If I use Google Authenticator for Coinbase, and someone sim-swaps my phone number and gains full access to my email account, can they drain my Coinbase account?
They would be in control of my email, sms, and phone calls.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
It will depend on how Coinbase protects the account from the loss of the 2FA code. If you can get past the 2FA by saying "send me an email/text instead", then 2FA does not protect you at all in this case.
If the 2FA code cannot be bypassed so easily, then 2FA can protect the account better from SIM-swap attacks.
No, the Google Authenticator doesn't stop SIM swapping attacks since the Authenticator (or any other OATH-TOTP app) isn't related to your SIM card in any way. If somebody "steals" your SIM card with a swapping attack, the Authenticator doesn't add any protection.
The Google Authenticator adds a second factor to the authentication process: You need your "normal" password + the one-time password from the Authenticator to log into your service. For this, the Authenticator stores a secret on your device. An attacker can't get this secret with a SIM swapping attack.