UPDATE: CoinBase eventually concluded that my API key may have been exposed due to a security flaw that they've since patched. They decided to refund me, and my coins have been returned. Thanks CoinBase!