If this is the same SS7 protocol flaw that security experts have been using to justifiably avoid SMS in 2-factor auth schemes forever now it's face palm inducing. Not that this sounds like a simple hack if they also compromised inboxes. Sounds like the victims were already very well owned at that point. Lesson learned I guess. I wonder how much it cost Coinbase.