Bitcoin Forum

Can Coinbase be hacked if you use 2 factor Authentication, email address associated Gmail with 2 factor ID with SMS verification. Gmail is my regular account which I log into often.

I log in on my laptop which is fairly secure and smart phone android.

Not unless someone has both your password and your phone; otherwise, no.

either you probably can hack your friend, if u know his/her closely (family, pets, etc)
what do u think about this issue?

ps dont deposit your passs in phones!!!

Ok thanks good to know. I am treading into BTC. Just hearing about all sorts of scams and hacking I just want to protect myself.

I would prefer 3 factor ID, password, yubiKEY, and google authenticator.

Be warned any kind of online wallet is not safe, no matter how big the reputation of company, since you actually never have the wallet in your possession.

Thanks I am just building up a few K for now. Once I build up more I will look into paper wallet and securing it.

everything can be hacked but it depends how hard is it to do so because some sites are extremly secured from such attacks ;)

Correct, if we're talking about a server side attack (on Coinbase) then there could be trouble. As far as just access of use for your account, it is extremely secure with 2FA. As others have said, best case is not to keep any assets in the cloud.

Armory is highly recommended!

Yes it can be hacked. every online wallet can be hacked,whatever they tell you. There were small compromises of CoinBase in the past and people lost bitcoins. offline wallets are probably the safest.

coinbase has very good intentions to be hackerproof, they mention empleyees are security cleared. If they have implemented what they say, it is quite secure. It is best to be couscious though.

SMS verification on smart phone may be problem, especially when you are connected to internet with it and browsing or playing variety of games - it can be compromised

mobile sms can hack, password too.
But it is very expensive to hack sms.
hacking password is very much depends on its complexity.
And of course viruses - they like windows and windows like them.

Any place can be hacked.  Two factor auth will prevent you from bring hacked with a keystroke logger.  The hacker will need your password "Something you know" and the google auth app on your phone "Something you have" in order to access your account. 

Though sites have been working hard to counter hackers, every sites may be hacked.
It would be better to store your funds in your offline wallet.

Just because someone security cleared doesn't mean they know how to write secure code.  As a CEH & OSCP I regularly get through apps written by very security conscience developers/project teams.

MFA protects you from yourself and the likelihood that your system will be compromised.  

As for the security of the system, defense in depth and design and development with a focus on security goes a long way.  Were talking typical infrastructure security like Firewalls, IDS/IPS, WFA and the such are just not enough.  

Typically systems are built to meet the business need.  Business defines functionality, then use cases and test cases are written.  They tend to forget about the abuse cases, and that is when I can get in.  

What needs to happen in addition to all the infrastructure security, is that non functional requirements like security are considered from the beginning and developers are trained in defensive software development, designers trained in such things as threat modelling, business owners place as much focus on security testing as they do on functional, performance and UAT testing.  Then you stand a chance.

So, it's as secure as they allow it to be.  They will always claim it is secure, but the truth is in the pudding.  I have no idea if they are or they are not.  I certainly hope they are as I know many people rely on them.

Hypothetically, any website can be hacked.

The question is how hard is it to do so.

For big, trusted companies like Coinbase, I think it is very unlikely someone will figure out how to hack them.

yes, of course, anything can be hacked. security is just a deterrent...... but your're fine, from the sound of it

if you have coins, withdraw to a wallet you control, though. no reason to leave em in a hosted wallet. that's asking for trouble

I think Sony was bigger and more trusted.

That is still 2 factor.  Password is something you know.  The yubi key and google auth is something you have.  To get third factor you must include something you are (Bio metrics).

biometric -- that's what i want! ;D

Big? Trusted?
How did you already come up with these words?
Have they existed for such a long period to label them as secure and trusted?

Also,far bigger and older companies have been hacked to promote Coinbase as impenetrable.

Is a password something like this complex enough

Akasha#5123&7623

i dont think coinbase is safe at all. no hosted wallet is safe.

keep coins with 3rd parties at your own peril!

It seems they have an API vulnerability. Several accounts have been hacked.. So what is the safest way to store Bitcoin.. Paper wallet.. and if there is fire thats gone too ?

Your password works out in theory to be a 104.87 bit password ( bits of entropy ), so thats a fairly difficult to crack password ( although I would not have so many numbers in a row like that ).

Theoretically, any password can be bruteforced, but just not in the real world.

example: Your password cracked in 58 years....
( 94^16 / 2 ) / ( 10^22 ) / 60 / 60 / 24 / 365.25 = 58 years at a 10 Sextillion hashes per second bruteforcing it.

Attackers are going to focus on the easy hacks first before ever trying out bruteforcing passwords. APIs, installable wallets, through to the yea old database code injection hacks would be the place most of them would start.

no

You really think so? lol

Yes, because the site itself could be hacked, not through an individuals account, but through various attacks through insecure code and services on coinbase itself.

I just use coinbase as a conduit for converting between BTC and USD.  I wouldn't use it as long term storage for significant quantities of currency because that increases the risk of shit happening.

I see a bit too much emphasis on wallet security with some gut wrenching stories about how someone made a super secure wallet and then deleted all keys. I think reliable recovery (have wallet encrypted and backed up in dropbox, email, flash, etc) is much more important on "average" than concerns about security. People are constantly losing massive amounts of bitcoins through the loss of private keys. Coinbase is pretty good at security, but you don't have to store all of your coins there.

One additional important point: paper wallet and "change" address conundrum.
Example: you made a paper wallet with 10BTC in it, then used private keys to send 2 BTC to someone. Do you think that 8 BTC are still in your paper wallet? Nope, they are in your "change" address and this confounded many people before.

Any online site has the possibility of being hacked.  Risk -vs- Convenience on our part. 
Do not put all your eggs into one basket, or all of your coins in one online wallet, exchange, etc...

Indeed, it is always suggested to both encrypt your wallet and make multiple backups.



It depends.
For some wallets, you can adjust the setting to "disable" the use of "change addresses".
So, in your example, the wallet will automatically create a tx which send 2 BTC out and 8 BTC "change" back to the original address.

For other wallets, you can still put your own address as a recipient and create the above tx manually (2 BTC out, 8 BTC back to yourself).

Would be really hard to do... but yes. Anything is hackable in some way if it is online.

I would never keep a large amount online.

Can Coinbase be hacked? Definitely.

All those big tech companies like Google, Yahoo, Facebook, Twitter have been hacked previously, what makes you think Coinbase cannot be hacked?

Yes it can be hacked. every online wallet can be hacked

Why do you say it's expensive to hack sms?

What we need is eyelock myris retina scanner.  ;D

I wouldnt worry about it. Always use 2FA on your account. Coinbase keeps most of their coins in cold storage so even if they got hacked, they wouldn't lose much.

Anything can be hacked though they store most of their funds in offline cold wallets which mitigates risk greatly. It's more likely your computer gets compromised giving the attacker access to your account.

I heard Electrum is a good Bitcoin Client, Check it out if you want.

Yup, Electrum is pretty good.
It is easy to use and there is no need to store all the block data.

Another risk of hacking your bitcoins come from the hacking of the site itself and not just your account. you should be careful with both online and offline wallets (have a very secure wallet and hidden private keys etc...)

Yep, unless a server side hacks happense which is unlikely!

I dont think so he would have to have pw and phone.. no chance

Why is it unlikely? We have seen quite a lot of server-side hacking in huge tech companies in the past.

Everything that is online can be hacked.
If it is worth it and/or someone will put the effort in it is another question.

Everything can be hacked. To hack this they will need your password and the google auth app on your phone

Do not store your bitcoins on any exchange. There is a chance that they can be hacked. Just store it on cold wallet.

Everything can be hacked... something on the hard way and something on the easy way... it depends about you on what way you'll be hacked...  :)

I think one should have your phone to recover password but as you said you use an Android phone so Android phones are not 100% safe so don't keep useful data in your phone and don't leave bluetooth opened every time.