This is exactly what Bitfinex did back in 2016. They were 'hacked' for $72M, or about 36% of their assets at the time. They logged in, and removed 36% of everyone's account balances and replaced them with IOU tokens. [1] In fact it was believed that Coinbase was a Bitfinex customer at that time - and that they were one of the few accounts not actually given a haircut because I assume their lawyers mumbled something about 'fraudulent conversion.' [2]

[1] https://www.reuters.com/article/us-bitfinex-hacked-hongkong/...

[2] https://definitions.uslegal.com/f/fraudulent-conversion