Coinbase account takeovers via SMS account recovery flaw
Between March and May 20, 2021, attackers who already had victims' email addresses, passwords and phone numbers abused a flaw in Coinbase's SMS account recovery process to obtain the SMS two-factor codes needed to take over accounts. Coinbase disclosed the thefts in a notification letter reported on October 1, 2021, said it updated its SMS account recovery protocols, and reimbursed affected customers.
- Victim
- Coinbase
- Industry
- Crypto and Web3
- Country
- United States
- Intrusion began
- Mar 2021
- First disclosed
- Oct 1, 2021
- Actor
- Financially motivated
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- 6,000 (At least 6,000 customers had funds stolen, per Coinbase's notification letter filed with the California Attorney General.)
- Disclosed cost
- Not disclosed
The identity lesson
Account recovery must be as strong as login: recovery paths that fall back to SMS codes undo the protection of the primary factor, and TOTP or security keys remove that path.
Sources
- MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed, Threatpost, Oct 1, 2021
- Hackers exploit 2FA flaw to steal crypto from 6,000 Coinbase users, Hackread, Oct 2, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Crypto.com unauthorized withdrawals bypassing 2FA 2022 · Identity infrastructure vulnerability
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Coinbase account takeovers via SMS account recovery flaw. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-coinbase-sms-recovery-flaw/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.