Attackers exploited a vulnerability in Coinbase's SMS-based account recovery process to bypass 2FA on 6,000+ customer accounts. Threat actors leveraged phishing campaigns to obtain email, password, and phone number combinations, then used the SMS recovery flaw to intercept 2FA tokens and drain accounts. Coinbase reimbursed affected customers.

According to a notification letter submitted by Coinbase to the California Attorney General’s Office to affected customers, a vulnerability that allows hackers to bypass Coinbase’s multi-factor authentication SMS option has affected at least 6,000 Coinbase users between March and May 2021. During the 20th day, hackers took advantage of this omission to access the accounts of affected users and transfer user funds from Coinbase. After Coinbase learned of this issue, it immediately updated its SMS account recovery agreement to prevent hackers from further bypassing the authentication process. In addition, Coinbase will deposit funds of the same value into the accounts of affected users. Coinbase has also been working closely with law enforcement agencies and is conducting an internal investigation into the incident.