If they use that wording, though, they are putting themselves on the hook to fix the "flaw". That's why I'm skeptical that it was just simjacking. I don't see

If they use that wording, though, they are putting themselves on the hook to fix the "flaw". That's why I'm skeptical that it was just simjacking. I don't see a way that Coinbase could implement SMS 2FA in a way that doesn't have that "flaw".