Poloniex Data Leak on Twitter

[fratoshi]

The tweet was deleted minutes after Poloniex announce there was a leak, anyone has real proof that the leak is from Poloniex? it seems for me that this is a shady hack, no real proof of it.
Maybe Poloniex was trying to get some exposure on the news, the exchange is already dead and more bad publicity will not really affect them.

[exstasie]

Similar to what happened to BitMex months ago. The issue could happen in every centralized exchange so not gonna get surprised with this.

This could be significantly worse than the Bitmex leak considering Poloniex is forcing a password reset for all accounts. With Bitmex, only email addresses were compromised, so only users with balances and no 2FA were forced to reset their passwords (out of an abundance of caution).

We actually don't know the extent of this leak since Poloniex hasn't been forthright about what happened. For all we know, passwords and KYC data were compromised.

[sisule]

Become new drama with exchange market on new year again where Poloniex exchange market have leak their data and announce it on twitter, will be Poloniex become fist exchange market on this year announce to public their account hack or not, we glad waiting for with their continue announcement about how come their exchange keep better and fix it.

[Swordsoffreedom]

The tweet was deleted minutes after Poloniex announce there was a leak, anyone has real proof that the leak is from Poloniex? it seems for me that this is a shady hack, no real proof of it.
Maybe Poloniex was trying to get some exposure on the news, the exchange is already dead and more bad publicity will not really affect them.

It's not really dead, it still has 41 million USD daily volume and is ranked #65 on CMC. It used to be in the very top back in 2017 so it is in decline, that's true.

[X-ray]

The funny part is actually there is some users that thought the email sent by Poloniex was a phishing attempt and not a genuine email 

I could kinda tolerate to people who are saying such thing. I got massive phishing attempt through email few months ago and you know what's the funny part is, the whole email is saying exactly like the things poloniex said, telling there system is breached and people should do immediate password change. This email format even if it comes from poloniex official mailer still sounds phishy that it could make people just outright ignore the email.

[btccashacc]

I assume the exchange allows for the use of 2FA? That would be one potential positive (and a feature every exchange should offer), though even 2FA does have vulnerabilities that could result in malicious people accessing your exchange accounts.

You might also want to change your passwords for other sites if you have a tendency to use the same password for multiple sites. Hackers like to bruteforce logins on a variety of websites with leaked data, and you never know if another one of your important accounts could be compromised.

If I'm not mistaken, even if you don't enable 2FA, they will send the email verification especially if you're in new IP Address which is good, so even though the hackers got your password they have to get your email to access the verification email. But again users should change the password just make sure something bad will not happen to you. I personally use a different password for different account and I think people should do that too.

[goinmerry]

The funny part is actually there is some users that thought the email sent by Poloniex was a phishing attempt and not a genuine email  

The email was sent from the official Poloniex used email. It should not be confusing nor suspicious to those who received that mail.

If ever those users didn't notice that, the announcement made was enough for them to know that the email was legit.

To verify, after reading the email content they should probably head to any official channel of Poloniex and will check if the announcement was legit and genuine.

[StephenieDuong]

These data leak is really dangerous and i am a victim of this, but lucky my exchange account is empty. I was use the same email and password for all exchange and even bounty. Few months ago, my Bitfinex account was logged 2-3 time each months from strange ip address, i have try to freeze this account but its keep logging in, i have ignore this since i have no money there. Anyway, each password should be use for each site to avoid this problem.

[BitcoinHunt3r]

These data leak is really dangerous and i am a victim of this, but lucky my exchange account is empty. I was use the same email and password for all exchange and even bounty. Few months ago, my Bitfinex account was logged 2-3 time each months from strange ip address, i have try to freeze this account but its keep logging in, i have ignore this since i have no money there. Anyway, each password should be use for each site to avoid this problem.

Different password, and different email for wallet and bounty will be needed. I think you will need it because anything that we submit in a project is not really safe. And then we don't need to reveal our main email except if join bounty and it distributed to some exchange's account.

[luckyflop]

terrible, many market exchanges that have a very good reputation suddenly appear shocking news like that, customer data is leaked to the public. I am a poloniex customer but I never get an email to be told to change my password, I feel safe because I use 2fa. for others, be careful not to use the same password when creating accounts on every website, exchange market, or whatever.

For me poloniex is not a famous exchange at the moment. Currently there are not many users on this exchange and the volume on this exchange is very low. But the issues related to the security of exchanges are always fearful for us because our information can be hacked at any time. And your suggestion is great, we should not use one password for many different websites, because it can be easily searched by hackers.

[moviebuff777]

Not good. This is another reason to avoid keeping coins on exchanges. Although in this case, even if you don’t have coins on Poloniex but have an account with them, it’s not good that the password may be compromised.

[the rise]

Not good. This is another reason to avoid keeping coins on exchanges. Although in this case, even if you don’t have coins on Poloniex but have an account with them, it’s not good that the password may be compromised.

I was quite surprised, this news did not seem to be a big problem, some regarded it as something ordinary. very different when the kyc leakage case in binance arises. Actually there is no significant effect for old accounts because previously they were required to kyc and use authenticator. It's better not to think too complicated and start changing passwords and even resetting 2fa.

[alyssa85]

are you sure about your statement, I am a poloniex user but do not receive messages as you mentioned, on the 30th there was an email but it was about the announcement of smaller fees, if there is indeed a leak it will indeed be very detrimental to the user, despite using 2fa security, I'm sure many users have the same password for other sites,

There is nothing at all on Poloniex's twitter acount about this at all:

https://twitter.com/Poloniex

It looks like this was a scam attempt - with the scammers then trying to persuade people that the email was real in this thread! So a double scam attempt.

[zeze18]

are you sure about your statement, I am a poloniex user but do not receive messages as you mentioned, on the 30th there was an email but it was about the announcement of smaller fees, if there is indeed a leak it will indeed be very detrimental to the user, despite using 2fa security, I'm sure many users have the same password for other sites,

There is nothing at all on Poloniex's twitter acount about this at all:

https://twitter.com/Poloniex

It looks like this was a scam attempt - with the scammers then trying to persuade people that the email was real in this thread! So a double scam attempt.

Yeah that must be a scam attempt and also i think the thread maker is don't know either if it's a scam. Poloniex is an good old exchanges that still operating till right now. I was using it for a long time and nothing problem happened to me. The interface looked like old style but all function is well.

[Dart18]

I dint't receive any e-mail from poloniex.
Am I considered safe on that list?

Maybe it will be better to just change my password.
I have been using the same password for different exchanges and I don't want to jeopardize everything.

[dvmmayowa]

I am a poloniex user and i didnt recieve anything of such, one thing i discover in this space is that scammers would go to any extent to get your exchange accounts compromised. Dont be surprised if your several exchange accounts gets compromised because whoever that's behind it would always try to use the login details you provided to login all other exchanges (The more reason why 2fa is mandatory for all exchanges).

In all, lets just check the credibility of whatever mail we receive to avoid stories that touches the heart...

[exstasie]

The funny part is actually there is some users that thought the email sent by Poloniex was a phishing attempt and not a genuine email  

The email was sent from the official Poloniex used email. It should not be confusing nor suspicious to those who received that mail.

It's pretty easy to spoof the sender's email address in a phishing attack. My gut instincts would have suspected a phishing attack too, especially because Poloniex never publicly announced anything.

There is nothing at all on Poloniex's twitter acount about this at all:

https://twitter.com/Poloniex

It looks like this was a scam attempt - with the scammers then trying to persuade people that the email was real in this thread! So a double scam attempt.

Nope, the emails were real. Poloniex support reps confirmed. They ended up forcing customers to change their passwords: https://thenextweb.com/hardfork/2020/01/02/cryptocurrency-exchange-poloniex-forces-change-passwords-data-leak-twitter/

[countryfree]

There is nothing at all on Poloniex's twitter acount about this at all:

https://twitter.com/Poloniex

It looks like this was a scam attempt - with the scammers then trying to persuade people that the email was real in this thread! So a double scam attempt.

Nope, the emails were real. Poloniex support reps confirmed. They ended up forcing customers to change their passwords: https://thenextweb.com/hardfork/2020/01/02/cryptocurrency-exchange-poloniex-forces-change-passwords-data-leak-twitter/

They probably deleted the tweet to make it look like nothing happened, but plenty of wrong doing did take place, and that wasn't the first time at Poloniex.

They are literally backed by a huge wall street company, how are they letting something like this happen when they have trillions of dollars in their funds? Sure they are their own company as well but they are owned by Circle which is a multi billion dollar company and an app that is known all around the world and getting a big chunk of the market share as we speak and that company Circle? That is owned by Goldman Sachs (sort of, they own small part of it) which is the trillion dollar fund that I was talking about.

I understand hackers will hack things and even NASA has been hacked couple times now and people see it as a challenge at this point but honestly I would expect them to make their security better and at least save their customers information.

Stay informed! Circle almost killed Polonix because of their stupid management, and they've sold it. Poloniex is now owned by a secret owner hiding in the Seychelles.

[nydiacaskey01]

As soon as I read that article in Cointelegraph, I checked my Poloniex account and look at my email if I also received such an email. I didn’t get any. Does that mean my account was not among those that was leaked? I still updated my password just because quarterly I change my password and use random password generator by Avast. I dont use the same password on the exchanges that I use. Not anymore.

[hello_good_sir]

Not a great look for Poloniex at the start of the year at all.

They're already having reputation issues with their previous issues with support tickets and all that that earned them a bad name, and they're just trying to rebrand themselves after Circle. This happening will definitely set back their progress quite a bit, to say the least.

At the end of the day though, as a user, you need to protect yourself and to be safe, you shouldn't be keeping any significant sum of money on such exchanges anyhow.