At least 6,000 Coinbase users had funds removed from their accounts earlier this year, possibly as a part of a phishing attack. The hack took place between March and May 20, according to a copy of Coinbase's letter to affected customers. Hackers exploited a flaw in Coinbase's SMS account recovery process to gain access to accounts and transfer funds.