Your friends are forwarding you screenshots of crypto giveaway links you never sent. You got an email about a sign-in from a country you have never visited, and now your password no longer works. Maybe you opened the Coinbase app and your balance looks wrong, or a transfer is pending that you did not authorize. That sinking feeling is real, but so is the path back. Coinbase has a built-in way to freeze a compromised account, a password reset that runs through your email, and an identity-based recovery flow for when you have lost access to your two-step verification. Work through the steps below in order, starting with the fastest action that stops the bleeding.
Make the new password count. A free strong password generator produces a long random string or a memorable passphrase locally in your browser, which beats any reused or predictable choice.
Before you touch anything, one rule keeps you safe throughout this process. Start your recovery on a device, browser, and network you have used to sign in to Coinbase before. This avoids triggering a temporary security restriction and reduces the chance of fresh verification roadblocks. Never create a new Coinbase account to report the hacked one. And no matter who contacts you, never share your password, a verification code, or a two-step verification code with anyone. Real Coinbase support never asks for those.
Lock the Account Down Before the Attacker Moves Funds
If you believe someone has gained unauthorized access, the single fastest thing you can do is enable Security Lock. This freezes the account so no one can trade, transfer crypto, or change your settings while you sort out the rest. Importantly, while Security Lock is on you can still sign in, view your balance, review your transactions and activity, and contact support, so you lose nothing by turning it on immediately.
You can enable Security Lock from the Coinbase mobile app or on Coinbase.com. Open your settings, go to the security section, and select the Security lock option, then review the warning and confirm. Make sure you are on the genuine official Coinbase app or website before you sign in. The account stays frozen until you unlock it, which buys you time to reset your password and reclaim control without watching helplessly as crypto leaves your wallet.
Reset Your Password Through Your Email Code
Whether your password simply stopped working or you want to push the intruder out, reset it next. Go to the Coinbase password reset page, enter your email address, and select Reset password. Coinbase emails you a 6-digit verification code. Enter that code on the reset page to set a new password.
Do this from a device you have recently used to access Coinbase. Resetting from an unfamiliar device or network can trip a temporary security restriction that slows you down. The password reset lives on the Coinbase login domain under the forgot-password flow, so confirm you are on the genuine official Coinbase domain before you type your email or your new password. You will also need to reset your password as part of unlocking the account after a compromise, so doing it now keeps the later steps moving.
Sign Back In and Unlock, Verifying Based on Your Balance
With a fresh password, sign in on Coinbase.com or in the app using your email and new password, complete your two-step verification, then follow the prompts to unlock your account. To unlock a compromised account, you must be able to complete your two-step verification, so keep your authenticator app or your verification method handy.
How much identity proof Coinbase asks for here depends on your account balance:
- Under $300: email, password, and two-step verification only.
- $300 to $20,000: automated identity verification.
- Over $75,000: identity verification with manual review, which can take 48 to 72 hours.
Plan around one more detail. Crypto sends are disabled for 24 hours after the account is unlocked. That hold is a security feature, not a glitch, so do not panic if you cannot move funds out the moment you are back in. If a higher-balance manual review is involved, only upload identity documents on the genuine official Coinbase domain, never through a link someone sent you.
Reclaim Access When You Have Lost Your Two-Step Verification or Email
The hardest scenario is when the attacker changed your two-step verification, or you lost the phone or email tied to it, and you can no longer complete that step to unlock. Coinbase handles this through its Account Recovery flow, which verifies you with your identity instead.
- 1.Open the 2-step verification settings page.
- 2.Select "Lost access to your 2-step verification?"
- 3.Select "Get started."
- 4.Enter your password (reset it first if you lost it or never set one).
- 5.Upload your ID.
This recovery process takes up to 24 hours. As with a standard unlock, you may be unable to send funds for 24 hours after it completes. The moment you are verified and signed back in, update your two-step verification method. You should do this within 24 hours of regaining access to keep your access secure and lock the attacker out for good.
There is one shortcut worth checking first. If you use an authenticator app such as Google Authenticator and you saved the secret seed that was shown when you set it up, you may be able to restore your codes on a new device directly from that seed, with no upload required. Note that Coinbase cannot recover or replace lost security keys. If a security key is unavailable, you will need to sign in using a backup two-step method.
Report Unauthorized Transactions and Email Coinbase Security
If money already moved, treat it as urgent. Report any unauthorized transactions on your bank statement or your Coinbase account or statement immediately. If an unrecognized third party has removed funds, contact local authorities right away. Coinbase works with authorities during the investigation, so a police report can support your case.
For anything that simply feels off, even if no funds are missing yet, lock your account in the app and email [email protected] to report it. Sending that report from the email tied to your account creates a record and flags the compromise to Coinbase's security team while you continue the recovery steps. Forward any suspicious or phishing emails impersonating Coinbase to that same address so they can act on them.
Reach Coinbase Support When You Still Cannot Get In
If you have worked through the steps above and you are still locked out, escalate to a person. Use the official Coinbase Support and Contact us pages to reach the team. Coinbase offers support through chat, phone, email, and mail, and the support page includes options to chat with Support or request a call. Reach these pages only from the genuine official Coinbase domain.
Before you open a ticket, run through the official Coinbase guide for when you cannot sign in to your account, which covers the common sign-in fixes in order: reset your password, complete your two-step verification, then complete identity verification to confirm it is you. Many lockouts clear at one of those steps. Whatever you do, do not pay any third-party "account recovery service" that promises to get you back in. Legitimate Coinbase recovery happens only through Coinbase's own pages, and no genuine service needs your password or codes to help you.
Harden the Account So It Cannot Happen Again
Getting back in is only half the job. Once you have access, strengthen the account using Coinbase's official guidance on making your account more secure, which includes setting up or updating strong two-step verification. If you went through Account Recovery, remember the 24-hour window to refresh your two-step method, and choose a method the attacker cannot reach.
Review your sign-in security as a routine habit afterward. Confirm you can complete two-step verification cleanly, keep your recovery email secure, and save your authenticator secret seed somewhere safe so a lost phone never locks you out again. The official Coinbase guide for when you cannot sign in is a useful reference to bookmark, since it walks through the password reset, two-step verification, and identity verification sequence that defines normal recovery on Coinbase.
Frequently Asked Questions
How long does Coinbase account recovery take?
It depends on your balance and the type of recovery. After a Security Lock or identity check, accounts under $300 need only email, password, and two-step verification; balances of $300 to $20,000 go through automated identity verification; and balances over $75,000 require identity verification with manual review, which can take 48 to 72 hours. A lost email or two-step verification recovery through the Account Recovery flow takes up to 24 hours.
Why can't I send crypto right after I unlock my account?
Crypto sends are disabled for 24 hours after your account is unlocked or recovery completes. This is a deliberate security hold to stop an attacker from draining funds the instant access is restored, so wait out the window rather than assuming something is broken.
I lost access to my two-step verification. Can I still get back in?
Yes. Open the 2-step verification settings page, select "Lost access to your 2-step verification?" then "Get started," enter your password (reset it first if needed), and upload your ID. That recovery takes up to 24 hours, and you should update your two-step verification method within 24 hours of regaining access. If you saved your authenticator app's secret seed, you may instead be able to restore your codes on a new device from that seed.
Will Coinbase support ever ask for my password or a verification code?
No. Real Coinbase support never asks for your password, a verification code, or a two-step verification code. Anyone who does is trying to take over your account. Only enter those details on the genuine official Coinbase domain, and never share them in chat, by phone, or over email.
Should I create a new account to report that my account was hacked?
No. Never create a brand-new Coinbase account to report a hacked one. Use Security Lock and the recovery steps on your existing account, email [email protected], and contact Coinbase Support through the official Contact us and support pages instead.
Someone took funds from my account. What should I do first?
Report the unauthorized transactions on your bank or Coinbase account or statement immediately, and lock your account in the app. If an unrecognized third party removed funds, contact local authorities right away, since Coinbase works with authorities during the investigation. Then email [email protected] to report the compromise.
