My Coinbase was just compromised

[damiano]

As the title states. 

I have SMS verification and Google 2FA on the account.

Here is the hash/txid

https://blockchain.info/tx/5ed1434a78fcba878f18693f63e7ddaf98f0154d77e6ffa84f32dfa1395c2060

It's been almost 3 hours since I submitted a support ticket and still nothing

[1714095014]

1714095014

[1714095014]

1714095014

[goxed]

As the title states. 

I have SMS verification and Google 2FA on the account.

Here is the hash/txid

https://blockchain.info/tx/5ed1434a78fcba878f18693f63e7ddaf98f0154d77e6ffa84f32dfa1395c2060

It's been almost 3 hours since I submitted a support ticket and still nothing

This doesn't bode well.

[damiano]

As the title states. 

I have SMS verification and Google 2FA on the account.

Here is the hash/txid

https://blockchain.info/tx/5ed1434a78fcba878f18693f63e7ddaf98f0154d77e6ffa84f32dfa1395c2060

It's been almost 3 hours since I submitted a support ticket and still nothing

This doesn't bode well.

Still no response from anyone. 

I just got off the phone with Wells Fargo and they froze everything.

[pdawg]

Sounds like you did not get an SMS confirmation, so it was not logged in via 2FA?  So then they are internally compromised.  So much for cold storage wallets they claim to be using???

[geofflosophy]

Scary stuff, I'm watching closely.

[crazy_rabbit]

As the title states. 

I have SMS verification and Google 2FA on the account.

Here is the hash/txid

https://blockchain.info/tx/5ed1434a78fcba878f18693f63e7ddaf98f0154d77e6ffa84f32dfa1395c2060

It's been almost 3 hours since I submitted a support ticket and still nothing

I don't quite understand- what happened?

[BitcoinWalker]

Looks like the coins were sent out from his account without permission. But a lot of people are making claims like this one so the truth can't be told.

[damiano]

Here is a brief update.

I have spoken to Olaf once and it wasn't very productive conversation.  I believe my 2FA code was stolen (neglegence on my part was keeping it around in the first place)

I just woke up to find my checking account with Wells Fargo to be 100% drained with overdraft kicking in,

My Coinbase account was linked to a savings account which was linked to a Wells Fargo Visa.  On Monday 12/02/13 I spoke with Wells Fargo and they froze both accounts.  On Wednesday they attempted to withdraw and failed.  Now this morning I woke up and found my checking account drained with overdraft kicking in

When I first signed up with Coinbase this year I had linked my checking account, but within a month I DELETED IT and relinked a savings instead.

My CHECKING account wasn't even being listed at all on Coinbase, but it appears they keep that information..

I still cant reach Olaf, I messaged him on here as well and submitted a new ticket.

[bitmarket.io]

Here is a brief update.

I have spoken to Olaf once and it wasn't very productive conversation.  I believe my 2FA code was stolen (neglegence on my part was keeping it around in the first place)

I just woke up to find my checking account with Wells Fargo to be 100% drained with overdraft kicking in,

My Coinbase account was linked to a savings account which was linked to a Wells Fargo Visa.  On Monday 12/02/13 I spoke with Wells Fargo and they froze both accounts.  On Wednesday they attempted to withdraw and failed.  Now this morning I woke up and found my checking account drained with overdraft kicking in

When I first signed up with Coinbase this year I had linked my checking account, but within a month I DELETED IT and relinked a savings instead.

My CHECKING account wasn't even being listed at all on Coinbase, but it appears they keep that information..

I still cant reach Olaf, I messaged him on here as well and submitted a new ticket.

Your bank will cancel all transactions from coinbase if the requested amount puts your account in the negative.  It may say your account is in the negative while the transaction is pending, but the closer it gets to that delivery date the sooner they will cancel the transaction.

Had the same thing happen to me. I accidentally placed a huge order from my phone app while i checking prices.

[damiano]

Here is a brief update.

I have spoken to Olaf once and it wasn't very productive conversation.  I believe my 2FA code was stolen (neglegence on my part was keeping it around in the first place)

I just woke up to find my checking account with Wells Fargo to be 100% drained with overdraft kicking in,

My Coinbase account was linked to a savings account which was linked to a Wells Fargo Visa.  On Monday 12/02/13 I spoke with Wells Fargo and they froze both accounts.  On Wednesday they attempted to withdraw and failed.  Now this morning I woke up and found my checking account drained with overdraft kicking in

When I first signed up with Coinbase this year I had linked my checking account, but within a month I DELETED IT and relinked a savings instead.

My CHECKING account wasn't even being listed at all on Coinbase, but it appears they keep that information..

I still cant reach Olaf, I messaged him on here as well and submitted a new ticket.

Your bank will cancel all transactions from coinbase if the requested amount puts your account in the negative.  It may say your account is in the negative while the transaction is pending, but the closer it gets to that delivery date the sooner they will cancel the transaction.

Had the same thing happen to me. I accidentally placed a huge order from my phone app while i checking prices.

The funds are withdrawn and gone.  I had to file a dispute. 

[michiganmushrooms]

This is scary stuff... Please keep us updated on all this. I would be very interested to hear if any others had issues like this(bad actors getting into check/save accounts).

[Martijnvdc]

Oh god... Not a second inputs.io...
Here we go again.

[kireinaha]

Doesn't make sense. How can a 2FA be stolen? It's a randomly generated value and only valid for a matter of seconds.

Unless you select Coinbase's option to not require 2FA again for 30 days from the same computer? If that PC is compromised with a keylogger, then it could be a problem.

[Martijnvdc]

Doesn't make sense. How can a 2FA be stolen? It's a randomly generated value and only valid for a matter of seconds.

Unless you select Coinbase's option to not require 2FA again for 30 days from the same computer? If that PC is compromised with a keylogger, then it could be a problem.

It could be compromised from inside Coinbase itself. Just like with the so called "inputs.io hack".

[naphto]

Did you activate 2FA and SMS before the hack?

[damiano]

Doesn't make sense. How can a 2FA be stolen? It's a randomly generated value and only valid for a matter of seconds.

Unless you select Coinbase's option to not require 2FA again for 30 days from the same computer? If that PC is compromised with a keylogger, then it could be a problem.

Every time I enabled a 2FA I would take a screen shot of the code and keep it.  I believe it was either taken from my email or my desktop.  I only found some malware on my desktop, but then I said fuck it and wiped the whole disk.

[damiano]

Did you activate 2FA and SMS before the hack?

Both were active before it of course.

Although this week SMS doesn't work for me anymore.

I have to do the phone call where they tell me the code

[balanghai]

So how was this possible? Coinbase employee needs to make ends meet?

[Martijnvdc]

Does anybody know if there have been any similar reports?
This seems like quite a serious issue...

[michiganmushrooms]

This is an extremely serious issue! And I'm really surprised it's not getting more traction on the board here... I guess everyone is used to bitcoin services being inherently unsafe. But wasn't coinbase 'supposed to be different'?