When you create a wallet, it generates a unique 12-word recovery or seed phrase representing the private keys of the cryptocurrencies associated with your wallet.
You can use this phrase to import to any non-custodial wallet that supports it to access funds. That being said, once this recovery phrase is exposed to another party, they can use it to transfer funds without your authorization. Because your wallet is a user-controlled and non-custodial product, meaning that only you have full control/access (including the recovery phrase), we cannot provide any additional details about how it was compromised.
Due to the irreversible nature of cryptocurrency protocols, transactions can neither be canceled nor reversed once confirmed on the blockchain. If you still hold any funds, we recommend that you immediately send them to a secure address. You can create a new wallet and then transfer those funds to it.
We cannot generate a new key for your new wallet. For more information, please refer to the Coinbase Wallet FAQ page.
If you haven’t already done so, you may want to report this incident to law enforcement agencies in your jurisdiction, as well as the FBI Internet Crime Complaint Center (IC3): https://www.ic3.gov/complaint/default.aspx/
Coinbase is willing to cooperate with law enforcement investigations pertaining to your compromised wallet.
For more information about spotting and avoiding cryptocurrency scams, we recommend reading the following help articles: