[solveit]

The article is not heavy on details, but it sounds like they spoofed a Coinbase notification while the victim was on the legit Coinbase website, so the most likely possibility is that the machine was compromised.

[joezydeco]

So....just a lucky phishing event, malware on the machine waiting for a Coinbase login to appear, or something else?