Coinbase hack sees thousands of users' accounts drained
Coinbase admits thousands of users saw crypto funds stolen, but promises to reimburse
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Coinbasehas sent out breach notification letters to over 6000 users admitting they might have lost funds in a months-long campaign against the cryptocurrency exchange.
In the letter, the company said attackers took advantage of a flaw in Coinbase’ two-factor authentication (2FA) mechanism to carry out several assaults between March and May 20, 2021.
“As soon as Coinbase learned of this issue, we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process,” notes Coinbase in thenotification letter.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
Even as the exchange is investigating the incident, it has decided to reimburse all customers by depositing funds equal to the cryptos stolen from their accounts.
Complex campaign
Sharing more details, Coinbase said that attackers would have required certain information associated with the customers account, such as their phone numbers, and login credentials.
The issue has been brewing for some time now. Unconfirmed reports of hackersaccessing and drainingthecryptocurrency walletsof Coinbase customers first surfaced in August. Then in September, the company had to reassure its users that the email they received about the change in their 2FA settings weresent erroneously.
While the exchange has admitted that it is “not able to determine conclusively how these third parties gained access to this information,” if it were to guess it’d say the details were inadvertently leaked by the customers as part of an elaborative and affective phishing campaign.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“Even with the information described above, additional authentication is required in order to access your Coinbase account. However, in this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account,” explained Coinbase.
In addition to reimbursing the funds, Coinbase will provide freecredit monitoring serviceto customers, as it suggests users to use a different 2FA mechanism besides SMS-based one, and cycle the password of their Coinbase account, as well as of the associated email address.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Rising AI threats are making firms turn back to human intelligence
Thousands of employees could be falling victim to obvious phishing scams every month
Forget the 6,000mAh OnePlus 13 – we could see a OnePlus phone with a 7,000mAh battery
