its a big mistake .
send directly from a wallet with no fully control of that wallet for investement plan.
i wonder , he(OP) reads the terms and conditions, but did the OP seeing about simple notice like " dont send funds directly from third party" .
because, i guess most of good investement plan have a notice like that, such as GNT,PowerLedger, even Monaco, i quite remember about it.
This, of course, should be a basic principle, but if Coinbase has such a good opinion about security, someone just trusted them.
Of course, nobody should do that, but I guess someone bought BTC there and wanted to invest it immediately, bypassing sending them through his desktop wallet.
The mistake was that this person did not notice that the withdrawal address was different from the deposit address.If he knew this, he would probably inform the investment platform in time and change the address.