Once they've done that, they can just set up an automatic sweep of all incorrect addresses (just like they sweep all correct addresses multiple times a day) and credit customers accordingly. Their whole "too time consuming" argument is complete nonsense. They are stealing from their customers and they can't be bothered to fix it.
Delete Coinbase.
they would need to go outside of their established security protocols and dump private keys from their bitcoin hot wallet. that's rather risky, which is the more important factor for me.
i'm fairly sure coinbase (and most exchanges) structure their key architecture in a way that would make it costly in terms of man hours vs the financial benefit customers receive. it sucks, but customers really ought to heed the warning virtually every altcoin-supporting exchange posts on the deposit page---that deposits on the wrong chain will not be credited.
for example, this is what kraken has told customers in the same exact situation:
This is what Kraken replied to me:
"You are absolutely correct about us possessing the private keys in this circumstance. That being said, it isn't as straight forward as you might think. Kraken is a cryptocurrency exchange and the nature of cryptocurrency exchanges are wholly different from the experience you might have with a personal wallet where you have easy access to the private keys. With things like the theft of Mt Gox, the internal compromise of Shapeshift, the social engineering of BitPay, and others, we must put security as the paramount concern. As such, our exchange is setup in such a way that nobody within Kraken can unilaterally move funds. We believe that this is a very important protection that makes it extremely difficult for client funds to be stolen by external or internal parties.
Only a very small group of people at Kraken (devs) have the ability to access your funds given an auditable thorough process of checks and balances. This makes the process extremely resource (time) intensive for the devs that have very full plates and very little time to dedicate to any specific task. They must prioritize all of our tasks internally and the requests of clients as best they can. We think that the prioritization of improving our UI/UX as to avoid these type of mistakes will show the greatest dividends for our clients."
bittrex takes another approach. although they refuse to recover coins in a bunch of different scenarios and will deny any request at their discretion, they will usually recover coins in this case
if your deposit is big enough and they are informed immediately. they will charge a sizeable fee:
Bittrex will only attempt to recover crosschain deposits that exceed $5000 at the time of deposit, within 7 days of the deposit and will charge a 0.1 BTC for this recovery. Recovering coins crosschain is an inherently dangerous and time consuming process.
that fee rises to 0.25 BTC in cases of removed wallet support or unsupported ERC-20 tokens. if the lost deposit is big enough, i reckon coinbase
might be willing to recover it too.
anyway, there are lots of good reasons to shit on exchanges, especially coinbase. this is not one of them IMO. i don't mean to be insensitive, but if you send cryptocurrency to the wrong address, you should be prepared to lose it.
But what they should've said here is that we'll sweep a load of our addresses at some point, as they clearly have in this case, and sort you out when it happens with no guarantee of when it'll happen.
they can't just "sweep" the addresses though. they have to dump and import them into a different wallet on a different blockchain. that carries very, very serious security implications for their bitcoin hot wallet.
tbh, i wouldn't like the idea of customers fucking up and exchanges constantly manually dumping private keys to bail them out. it puts the security of all user deposits at risk.
