6000 coinbase clients hacked

[Poker Player]

I wonder why there are so many cases of hacks in cryptocurrencies compared to banks. Coinbase moves considerable amounts of money to be able to spend significant amounts on security. If it was what DaveF says about SMS, it seems silly but Coinbase should not have hacks for stupid things like this.

I guess hackers put more effort into trying to hack cryptocurrencies because if they manage to steal them they can transfer them unhindered by anyone and making you lose track of them very quickly.

[1714243455]

1714243455

[1714243455]

1714243455

[1714243455]

1714243455

[dupee419]

Some points before people starts panicking:

The hack took place between March and May 20 of this year

The hackers needed to know the email addresses, passwords and phone numbers linked to the affected Coinbase accounts, and have access to personal emails

Although obviously Coinbase said that there's no evidence that the users' data comes from them, it looks too much like it. Either somebody from inside has sold users' data to a malicious 3rd party, either Coinbase user database was hacked and they didn't notice. Of course, from there to actually accessing users' e-mails there's still some work to do.

The warning, however, is the same as always: don't keep at centralized exchanges too much money and for too long. Not your keys, not your coins.

I heavily use Coinbase, since their user interface and features are actually great, although I still have worries of having my account getting hacked, I'm actually glad that my Coinbase account did not get breached. It could either be a breach under Coinbase's DB and since they were able to breach through their 2FA feature, anyway, I think I'll consider switching wallets or at least not let my holdings stay here for a long period of time.

[rikybrosh]

I think coinbase need more smarter people, if counbase is under government supervision then coin base should take responsibility. This is a very bad news, image of cryptocurrency can be negative among other people. I hope those hackers stop do criminal act. I think their skill can be used for many positive things rather than do crime. But I still like to use cryptocurrency, I think it is safer to save money, if we bring a lot of money in the street without good security then we might be get robbed.

[o_e_l_e_o]

Either somebody from inside has sold users' data to a malicious 3rd party

We already know Coinbase sell user data to third parties, but I think this is unlikely. Selling a name and associated bitcoin addresses is one thing; selling passwords is another.

So, if I got access to your gmail account (picking on them I am sure there are others that have linked email and phone numbers) and you had your SMS access /recovery phone number set to the google voice number that was linked to that account. Well, it's all over for you.

This of course makes it incredibly easy, but even just access to your email account is enough even if your SMS is linked to your phone. If I get in to your email account - somewhere in your inbox or your outbox I'll probably be able to find your phone number, your address, your date of birth. Maybe you've got some electronic bank statements, rental agreements, car finance, etc., where I can get even more info about you, like your SSN. That's probably enough info for me to convince your carrier that I am you and transfer your phone number to my device and start receiving all your SMS messages.

I agree 100% on this. But where would the hacker get from 6k email addresses and their passwords too?

Database hacks and leaks from other companies. https://haveibeenpwned.com/Passwords has 600 million accounts and passwords in their database. Too many people use the same password across multiple (or even all!) accounts.

[NeuroticFish]

We already know Coinbase sell user data to third parties, but I think this is unlikely. Selling a name and associated bitcoin addresses is one thing; selling passwords is another.

No. Coinbase itself won't sell passwords. But there's a chance an employee (or ex employee) could have done that.

Database hacks and leaks from other companies. https://haveibeenpwned.com/Passwords has 600 million accounts and passwords in their database. Too many people use the same password across multiple (or even all!) accounts.

Wow, I didn't know the number became that big.
However, if it would have gone on this path, I'd expect some of other exchanges' customers have the same problem - at least those with no 2FA set.
Of course, we can only speculate on where the hacker got from the e-mail passwords. Some still keep an awfully lot of useless mails and sensitive data in their mailboxes, but scanning so many mailboxes to find out whether they're Coinbase customers or not may not be a small job (of course, it can be automated for some of the servers).

[Fortify]

Another example why using central exchanges is risky. The hackers knew private data of the users. One corrupt employee or one successful hack and bad guys capture your email, home address, phone number and sell it to local criminals who might knock on your door then best encrypted wallets are useless. Cryptocurrencies are designed for peer to peer usage. If you change it into peer to bank to peer then this adds some risks.

https://www.reuters.com/business/finance/coinbase-says-hackers-stole-cryptocurrency-least-6000-customers-2021-10-01/

Keeping your money on an exchange certainly does make you an easier target, but some people simply do not have the ability to store their cryptocurrency safely in any other way. They might not have access to safe storage along with a personal PC, but want to purchase and hold it. In theory an exchange can be much safer than a private PC which could be vulnerable to viruses or even hardware failure - this sort of redundancy will be built into the biggest exchanges who can have vast security teams covering many different aspects. While it is devastating for the 6,000 affected individuals, the fact that it is not a complete loss of millions of accounts and is fairly concentrated to the low thousands is somewhat commendable.

[o_e_l_e_o]

However, if it would have gone on this path, I'd expect some of other exchanges' customers have the same problem - at least those with no 2FA set.

They do, just not all at the same time like this, since this attack involved both a leak of data and a security exploit in Coinbase's SMS systems. Exchange accounts get hacked all the time, especially if they are using no 2FA or weak 2FA like SMS.

Some still keep an awfully lot of useless mails and sensitive data in their mailboxes, but scanning so many mailboxes to find out whether they're Coinbase customers or not may not be a small job (of course, it can be automated for some of the servers).

It would be pretty trivial to write a bot which would log in to every Gmail account (for example) you had credentials for and then run some quick searches for "Coinbase", "Binance", "Bitfinex", etc. Also, the email and password leaks could have come from a crypto related service. If some faucet, ICO, bounty, etc., leaks or sells a database of 10,000 users, then you can be certain that the vast majority of them will have an exchange account, and knowing the kind of users who sign up for bounties and airdrops, probably a far higher than average percentage of them reuse the same password across all their accounts.

[Artemis3]

Well you know the saying... Not your keys, not your money.

"Where to invest safely"? Easy, buy bitcoin, send them to your cold wallet, done.

A "cold" wallet is just a piece of paper with a bunch of words written by your own hands. If you are surprised of this, you need to learn more.

Anything online is at risk. A cold wallet is offline, you can only send money to it, nothing else. Until the day you need to spend some of it, then you temporarily (and securely) restore it to move a small sum out of it to a normal "hot" wallet.

When they said you are now your own bank they weren't kidding. Give your money to others, and you risk getting it stolen.

[passwordnow]

It is strange that this news has spread so far.

Not that strange, these media are showing past incidents for a sure agenda and that's to give fear to the people that are new to this.

We still need to improve security on these exchange sites that are necessary for users.

They are the ones that have to improve security and I think that they're doing that but it's just that they have to continually do that. Because these hackers are also improving and finding every possible loophole from their systems.

Well, the good thing here is Coinbase refunded the lost amounts to its affected customers. Now, those customers who knew that their respective credentials are compromised should change their passwords or secure those info related to this hack. This also proves once again, that storing funds in exchange is not a very smart idea to do. Even top exchanges with high security as they say, can be penetrated by these hackers. Hacking softwares are getting sophisticated and so they need to upgrade their security level also.

Never been a good idea to store your funds into an exchange whether it would be Binance, Coinbase or any another known exchange. These people who kept on doing probably have learnt it when they're affected on it. Not just all about the funds but as well as the information that they've sent to it. Every hack that happens it only shows that they have vulnerability, Coinbase is rich and they'll upgrade for sure and increase their security to avoid this to happen again.

[aoluain]

Its really important to realise that exchanges are for exchanging FIAT/Crypto, not for
long term storage of either.

Dont use gmail and change up your passwords regularly, dont have google conveniently
remember your passwords for you, these should be a very minimum. The trouble here seems
to be the SMS verification functionality.

The trouble with KYC and AML is obviously we trust exchanges with our personal
information.

Very informative thread and info from DaveF, NeuroticFish and o_e_l_e_o

[Slow death]

No matter how safe they tell you their exchange is, do not store your assets there! At least not for long. No matter how protected they claim to be, as long as there are much users on that exchange, they will forever be a target; hackers will keep on trying what they can. Meanwhile, you're not placing a bet with your money if they can hack it or not. So, for your mind to be at peace and for optimum safety of your money, use a decentralized wallet to store your crypto assets.

how will people do day trade if they don't leave the asset on the exchange? doing withdrawals every day has a high cost because you imagine that the person withdraw the coin and at the same time the price is falling, indicating a good chance of buying? It is the exchange's responsibility to have good security and pay customers when the exchange is stolen. this is a risk that everyone who day trades will have to take

[ene1980]

~
how will people do day trade if they don't leave the asset on the exchange? doing withdrawals every day has a high cost because you imagine that the person withdraw the coin and at the same time the price is falling, indicating a good chance of buying? It is the exchange's responsibility to have good security and pay customers when the exchange is stolen. this is a risk that everyone who day trades will have to take

It is the responsibility of the exchange to take care of the clients assets and if some of the exchanges prove that they are not capable then as investors and traders you need to move out to other exchanges rather than sticking to them thinking that they would change. Coinbase is a huge company and they are worth billions of dollars if they cannot take care of security then what is the point in trusting them in the long run.

[iTradeChips]

Some points before people starts panicking:

The hack took place between March and May 20 of this year

The hackers needed to know the email addresses, passwords and phone numbers linked to the affected Coinbase accounts, and have access to personal emails

Although obviously Coinbase said that there's no evidence that the users' data comes from them, it looks too much like it. Either somebody from inside has sold users' data to a malicious 3rd party, either Coinbase user database was hacked and they didn't notice. Of course, from there to actually accessing users' e-mails there's still some work to do.

The warning, however, is the same as always: don't keep at centralized exchanges too much money and for too long. Not your keys, not your coins.

It is really sad that people still tend to put their money in centralized exchanges. If it is that big then at least try to put it on your own wallet and then just try put out what you need in case you want to cash out. Do not put your money to exchanges even if they say their security is so tight. You will never know what might happen in the future. You will never know if the exchange you trust suddenly decides to run away with your money.

[pooya87]

Another example why using central exchanges is risky.

To be fair using centralized exchanges is inevitable for anyone who wants to either buy bitcoin or trade it and the risk is known to these people. What we warn people about is storing their coins with a third party including but not limited to centralized exchanges.
Until we get better and more popular decentralized exchanges we will continue seeing news like this.

[gabbie2010]

Another example why using central exchanges is risky. The hackers knew private data of the users. One corrupt employee or one successful hack and bad guys capture your email, home address, phone number and sell it to local criminals who might knock on your door then best encrypted wallets are useless. Cryptocurrencies are designed for peer to peer usage. If you change it into peer to bank to peer then this adds some risks.

https://www.reuters.com/business/finance/coinbase-says-hackers-stole-cryptocurrency-least-6000-customers-2021-10-01/

I absolutely agreed that an insider is directly or indirectly involved in what lead to the hacked wallets of coinbase users, it has become glaring that centralized exchanges can never be reliable and trusted in storing coins, past hacking events related to CEX has proven that reliability of those type of exchanges is very risky, because some of their scrupulous employee who can never to trusted will surely compromised, I think experienced crypto enthusiast knows the implications of hodling their coins in CEX exchanges it's up to every newbie to research on ways of securing their coins too.

[Kittygalore]

This is scary, I have some considerable amount of my tokens in Binance and I am definitely risking those coins from being atolen because I don't have any hardware wallet and the hardware wallets that store those tokens are so expensive and a lot of the tampered ones are spreading online, being sold to unknowing newbies.

[breathlessz]

This is scary, I have some considerable amount of my tokens in Binance and I am definitely risking those coins from being atolen because I don't have any hardware wallet and the hardware wallets that store those tokens are so expensive and a lot of the tampered ones are spreading online, being sold to unknowing newbies.

therefore we can divide it into several baskets, so that at least it can minimize the risk. Hacking is nothing new, but we must be careful ourselves to secure the assets we have. many of them ignore this little thing, and in the end it is very risky

[Amejoaquim]

Thats why i don't want to store my assets into exchange even tough most people call coinbase is the best exchange in the world it still very risky to store our aseets into it. I personally store my asset on MEW, i think MEW is the best platform for us to store our asset.

[wajik-tempe]

Another example why using central exchanges is risky. The hackers knew private data of the users. One corrupt employee or one successful hack and bad guys capture your email, home address, phone number and sell it to local criminals who might knock on your door then best encrypted wallets are useless. Cryptocurrencies are designed for peer to peer usage. If you change it into peer to bank to peer then this adds some risks.

https://www.reuters.com/business/finance/coinbase-says-hackers-stole-cryptocurrency-least-6000-customers-2021-10-01/

The lesson that we could learn from this big exchanges is no guarantee to be safe. People still have mind that popular and big exchange is safe because they have the best security but the reality is, the good hackers are targeting big exchanges instead of mediocore level exchanges.
As an investors we should just sent a few of our balance to trade on exchange wallet if we want to trade and never save balances too much on an exchange because that could be targeted by the hackers

[o_e_l_e_o]

how will people do day trade if they don't leave the asset on the exchange?

If you want to day trade, then that is the risk you have to take. You would hope that most people day trading any significant amount of money are sensible enough not to try to secure their account with something as insecure as SMS, though. The fact that Coinbase even still offers SMS is very poor on their part.

I don't have any hardware wallet and the hardware wallets that store those tokens are so expensive

A Ledger Nano S or a Trezor One both cost around $50 bucks. If you ask in their respective subreddits for a referral code, you can usually get 20% off that. If you wait for Black Friday coming up in at the end of November, then based on previous years you might be able to get up to 50% off. This really isn't a lot of money to spend for financial security, especially if, as you say, you have a "considerable" amount of money on Binance. If it is more than you can afford to lose, then get a hardware wallet.