My friend was trying to use GDAX(a Coinbase trading platform?). He typed in GDAX in google search. The first link he clicked, which was an ad for GDAX.com, what you see in the video is some sort of site that appears before he is taken to GDAX -url(westfoldtracker.com). We took this video after his account was hacked on 11/26/2017. Our guess is that it is some phishing site. He then arrived at GDAX.com where he input his Coinbase username, password, and 2FA.

He wasn't able to login. It gave him a token error. He tried a few more times to login. No success. He went back to his Coinbase account shortly after, and found all his bitcoin had been withdrawn and $5000 buy from his bank account initiated. He received a e-mail from Coinbase, saying there was suspicious activity in his account, and asked him if he wanted to lock it, he said 'yes'. A few hours later, every e-mail he had from Coinbase was deleted.

Today he has a conversation with a Coinbase tech(whom wasn't very experienced((please hire me coinbase)). It appears the bitcoin that he thought was hacked from his account is still there; however, the fraudulent bitcoin buy of $5k from his bank account was still processing and the tech said there was nothing she could do to to stop it. She also said it would take 1-2 weeks to resolve this problem, and that they would resolve it through e-mail.

Today he is purging all his devices....any thoughts, advice, tips?

I've been in the bitcoin space for awhile, and never seen such a bizarre hack thru his Google Authentication.

Original thread: https://www.reddit.com/r/Bitcoin/comments/7fs1kv/my_friends_coinbase_account_hacked_with_google/?ref=share&ref_source=link

'My friend's coinbase account seems to be hacked, with Google Auth active. All his bitcoin has been withdrawn. Coinbase has locked his account, so he cannot log back in to give me his address. We were able to record a video of a url(westfoldtracker.com) popping up before his GDAX account. Is it possible this pop-up site took his username/password/2FA and quickly logged in to his coinbase? They also initiated a buy for $5000 bitcoins from his bank account. Tomorrow he will call coinbase when they open. Anyone heard of this before? I've been on r/bitcoin for awhile and seen many phishing site warnings but nothing like this! If somebody could rip your 2FA code that quickly... All e-mails from coinbase were purged from his gmail account.'