10
Need advice on (probable) Coinbase account being hacked
(hexbear.net)
Definitely sounds like someone has control of their computer. They should immediately force shut it down, unpower it, and disconnect it from any network connection. If they have no physical way to sever the network connection on the computer itself, unplug the modem/router it was connected to. Really any wifi device it might automatically connect to. Turn off hotspot on their phone.
Next they should immediately change all of their passwords, starting with email since pretty much every other login can be bypassed with a "forgot password" email. Make sure they weren't tricked into installing something on their phone before, or do it from some other device that can't possibly be compromised. Assuming they have a gmail account these are the steps to recover it.
They should use KeePass (fully on device, encrypted by a master password) or Bitwarden (saves to Bitwarden's servers so you can access it from anywhere and don't risk losing the file if a device is damaged, also encrypted by a master password) to generate and store unique random passwords for each site. The master password will need to be something they can remember, but not anything even close to any passwords they may have used in the past. Again make sure that's all done on a non-compromised device and if using Bitwarden make sure the email account used to sign up is fully under their control.
Back up any important files and don't reconnect the computer until it has been fully wiped and reinstalled.
They probably got phished into calling a fake "customer support" number. Depending on the sequence of events, it's likely they got a scam text saying their account was compromised or something and giving the fake number then when they called they might have been asked to run some program, possibly remote desktop software.
If the scammers already got into their coinbase account and transferred the crypto out, there's most likely nothing they can do there. Crypto transactions can't be reversed. The actual customer support number seems to be +1 (888) 908-7930 so they can call that for help.
