How hackers can use your Email to take over your crypto exchange account

[freedomgo]

As traders, we usually focus on securing our crypto exchange accounts and making sure they will not be hacked, but sometimes the problem is not there, it's actually the email address we are using.

So I read this warning from Singapore Police where attackers first gain access to their victim's email account, and once inside they can easily search the inbox and find out what crypto exchanges you are using. And because they are smart, they can create email rules to hide security notifications, then request a password reset from the exchange and intercept the reset link or verification email without the user noticing it.

So here's the usual format of the attack:

Your old or reused password gets leaked.

[1] They gain access to your email
[2] They search which crypto exchanges you are using
[3] Hide security emails using inbox rules
[4] Reset your exchange password
[5] If successful, they gain access to the account

So even if the exchange has good security, if our email is not properly secured, there is only so much the exchange can do to protect us. For me, using a different password for your email and exchange is really a must, and if there is 2FA available we should activate it.

Based on the report, we should also check our email forwarding settings, inbox rules and active sessions from time to time because unusual changes there can be a sign that someone already gained access to our email. With this incident it tells us that securing the exchange account alone is not enough, because the email connected to it can also become the easiest way for an attacker to get inside.

[_act_]

and if there is 2FA available we should activate it.

Any exchange that does not have 2FA should be avoided. All exchanges that know the importance of 2FA make it available for their customers that are using their exchange. Even some exchanges make it mandatory to set before new customers will continue using the exchange.

2FA can also be set on email. A good email service provider will let you know when anyone want to compromise your email account, it will give you options in a way the person will not be able to.

Some email service providers also give options for 2FA which will be required if you want to login in from a new device.

[freedomgo]

and if there is 2FA available we should activate it.

Any exchange that does not have 2FA should be avoided. All exchanges that know the importance of 2FA make it available for their customers that are using their exchange. Even some exchanges make it mandatory to set before new customers will continue using the exchange.

2FA can also be set on email. A good email service provider will let you know when anyone want to compromise your email account, it will give you options in a way the person will not be able to.

Some email service providers also give options for 2FA which will be required if you want to login in from a new device.

They do provide it, but what if it's not compulsory and the user does not activate 2FA? Then their account can be compromised more easily. I still know some exchanges where 2FA is not required and transaction confirmation is only through email. The thing is, there are people who prefer convenience but don't really see the security risks. If they become a victim because of that, then unfortunately they will learn the hard way.

[BIT-BENDER]

This is where 2FA factor comes in to help and yes I am with @Act on this one and I believe every exchange should have 2FA for their clients because that extra security is highly needed and can't be compromised on.
Also an email that is in the shadows, hidden will not most likely be a target, what I mean is this , there are many reason we send out our email addresses to family, friends, for giveaways, to groups and so on. I believe in delegating our email addresses and any email used when creating an exchange should not be used for any other thing.

[_act_]

They do provide it, but what if it's not compulsory and the user does not activate 2FA? Then their account can be compromised more easily. I still know some exchanges where 2FA is not required and transaction confirmation is only through email.

Those exchanges should not be used. Exchanges that like their customers will make 2FA mandatory. Anyone that is using exchanges should also know the importance not 2FA.

The thing is, there are people who prefer convenience but don't really see the security risks. If they become a victim because of that, then unfortunately they will learn the hard way.

2FA is not about convenience or inconvenience. After the 2FA app has been downloaded, it can be used for other exchanges and for other things. If the person want to withdraw, just the 2FA can be requested for, no need for email authentication OTP.

[freedomgo]

They do provide it, but what if it's not compulsory and the user does not activate 2FA? Then their account can be compromised more easily. I still know some exchanges where 2FA is not required and transaction confirmation is only through email.

Those exchanges should not be used. Exchanges that like their customers will make 2FA mandatory. Anyone that is using exchanges should also know the importance not 2FA.

Some traders feel it's a hassle to activate 2FA on their account, but if regulators already require exchanges to make it mandatory before activating a client's account, then probably this will help solve the problem. But this is still fresh news, reported only this month, so most probably it's not yet mandatory for all exchanges.

2FA is not about convenience or inconvenience. After the 2FA app has been downloaded, it can be used for other exchanges also. If the person want to withdraw, just the 2FA can be requested for, no need for email authentication OTP.

Maybe they are not educated about this, but like i mentioned if it will become mandatory, they have no choice but to comply.

This is where 2FA factor comes in to help and yes I am with @Act on this one and I believe every exchange should have 2FA for their clients because that extra security is highly needed and can't be compromised on.
Also an email that is in the shadows, hidden will not most likely be a target, what I mean is this , there are many reason we send out our email addresses to family, friends, for giveaways, to groups and so on. I believe in delegating our email addresses and any email used when creating an exchange should not be used for any other thing.

In this case, we can also partly blame the users because it was their choice to use that exchange. Most probably, exchanges that don't make basic security like 2FA mandatory are not that reputable in the first place.

So it's also a bad choice on the user's side, and if they lose money because of that negligence, the exchange will most likely not take responsibility for it.

[Hyphen(-)]

So even if the exchange has good security, if our email is not properly secured, there is only so much the exchange can do to protect us. For me, using a different password for your email and exchange is really a must, and if there is 2FA available we should activate it.

Based on the report, we should also check our email forwarding settings, inbox rules and active sessions from time to time because unusual changes there can be a sign that someone already gained access to our email. With this incident it tells us that securing the exchange account alone is not enough, because the email connected to it can also become the easiest way for an attacker to get inside.

Strong 2FA will be the best action to take against all these email hacks because sometimes, as long as you are using exchanges, your emails might not be public in some cases, and scammers can use the emails to make attempt to sweep your exchange funds if you have, and once they attempt to reset password, they are in because the exchange doesn’t know if you are the one accessing the account or not, but if you have 2FA, you can avoid everything, and this is the reason why exchanges are trying as much as they can to make it mandatory for their users to have 2FA to avoid such cases if email hacks.

[Botnake]

Strong 2FA will be the best action to take against all these email hacks because sometimes, as long as you are using exchanges, your emails might not be public in some cases, and scammers can use the emails to make attempt to sweep your exchange funds if you have, and once they attempt to reset password, they are in because the exchange doesn’t know if you are the one accessing the account or not, but if you have 2FA, you can avoid everything, and this is the reason why exchanges are trying as much as they can to make it mandatory for their users to have 2FA to avoid such cases if email hacks.

Not only on the exchange that we have to enable 2FA, since in this case the email has been compromised, email providers also have their own 2FA.

For example, Gmail has 2-Step Verification, where you can add another layer of security aside from your password. Since Gmail is very popular, I think this is also something crypto users should activate, especially if that email is connected to an exchange.

[BlackBoss_]

Your old or reused password gets leaked.

[1] They gain access to your email
[2] They search which crypto exchanges you are using
[3] Hide security emails using inbox rules
[4] Reset your exchange password
[5] If successful, they gain access to the account

So even if the exchange has good security, if our email is not properly secured, there is only so much the exchange can do to protect us. For me, using a different password for your email and exchange is really a must, and if there is 2FA available we should activate it.

That's very true.

Exchanges have their own platforms and security to protect but they only can provide us a good platform to use while as users we will have to take care of our accounts, security and funds too.

Our account security relates to many factors like exchange account password, password of email used for exchange account registration, 2FA for the exchange account and the email. If we can not secure our email, with very weak password, no 2FA, it can be compromised then in turn will cause more risk to our exchange account.

But usually with people who have bad practice, they will have risk on multiple accounts at the same time, like a device is compromised, not only a single account. It's more risky if they have everything on that device from exchange account log in, email log in, and 2FA for both are on the same device.

[attiq310]

On top of that, make sure you've got withdrawal address whitelisting/delay set up on your exchange, though not all of them have this option, and this will mean that even if they reset your password, they won't be able to set up a new address to withdraw to and cash out right away. There will be a delay of 24-48hrs, depending on the exchange, for new addresses to become valid. That will give you a chance to secure your account.

Also, if you use 2fa on your account, I'd recommend something other than sms-2fa because they can be defeated with a sim swap attack. Use an authenticator app at least, but a security key is even better.

Same goes for securing your email, I'd recommend a security key/passkey for your email if possible because it is by far the best option. Make sure that the 2fa for your exchange cannot be reset using your email only. Otherwise, they'll be able to take over your account if they get into your inbox.

[stadus]

But usually with people who have bad practice, they will have risk on multiple accounts at the same time, like a device is compromised, not only a single account. It's more risky if they have everything on that device from exchange account log in, email log in, and 2FA for both are on the same device.

That is not the point here, it's the email that was compromised, not the device. So if the email has 2FA, or the exchange has 2FA and it's activated, it would be much harder for someone to compromise the account.

That's why it's necessary that we also educate ourselves, especially if we are trading a decent amount of money. Security should be the first priority before thinking about earning, because what if you already have a significant amount in the exchange and you lose it because of your own negligence, who would you blame?

[Tetu100]

They do provide it, but what if it's not compulsory and the user does not activate 2FA? Then their account can be compromised more easily. I still know some exchanges where 2FA is not required and transaction confirmation is only through email. The thing is, there are people who prefer convenience but don't really see the security risks. If they become a victim because of that, then unfortunately they will learn the hard way.

Mine is bybit, and I have made the activating of the 2FA so mandatory for my self because I know its important. Even on my email I don't joke with enabling my 2FA, I always make sure every necessary action is taken to avoid being a victim since one can not actually tell where they might attack.

Again, sometimes dudes just feel like all these isn't true till they've experienced it by themselves. Maybe I was once in that category of a doubting Thomas till a friend of mine finally learned some new things ( they cleared off his assets through this means) and that was when I started paying close attention to everything that concern my assets and till date I haven't experience any funny move. Sometimes experience is just the easiest language people understand faster, I have observed it.

[CryptopreneurBrainboss]

As traders, we usually focus on securing our crypto exchange accounts and making sure they will not be hacked, but sometimes the problem is not there, it's actually the email address we are using.

Your exchange should be protected with multiple security options that hackers getting access to your email won't expose you to getting scanned that easy. 2FA should be used to protecti your email and always stay alerted so you don't ignore any emails that's requesting you to verify if you're the one that initiated the actoim. You should also protect your own end by not using your exchange emails for other online activities that could get it into the wrong hands and as for the exchange getting hacked and emails being taken for them to be used as medium for scams, that's not under your control but protecting your exchange accounts with other security options available should give you some kind of advantage. Occasional changing your password could help too because if the scammer is in already, they can redirect messages to the spam folder and you won't be aware so it's better to prevent them getting in from the onset.

[Darker45]

Unfortunately, the number of attack points and attack vectors are increasing by the day. One false move could compromise one thing and creates a domino effect.

You take care of your crypto exchange account, but you also need to take care of the email you're using for that account. But then there's also the device. You should also take care of your device because if it's compromised, your email could also be compromised, which could mean your exchange account would also be compromised.

[nobswebdev]

For important accounts like banks, exchanges etc it is important to use 2fa. Email used to register for these services should also be 2fa secured. With such setup it is very hard to hack you.

[KiaKia]

The lesion to take away from here is avoid using same password keys on every platforms that you signed on, some people use one same password for everything and if one of those platforms if breached they can keep logging into any available platforms online.

This includes having access to the email account, and that's because the same email account was created using that same password too, this is a very stupid idea that people needs to stop.

Generate different passwords for everything, your email account password must be different and strong from everything else, and always .ake sure that you active 2FA on every platforms you signed up on.

[tech30338]

You should always activate all the security that is needed like confirmation of log-in in email, also two factor authentication, and also alert for log-ins, also make sure your email is secured by having a notification and also authenticator to be able to login.
Always make sure to change your password, if you have something  suspicious going on or a notification that someone has login attempt to your email, also never put seed phrase or keys in your email so that even if your account get compromise your are still safe.

[boyptc]

While the others are pointing out about the use of 2FA. The other practice is that you should not use the same passwords for all of your accounts.

The login details of your email should be different from your exchanges. Because you'll never know that even if there's no hacking incident, the person behind the database could have that ill intention of remembering the login details from the exchange account.

And so, it's important to have different login details, usernames and passwords for different exchanges we use.

[Dogedegen]

They do provide it, but what if it's not compulsory and the user does not activate 2FA? Then their account can be compromised more easily. I still know some exchanges where 2FA is not required and transaction confirmation is only through email. The thing is, there are people who prefer convenience but don't really see the security risks. If they become a victim because of that, then unfortunately they will learn the hard way.

We must put responsibility where it belongs. The user is responsible for securing his own asset, not the company! The company is only supposed to provide the tools that are needed for this, and then keep their own stuff safe. If you make 2FA mandatory or add other complications to the initial process then the users complain that it is annoying and takes too long. People are responsible for educating themselves, and for enabling all of these functions. I do not know any regulated exchange that does not have 2FA, some even have multiple factors and it is impossible to get hacked with the method that is written here if you have all that enabled but it depends on the exchanges. Some exchanges allow you to reset the 2FA too by submitting a request with the email and some kind of verification like photo, but if the attacker has your photos they could use AI to create a fake and submit it. If they use those inbox rules that you mentioned, they can do this silently and the user might not even notice anything until 2FA is reset too and the funds are gone. We live in times where it is hard to keep things fully secure.

[BitMaxz]

That is why I have a unique password for my email and never use it for other sites, plus 2FA, where they can send a code directly to my phone number. Until now my email is still alive without any successful login attempts from hackers.

Even on Facebook I heard many people hacked through email, but they didn't know after a few months before they realize that their email was hacked, not the exchange account.

Email is very important for security; if someone had access to it without you knowing, you would always think the exchange had a security issue. That is why 2FA is a must via sending a code to your mobile phone.