What happened
In May 2019, an attacker stole more than $100,000 in cryptocurrency from the personal Coinbase account of Sean Coonce, then an engineering manager at the crypto custodian BitGo. This was a SIM-swap (SIM port) attack on one customer, not a breach of Coinbase itself. On the night of Tuesday, May 14, Coonce's phone lost service and he got a Google sign-in alert.
By Wednesday, May 15, the attacker had taken over his email and Coinbase accounts and swept the balance. Coinbase support later confirmed that all funds had been sent to on-chain addresses outside Coinbase's control. No recovery was reported.
Coonce described the attack in a Medium post on May 20, 2019.
How it happened
- The attacker got Coonce's mobile carrier to port his phone number to a SIM the attacker controlled, and his own phone lost service.
- The attacker started a password reset on Coonce's primary Google account, and the SMS verification code went to the hijacked number.
- From the email account, the attacker moved on to the Coinbase account tied to that address, which was protected only by SMS-based two-factor authentication.
- Over about 24 hours, the attacker withdrew the Coinbase balance to external on-chain addresses.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
