Help! BTC disappeared from my Coinbase account. What can I do?

[ca1yps05]

I was hoping someone could help me with an issue.

Yesterday I received a little over 7 BTC into my Coinbase account. It's received tons of confirmations since then.

However, 30 minutes later, Coinbase shows I sent this exact same amount of BTC (right down to the decimal point) to an external account.

Normally in the "To" field, it give the wallet address I sent it to. In this case, it just says "external account".

Additionally, I received no confirmation email stating that I sent any BTC to anyone.

What could possibly be going on? I emailed them, but they must be closed for the weekend. Anyone have a similar experience?

[1714972785]

1714972785

[1714972785]

1714972785

[1714972785]

1714972785

[DanzoFriend]

The exact same thing happened to me to the tune of 10.399 bitcoin! Shit, Coinbase looks compromised

[guoweang]

Can you post a screenshot? This is very odd.. Coinbase isn't compromised, its something on your end. Have you tried accessing your funds from a different computer?

[DanzoFriend]

Sorry for speaking badly of them, but this just seems a little too much of a coincidence that the exact same thing happened to OP and myself. I haven't used any computer other than my main computer to login. I also have two factor authentication enabled as well.

I had had no trouble with Coinbase in the past. So I sent coins from an exchange to Coinbase. When the 6th confirmation hit, and it said both "verified in just a moment" (or something to that effect) and pending still. Yet even before the pending status on the received Bitcoins was done an order to send the the exact same amount of Bitcoins to an external account popped up. Both transactions said pending at the same time. The order to send was put in exactly 1 hour to the minute after the original order to receive the coins was first recognized by Coinbase.

Here's the transaction: http://postimg.org/image/i5tojn2wt/full/

[nawazish1]

This happened to a friend of mine but not with coinbase. I think there is a trick someone is using to transfer coins to his account before the confirmation.

[ca1yps05]

Sorry for speaking badly of them, but this just seems a little too much of a coincidence that the exact same thing happened to OP and myself. I haven't used any computer other than my main computer to login. I also have two factor authentication enabled as well.

I had had no trouble with Coinbase in the past. So I sent coins from an exchange to Coinbase. When the 6th confirmation hit, and it said both "verified in just a moment" (or something to that effect) and pending still. Yet even before the pending status on the received Bitcoins was done an order to send the the exact same amount of Bitcoins to an external account popped up. Both transactions said pending at the same time. The order to send was put in exactly 1 hour to the minute after the original order to receive the coins was first recognized by Coinbase.

Here's the transaction: http://postimg.org/image/i5tojn2wt/full/

I would post a pic of my transaction details, but it is literally the same as the pic posted by DanzoFriend. Same hash, same date and time, same amounts and output addresses down at the bottom of the screen, same block. No difference. None!

Please let this be some kind of error that can be fixed. On Thursday I received some BTC that was confirmed in the blockchain, but didn't show up in Coinbase. After an email, they responded they had some computer issue preventing synchronization with the blockchain. I wonder if this is some related issue.

[pepe]

Who sent you the coins in the first place?

[Stephen Gornick]

Here's the transaction: http://postimg.org/image/i5tojn2wt/full/

I would post a pic of my transaction details, but it is literally the same as the pic posted by DanzoFriend. Same hash, same date and time, same amounts and output addresses down at the bottom of the screen, same block. No difference. None!

I'm not able to see the image on postimg.

But if two separate accounts are showing the exact same withdrawal transaction that's something Coinbase needs to know about.

[MstCoin]

Sounds like you may have been ripped off

[DanzoFriend]

Here's the transaction: http://postimg.org/image/i5tojn2wt/full/

I would post a pic of my transaction details, but it is literally the same as the pic posted by DanzoFriend. Same hash, same date and time, same amounts and output addresses down at the bottom of the screen, same block. No difference. None!

I'm not able to see the image on postimg.

But if two separate accounts are showing the exact same withdrawal transaction that's something Coinbase needs to know about.

I tried uploading to another place:

http://d.pictureupload.us/86731438751c6684b88d3e.jpg

Does that work for you?

Lol. I think we are getting trolled.

No, you're not. I was robbed, and so was the other person. Same thing could happen to anyone in the cryptocurrency world.

[legendster]

I tried uploading to another place:



No, you're not. I was robbed, and so was the other person. Same thing could happen to anyone in the cryptocurrency world.

While on the forum, choose your words carefully. Robbed and Scammed are two different words meaning completely two different types of incident.

[Stephen Gornick]

Lol. I think we are getting trolled.

No, you're not. I was robbed, and so was the other person. Same thing could happen to anyone in the cryptocurrency world.

So you are saying you use Coinbase and your Coinbase balance went down after you received Bitcoin funds?   And there is a transaction in Coinbase history that shows a BTC withdrawal ("You sent bitcoins to xxxxxxxxxxxxxxxxx") and you did not make that withdrawal request?  And that you have 2FA authentication?

Well, then let's consider what could have happened.

Authy is the 2FA authentication method that Coinbase uses.  Authy requires a mobile app or alternatively the 2FA code for withdrawal is sent as a text message.

So did you receive a text message with a 2FA code from Authy?

Either way, Coinbase can help you figure out exactly when this 2FA code for this transaction was sent (and Authy knows the the IP of the mobile device if the 2FA came from an app), and the IP address that was used when accessing Coinbase.com for that withdrawal transaction .

Have you contacted them?
 - http://support.coinbase.com/customer/portal/emails/new

[Stephen Gornick]

I would post a pic of my transaction details, but it is literally the same as the pic posted by DanzoFriend. Same hash, same date and time, same amounts and output addresses down at the bottom of the screen, same block. No difference. None!

You mentioned that you had received "a little over 7 BTC".  There's a UTXO for 7.13310828 BTC.  Is that the transaction you are saying you received and then has since been spent?
  - https://blockchain.info/tx/6813be2f7feb3cc45beefed6fcae8c62aeac7fe23c0613731c6557abe6e4438d?show_adv=true

If so, have you ever imported a paper wallet?  Specifically, 1AGbAJVqMsGgV5TovrVK4s8vFYkF8C5RUH?    
[Edit: I'm not sure how Coinbase treats imported Bitcoin addresses ...  it might sweep funds from a paper wallet to another address in your Coinbase wallet.]

[DanzoFriend]

Lol. I think we are getting trolled.

No, you're not. I was robbed, and so was the other person. Same thing could happen to anyone in the cryptocurrency world.

So you are saying you use Coinbase and your Coinbase balance went down after you received Bitcoin funds?   And there is a transaction in Coinbase history that shows a BTC withdrawal ("You sent bitcoins to xxxxxxxxxxxxxxxxx") and you did not make that withdrawal request?  And that you have 2FA authentication?

Well, then let's consider what could have happened.

Authy is the 2FA authentication method that Coinbase uses.  Authy requires a mobile app or alternatively the 2FA code for withdrawal is sent as a text message.

So did you receive a text message with a 2FA code from Authy?

Either way, Coinbase can help you figure out exactly when this 2FA code for this transaction was sent (and Authy knows the the IP of the mobile device if the 2FA came from an app), and the IP address that was used when accessing Coinbase.com for that withdrawal transaction .

Have you contacted them?
 - http://support.coinbase.com/customer/portal/emails/new

I hadn't quite received my funds. I believe the The 6th confirmation had come, but the status said something like "Just a minute until confirmed". It did clearly say the receipt of the coins was pending when to order to send them to another account was also pending. I never saw my account balance above 0.

I did receive a text message to my phone with my validation code when I logged in, but didn't receive one any other time.

I've contacted Coinbase via the link you posted yesterday afternoon. I haven't heard anything back.

[Stephen Gornick]

but the status said something like "Just a minute until confirmed". It did clearly say the receipt of the coins was pending when to order to send them to another account was also pending. I never saw my account balance above 0.

What does Coinbase show for the transaction status now?
 - https://coinbase.com/transactions

[Edit: The list of addresses in your Coinbase E-Wallet is available from:
 - https://coinbase.com/addresses ]

[DanzoFriend]

Here's what the transaction page says now. Same thing it said since the transaction went through:

http://d.pictureupload.us/67790295351c673a941187.jpg

Here is the list of addresses:

http://d.pictureupload.us/200967117751c674e180a8d.jpg


If it helps at all; here is the receipt of the coins to compare to

http://d.pictureupload.us/67788747651c673fa7339b.jpg

[ca1yps05]

I would post a pic of my transaction details, but it is literally the same as the pic posted by DanzoFriend. Same hash, same date and time, same amounts and output addresses down at the bottom of the screen, same block. No difference. None!

You mentioned that you had received "a little over 7 BTC".  There's a UTXO for 7.13310828 BTC.  Is that the transaction you are saying you received and then has since been spent?
  - https://blockchain.info/tx/6813be2f7feb3cc45beefed6fcae8c62aeac7fe23c0613731c6557abe6e4438d?show_adv=true

If so, have you ever imported a paper wallet?  Specifically, 1AGbAJVqMsGgV5TovrVK4s8vFYkF8C5RUH?    
[Edit: I'm not sure how Coinbase treats imported Bitcoin addresses ...  it might sweep funds from a paper wallet to another address in your Coinbase wallet.]

That's my transaction amount, and my wallet address. I've never used a paper wallet. I use authy, and I most certainly didn't send those coins to anyone.

I don't have any other accounts with Coinbase, and my balance reflects the loss of those coins.

I have emailed them but they have not responded.

[Stephen Gornick]

Here's what the transaction page says now. Same thing it said since the transaction went through:

http://d.pictureupload.us/67790295351c673a941187.jpg

This is all very, very strange because when a payment is sent from Coinbase it gets sent as a single transaction.     But that 10.399 BTC spend transaction was combined with other UTXOs in a transaction.

I'm stumped as if this was something like your account and 2FA being compromised then it would simply show as a 10.399 BTC spend transaction by itself.  Since Coinbase doesn't give out private keys there's no way for a thief to create a transaction that looks like a "You sent Bitcoins to an external account" 10.399 BTC withdrawal in the Coinbase Transactions history but at the same time have a transaction combined with other inputs at the blockchain transaction level.   (Unless, again, this was a private key that you imported but I don't know how Coinbase handles importing of paper wallets / private keys so maybe even doing that wouldn't even have been able to have caused this type of outcome).  

Can you confirm that this address was NOT a paper wallet/private key that you imported?

[DanzoFriend]

Here's what the transaction page says now. Same thing it said since the transaction went through:

http://d.pictureupload.us/67790295351c673a941187.jpg

This is all very, very strange because when a payment is sent from Coinbase it gets sent as a single transaction.     But that 10.399 BTC spend transaction was combined with other UTXOs in a transaction.

I'm stumped as if this was something like your account and 2FA being compromised then it would simply show as a 10.399 BTC spend transaction by itself.  Since Coinbase doesn't give out private keys there's no way for a thief to create a transaction that looks like a "You sent Bitcoins to an external account" 10.399 BTC withdrawal in the Coinbase Transactions history but at the same time have a transaction combined with other inputs at the blockchain transaction level.   (Unless, again, this was a private key that you imported but I don't know how Coinbase handles importing of paper wallets / private keys).  

Can you confirm that this address was NOT a paper wallet/private key that you imported?

I've never had a paper wallet, and am not sure what a private key is. I've never imported anything into Coinbase at all.

In a related side note I checked the API Key Access ,but that is disabled and I've never enabled it. It also says no applications have been granted access.

[ca1yps05]

Here's what the transaction page says now. Same thing it said since the transaction went through:

http://d.pictureupload.us/67790295351c673a941187.jpg

This is all very, very strange because when a payment is sent from Coinbase it gets sent as a single transaction.     But that 10.399 BTC spend transaction was combined with other UTXOs in a transaction.

I'm stumped as if this was something like your account and 2FA being compromised then it would simply show as a 10.399 BTC spend transaction by itself.  Since Coinbase doesn't give out private keys there's no way for a thief to create a transaction that looks like a "You sent Bitcoins to an external account" 10.399 BTC withdrawal in the Coinbase Transactions history but at the same time have a transaction combined with other inputs at the blockchain transaction level.   (Unless, again, this was a private key that you imported but I don't know how Coinbase handles importing of paper wallets / private keys).  

Can you confirm that this address was NOT a paper wallet/private key that you imported?

As I said before, my transaction data for my lost BTC is EXACTLY the same as that shown for DanzoFriend.

I have never imported any paper addresses. Only used the ones supplied randomly by Coinbase.

We are in the same boat, and it sucks.