"Coinbase's security procedure fails to flag and hold obviously fraudulent and unauthorized transactions…Any commercially reasonable policy would have assessed this combination of troubling factors, flagged the transactions as suspect, and held or rejected the transactions as likely to be fraudulent," the complaint states. "Once [Ferguson] notified Coinbase that his phone had been compromised, Coinbase had an obligation to cancel the transfers and freeze the account to prevent further unauthorized charges."