Bugs. I have discovered two bugs personally, reported them to Coinbase, and those are still unresolved.

For context, I reported couple of bugs to MtGox back in the day, and even MtGox fixed them in under a month which is more than what I can say for Coinbase. I guess this is what happens when Coinbase speed-hired 100 people in one year with no proper team-building exercises.

Mostly that if anything goes wrong their support tends to be incredibly unresponsive. Also make sure you're not using SMS-based 2-factor authentication with them since there's a long history of people getting their phone numbers stolen and then their Coinbase accounts drained within minutes.

> tends to be incredibly unresponsive

Correction, there is no support. I have a bit of money permanently locked in a coinbase account because their support does not reply at all.

At some point I will just have to convert it all to BTC and send it elsewhere. Caveat Emptor.

I had the same experience. Got locked out of 2FA, spent two weeks waiting for a reply from support, only to be told that I should just make a new account. Unfortunately I haven't found an easier option for buying BTC.

I had the opposite experience, though this was before Coinbase created/supported recovery codes for 2fa. My phone with the 2fa app bricked and it was a painless, one-message exchange with Support to work around it, completed in < 1 business day.

I can confirm: my 2FA has been hacked on Coinbase. My Social Security number + DOB are out on the internet, and it makes it trivially easy to hack companies with poor security protocols like Coinbase, Authy, AT&T, TMobile, Comcast, Yahoo.

Noted.

On the account draining -- well, there's a latency in setting up new bank accounts there. So I'm surprised it's that easy to just yank money out.

Although I did notice there's no account verification. For example, on Vanguard or other platforms they do a small deposit of a few cents and ask you to verify the payment amounts, a process which has a latency of a day or two.

Ah, so people just yank money out by sending it to some wallet. Makes sense.

Are there any ways to make coinbase safer other than a very secure password?

Software-based 2FA, rather than SMS-based.

You mean Google Authenticator? I have this enabled in addition to SMS.

Right. See if you can disable SMS-based 2fa and only use the app.

Well, thank god their two-factor has always failed to setup for me.

Never store money on an exchange. Once you are done trading, get it out of there.