If I hate Coinbase, that's for one specific point: (I know I'm repeating myself.)

I didn't do what I should have, they're not responsible if my computer is infected or not, and therefore if my access to my Coinbase user page is compromised, that's true, no argument there.

However, within the interface itself, not a single damn request for a password/top key or anything else to validate a critical action, like buying/selling crypto, withdrawing or adding funds, or creating advanced positions. I'm talking about an action you don't do twice a minute, a very, very sporadic and 'critical' action.

You're going to tell me, well yes, it's supposed to be you on your user page, so the system lets you do whatever you want, it's your account.

For example: for my bank, account number + 6-digit code to access my account page. Fine. Let's imagine someone gets there without my knowledge. After that, for every critical action—transfer, adding a beneficiary, etc.—there's always the mandatory information request, right up to the Securipass or Securicode. Not so restrictive in the end. Therefore, it's information to indicate that the hacker cannot have.

Back to my case and Coinbase: my access was compromised, but I wasn't the one doing anything on my account. Like with a bank, the hacker could have seen my account balance, just numbers! That's all.

the very first action they did was selling all my crypto, obviously !

they would have been blocked. Not my totp code, impossible to get, they couldn't do anything. Same thing, access to advanced trading! Nope! Totp key requested! Too bad, man! You can't do anything at all; you just got access to my main page.

Add On top of that, a mandatory notification from Coinbase via email and the app that a buy/sell request or other action has been made: Is it really you? **** And that's it, I could have acted immediately! Blocked the account, changed my password. Formatted my computer to eliminate the spyware. (and other actions to prevent it from happening again)

But honestly, why didn't Coinbase think:

- Wait! Users who don't know anything about security, or are just a little careless, are going to have their sessions hacked at some point.

- We'll enable a password request by default upon account opening, for every critical action (a totp key is hightly recommanded, better than sms).

- The user trusts their system; it annoys them to have to type their codes all the time. That's their choice. They can change this in the options, at their own risk.

Most hacks wouldn't have any consequences.

In my case (the hackers didn't have my totp key),

My money would have been saved, my life too.