What should you do if your Coinbase account is hacked?

If your Coinbase account is hacked, the first step is to lock it so no more crypto can leave, then take back control of the email and phone tied to it. After that, report what happened to Coinbase and to the police. Speed matters because crypto transfers usually cannot be reversed once they confirm.

What should you do first if your Coinbase account is hacked?

Coinbase's help center lists these steps:

1. Lock the account. You can do this through Coinbase Support, or by calling Coinbase's automated line, which in the US is +1 (888) 908-7930. Coinbase says a lock restricts funds from leaving the account and blocks access to it.
2. Reset your email password and check for unfamiliar forwarding addresses, filters or recovery emails.
3. Scan your devices for malware and update their software.
4. Change passwords on any linked bank account and turn on two-step verification there.
5. Protect your phone number against SIM swap attacks.

Only get back into the account after these are done. Coinbase lists support through chat, phone and email around the clock, reached through its official help site. Be wary of anyone who contacts you first claiming to be Coinbase. In the 2025 incident described below, customers lost funds after being tricked by people posing as the company.

How do you report a Coinbase account takeover?

Coinbase asks users to report unauthorized transactions right away. Its help page says to first check that a charge is not a recurring buy or a charge reversal, make sure the account is secure, gather the transaction details and then contact Coinbase Support. If an unknown third party removed funds, it says to contact local authorities immediately. Our guide on how to report a crypto scam lists other agencies that take reports.

Does Coinbase refund hacked accounts?

Not by default. Coinbase's insurance page says its crime insurance does not cover losses from unauthorized access to a personal Coinbase account, and that users are responsible for keeping their login details secure.

There is a narrower exception. Coinbase One account protection, offered to select members and not in all regions, covers unauthorized sends by a third party, such as after phishing or a device compromise. It requires a passkey or security key, and it excludes transfers you approved because someone deceived you. Coinbase says reimbursement usually arrives within five to seven business days after its investigation.

Coinbase has also made one-off offers. After a 2025 incident in which support contractors were bribed to leak customer data, Coinbase told the SEC on May 15, 2025 that it planned to voluntarily reimburse eligible retail customers who were tricked into sending funds as a direct result.

How can you lower the risk of it happening again?

Use a passkey or hardware security key rather than SMS codes, and never share codes with callers. Our guides on how to secure a crypto exchange account and whether Coinbase is safe go further.