10/09/2026
"Screenshot everything, just screenshot it." That's what one client's wife kept saying while he sat refreshing the transaction page, watching money leave.
She was right. Save the login IP history, the 2FA change confirmations, and every automated alert from that night. Transaction records stick around for years. The security logs showing who signed in, from where, and when are typically kept in active systems for roughly 30 to 90 days before they're archived or overwritten.
A "2FA changed" email often carries more weight than the withdrawal itself, because it can pin the moment the exchange's own system saw the access you're calling unauthorized.
Coinbase's user agreement also requires you to tell Coinbase Support immediately once you suspect your account is compromised. Waiting until Monday gives them something to argue about.
If you want a second set of eyes on your login history and those alerts, call us: (888) 578-6255.