either u or coinbase, if u clicked something malicious before and most likely you had been hacked by someone from ur own action so you are the one who should get blamed. coinbase is a pretty much a safe exchange in terms of security, so i think you had done something bad before.