The customer.

Unfortunate way to learn that SMS 2FA/MFA isn't adequate, especially when TOTP is available. Unfortunate way to learn, Not Your Keys, Not Your Coins. That being said, Valve has a higher level of security on my Stream account than Coinbase has. With Steam, a password reset triggers a 5 day marketplace/trading suspension.

I presume from the article an email account was hacked (password available?), which gave means for a Coinbase password reset, and then a SIM swap occurred on his account leading to a withdrawal.

One might argue Coinbase has a duty to do more here -- nothing on their site (at least the security/mfa section) suggests SMS isn't good enough. PcMagazine[1] suggests 95% of users rely on SMS 2FA/MFA, and Coinbase seems aware that these phishing campaigns are happening against SMS 2FA/MFA [2].

[1]: https://www.pcmag.com/news/95-of-coinbase-users-rely-on-sms-...

[2]: https://www.bankinfosecurity.com/crypto-exchange-coinbase-de...

Usually they do the SIM swap first, use SMS to recover email, then use email+SMS to recover Coinbase. I agree that Coinbase could do more.

Like supporting TOTP?

https://help.coinbase.com/en/coinbase/getting-started/verify...

Like forcing TOTP

The fact that Coinbase offers 2FA via an app is already potentially more secure than most US banks.

It would be far better if Coinbase defeated to TOTP for 2FA.

Sibling comment says "the cuatomer", yet I'm not seeing how either the customer's SMS provider is not at fault if they did not sufficiently authenticate the customer when sending an SMS to a scammrr's device instead, else Coinbase for allowing SMS as an authentication mechanism.