, the attacker takes over your phone number — you don't click any link. In phishing, the attacker tricks you into entering credentials on a fake site. See phishing on Coinbase →
Warning: After a SIM swap, fake "recovery services" may contact you. Read our recovery scam warning.
Three differences: (1) Coinbase is US-regulated (SEC, FinCEN, CFPB) — we can file a CFPB complaint for faster response. (2) Coinbase has a 48-hour withdrawal hold for new addresses (vs Coinbase's 24-hour whitelist lockout). (3) Coinbase users can withdraw fiat to US bank accounts — if the scammer converted to USD and withdrew, we can trace the bank. Recovery rates are 50-70%, comparable to Binance but with CFPB leverage.
Yes. Coinbase is a US financial institution subject to CFPB oversight. A CFPB complaint creates a regulatory obligation for Coinbase to respond within 60 days — but in practice, it accelerates response by 3-5 business days. We file CFPB complaints in parallel with legal freeze requests for all Coinbase SIM swap cases. This is a unique leverage point — not available with Binance, Kraken, or non-US exchanges.
Coinbase places a 48-hour hold on withdrawals to new bank accounts. If the scammer tried to withdraw fiat to a new bank account, Coinbase holds the withdrawal for 48 hours before processing. During this window, we can file the freeze request and reverse the withdrawal. This is a unique Coinbase feature — not available on Binance or Kraken.
Yes. The FBI has a dedicated cybercrime task force that handles SIM swap cases. Coinbase cooperates with the FBI — if you are a US citizen or resident, we file through the FBI, which gets a faster response from Coinbase. The FBI can also obtain the mobile carrier's port-out records and identify the SIM swap perpetrator. For non-US jurisdictions, we coordinate with local law enforcement.
3-10 business days. Coinbase's legal team processes requests through the Coinbase Legal Portal. We file a CFPB complaint in parallel, which typically accelerates response by 3-5 business days. For SIM swap cases, early filing is critical — if the funds are still on Coinbase (sent to another Coinbase account), they can be frozen within 3-7 days.
Switch from SMS 2FA to the Coinbase Authenticator app or a hardware security key. Enable the withdrawal address whitelist (48-hour hold for new addresses). Contact your mobile carrier and request a "port-out PIN." Use a separate email for your Coinbase account. Enable Coinbase's withdrawal delay (24-72 hour delay for all withdrawals). These measures make SIM swap attacks much harder — even if the scammer gets your phone number, they cannot withdraw without the Authenticator code.
Describe what happened. Include your mobile carrier, when you lost service, Coinbase withdrawal transaction hashes, and total amount lost. We respond within 6 hours.