Coinbase didn’t prevent the suspicious transfers, allegedly wiped customer’s transaction history, blamed the customer for the loss, then refused to reimburse. Arbitration concluded with $0 reimbursement.
Arbitrator found the complaint had been filed too late, and that the customer had admitted that a third party rather than a Coinbase insider had performed the theft. Doesn’t appear the arbitrator investigated the claims of a possible breach, or how the hardware MFA was bypassed.
As far as the 'filing too late' is concerned, one must love this tiny item in Coinbase's agreement:
'a. Claimant’s EFTA cause of action is time-barred because the “one-year limitations period begins when the first unauthorized transfer occurs, not upon discovery by the consumer, and not when the consumer notifies the defendant of the unauthorized transfer.” '
So much for having your coins 'peacefully' at Coinbase. You have to stay constantly alert.