Coinmarketcap hacked

[OmegaStarScream]

https://cointelegraph.com/news/coinmarketcap-hack-reportedly-leaks-3-1-million-user-email-addresses

Just a heads-up for anyone with an account there. Apparently, only the email addresses were leaked, so your account and diamonds are safe but you should still be cautious, you might start getting some phishing attacks sent to your email.

[bL4nkcode]

Didn't know you can create an account there. What the accounts are for on their platform? (Never visited their site for quite time)

[OmegaStarScream]

Didn't know you can create an account there. What the accounts are for on their platform? (Never visited their site for quite time)

You can use accounts to make a crypto watchlist and keep track of your portfolio, but people were mainly using them to claim diamonds and buy rewards (NFTs, vouchers, etc.). It's basically the same concept that Coingecko introduced some time ago with candies.

[hugeblack]

I created an account using a temporary email, but I assume that their database is large and it will cause a lot of losses because beginners trust the emails that are sent to them.

CoinMarketCap has become aware that batches of data have shown up online purporting to be a list of user accounts. While the data lists we have seen are only email addresses (no passwords),

Source  --> https://haveibeenpwned.com/PwnedWebsites#CoinMarketCap

The weirdest part is this quote, which means they don't know what exactly happened, and just because the password hasn't been hacked doesn't mean that customer data is safe.
I also didn't notice any new security update they made.

[Findingnemo]

The weirdest part is this quote, which means they don't know what exactly happened, and just because the password hasn't been hacked doesn't mean that customer data is safe.
I also didn't notice any new security update they made.

I never wanted to create an account with them because they are offering service for free so we can't expect our emails to be safe there. Anyway users should be careful now with the phishing attacks it may not happen immediately but since the data like email exposed we can expect the scammers use this to promote scams or steal crypto funds.

[The Cryptovator]

Thanks for the heads-up, a wasn't really aware of this. I can't recall if I have created an account there but I have clearly remembered that I had not bought anything from there. So I think I am safe from losing something except email. I am not sure why but for a few days I have been receiving a few spam mail including a few files to download, the title is something like free bitcoin, and so on. I am pretty sure they are all phishing attempts or included malware, so I just delete the mail without checking anything since I am not familiar with the mail address. I think everyone should be careful from such as mail.

[examplens]

Thanks for the heads-up, a wasn't really aware of this. I can't recall if I have created an account there but I have clearly remembered that I had not bought anything from there. So I think I am safe from losing something except email. I am not sure why but for a few days I have been receiving a few spam mail including a few files to download, the title is something like free bitcoin, and so on. I am pretty sure they are all phishing attempts or included malware, so I just delete the mail without checking anything since I am not familiar with the mail address. I think everyone should be careful from such as mail.

so well I got a lot of some weird emails at once. as if I had suddenly subscribed to a newsletter from a bunch of porn sites and investment opportunities. one of my alternate email addresses, but the last couple of days I get over 100 spam emails daily.

maybe this is not to worry about, as far as I can see no one used them seriously, nor did they have any great value there. but if we know that CMC is owned by Binance, it seems much more serious if their developers have failed to make a good enough protection.

[LeGaulois]

That's what happens when you spend too much time bragging on Twitter and don't spend money on security for your infrastructures.
I'm kidding but it's somewhat true for many companies (crypto or not).

Many companies neglect investments in security, even when they operate in sensitive business areas (like finance for example).
Guess why many (too many) crypto platforms have been hacked over the years? Then guess why those that invest literally millions of dollars have never had any problems?If you don't take proactive measures, you will have problems sooner or later

I don't know when this incident happened, but the fact that they didn't even make an announcement, or even send an email to their user base, says a lot about how they consider the members using their service

[shield132]

The weirdest part is this quote, which means they don't know what exactly happened, and just because the password hasn't been hacked doesn't mean that customer data is safe.
I also didn't notice any new security update they made.

I never wanted to create an account with them because they are offering service for free so we can't expect our emails to be safe there. Anyway users should be careful now with the phishing attacks it may not happen immediately but since the data like email exposed we can expect the scammers use this to promote scams or steal crypto funds.

You can check different temprorary email websites, some of them aren't blacklisted. Also, you can create brand new acount on Gmail without much additional (and correct) information and use it for cases where you don't want to use your primary email. I guess people rarely use only single email, right? Idk...

That's what happens when you spend too much time bragging on Twitter and don't spend money on security for your infrastructures.
I'm kidding but it's somewhat true for many companies (crypto or not).

Many companies neglect investments in security, even when they operate in sensitive business areas (like finance for example).
Guess why many (too many) crypto platforms have been hacked over the years? Then guess why those that invest literally millions of dollars have never had any problems?If you don't take proactive measures, you will have problems sooner or later

I don't know when this incident happened, but the fact that they didn't even make an announcement, or even send an email to their user base, says a lot about how they consider the members using their service

Coinmarketcap is owned by Binance, right? I think it may have some temporary effect on their reputation but people will forget it very soon. Btw coinmarketcap isn't a financial service provider and seems they didn't care much about that but it's funny when you pay enormous amount of money to acquire CMC but do nothing to improve the security.
Like you said, that truly shows how they treat the users but again, people forget things easily. It didn't have any influence on BNB coin btw.

[sunsilk]

My friend sent me a picture of email that ihavebeenpwned emailed him that his account in CMC got pawned by hackers and he don't know what to do. I don't have any account made on CMC but didn't know that there's sort of diamonds there.

I just told him to change his passwords rightaway after receiving that image of notification to me.

[Quickseller]

I created an account using a temporary email, but I assume that their database is large and it will cause a lot of losses because beginners trust the emails that are sent to them.

CoinMarketCap has become aware that batches of data have shown up online purporting to be a list of user accounts. While the data lists we have seen are only email addresses (no passwords),

Source  --> https://haveibeenpwned.com/PwnedWebsites#CoinMarketCap

The weirdest part is this quote, which means they don't know what exactly happened, and just because the password hasn't been hacked doesn't mean that customer data is safe.
I also didn't notice any new security update they made.

If all that is for sale are email addresses and not passwords (hashes), it is probably safe to assume that passwords were not compromised. Although you should use a unique and distinct password for every account you have.

It is possible that the attacker used some type of vulnerability that will leak information about if a specific email address is associated with an existing account. The attacker could then attempt to use whatever method leaks this information by trying a list of known email addresses known to be associated with bitcoin users against this method.

[ABCbits]

Since CMC is owned by Binance, this reflect how poor Binance manage security of their service (especially if it's not their main service).

Apparently, only the email addresses were leaked, so your account and diamonds are safe but you should still be cautious, you might start getting some phishing attacks sent to your email.

Not if you're also victim of different data leak which leak the password and use same/very-similar password on different website.

[OmegaStarScream]

Here we go...



I received this email a couple of hours ago. Maybe someone here with a CMC account could confirm that they have received the same thing?

[Husires]

Can someone tell me why emails are not encrypted or kept more securely, or what makes it more difficult to hack a password than an email?
this hack is not important because many will not be affected by the hack, beginners often do not notice the registration button and most of those who create accounts intend to track their favorite currencies and it will not be easy to deceive them with phishing links.

Binance' reputation will not be affected and they will not do anything unless there is serious competition from other sites.

[Darker45]

Binance' reputation will not be affected and they will not do anything unless there is serious competition from other sites.

I'm not sure about this. There have been signs that Binance is not giving their best, or perhaps spending enough, in terms of security. Binance itself was hacked and tens of millions in Bitcoin were taken. More than a year later, Binance figured in another controversy when its customer's KYC data were leaked. Personal information of about 60,000 Binance users was compromised. And now, Binance-owned coinmarketcap is also hacked.

Binance's reputation, at least in terms of security, will never be the same again. And they should certainly do something about it. This is not about competition against other sites offering similar services. This is about their security.

[mk4]

CZ is denying the allegations, stating that it's only FUD.

No comment on this because I fortunately don't have a CMC account lol.



https://twitter.com/cz_binance/status/1451855293059584000

[SFR10]

I don't know when this incident happened, but the fact that they didn't even make an announcement, or even send an email to their user base, says a lot about how they consider the members using their service

They first confirmed ^{[not sure where exactly]} it on October 12 and according to mk4's post, it took them 11 days to make that announcement while posting around 100 articles ^{[can't tell the exact number due to how they display the dates after a week]} on that period ^[SMH]!

it will not be easy to deceive them with phishing links.

But it's not impossible either.

[aioc]

Didn't know you can create an account there. What the accounts are for on their platform? (Never visited their site for quite time)

I didn't know it either, I just use it to check the price of the coins and the condition of the market, they offer alerts on airdrops but I'm not into airdrops anymore, glad that I did not create an account here, I'm using Coingecko more than Coinmarketcap, but when I'm using price comparison that's the time I use Coinmarketcap.

[sheenshane]

Didn't know you can create an account there. What the accounts are for on their platform? (Never visited their site for quite time)

I didn't know it either, I just use it to check the price of the coins and the condition of the market, they offer alerts on airdrops but I'm not into airdrops anymore, glad that I did not create an account here, I'm using Coingecko more than Coinmarketcap, but when I'm using price comparison that's the time I use Coinmarketcap.

Yesterday I have read different threads regarding Coinsmarketcap that has been compromised and AFAIK, I had registered there before using my email account associated with this forum account, so I worried and check my email account but there's no sign of hack there, there's no email or any message that contain malicious links.  So I doubt CZ claimed was right, it was just a FUD because I don't even receive emails in my inbox.

Either it's true or not, if our email accounts have been collected by them(hackers) and sooner or later they will send malicious links, we should avoid clicking messages on inbox that has links.  IMO, I don't usually open my email account, my mistake was I used this upon registering the Coinmarketcap platform.

It's also happened on the Binance exchange before right?  When all accounts have been compromised including emails, correct me if I'm wrong.

[bL4nkcode]

so I worried and check my email account but there's no sign of hack there, there's no email or any message that contain malicious links. 

Sometimes it takes times before email lists got sold or spammers got a copy of it. And sometimes its not about malicious link being sent, it includes some marketing emails which you didn't subscribes. Well, I hope it's the case, coz spam emails are annoying.

It's also happened on the Binance exchange before right?  When all accounts have been compromised including emails, correct me if I'm wrong.

AFAIR, it didn't happened yet, it will be a disaster if it will happen considering there are millions users of binance.