In order to access your Coinbase account, these third parties first needed prior knowledge of the email
address, password, and phone number associated with your Coinbase account, as well as access to your
personal email inbox. While we are not able to determine conclusively how these third parties gained
access to this information, this type of campaign typically involves phishing attacks ...
Even with the information described above, additional authentication is required in order to access your
Coinbase account. However, in this incident, for customers who use SMS texts for two-factor
authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in
order to receive an SMS two-factor authentication token and gain access to your account.
We will be depositing funds into your account equal to the value of the currency improperly removed from your account at the time of the incident. Some customers have already been reimbursed -- we will ensure all customers affected receive the full value of what you lost