And yet they still support SMS. Coinbase CHOOSE to use that security mechanism because it is quick and easy for them to onboard new business. They could, quite easily, restrict access to other mechanisms.

Instead Coinbase have decided that it is a sufficiently secure form of identification by which they will assume authorization for payment initiation.

If this users SMS was hacked, then the user didnt authorise payment, and coinbase incorrectly assumed that it was based on their own lax security requirements.

If this was regulated in the same way as a Bank, an EMI or a PISP then Coinbase would definitely be at fault here. I hope the legal system sees it in the same way and this guys assets are returned.

Chase, largest bank in the US, doesn't support TOTP yet there ar no articles how someone lost almost $100k by a sim card attack. Coinbase inability to detect and mitigate a sim card attack is on them and their lack of security.

And it's fine, because the regulator forces them to take the risk. As soon as the risk for having to own unauthorized transaction becomes to much for their current auth schema, you'd find it replaced faster than you can say CFPB.

Why anyone uses Wells Fargo after all the shit they've been in is itself mind boggling.