Hackers drain cryptocurrency accounts of thousands of Coinbase users

[taylorfinley]

This was posted a few days ago with a much less sensational headline. Also important to note it was 6,000 users and Coinbase has made them all whole.

https://news.ycombinator.com/item?id=28719786

[q1w2]

I am unconvinced that Coinbase didn't have some sort of breach here. I don't believe they disclosed everything.

Multiple people I know with Coinbase accounts were solicited by the hackers - none of them have ever mentioned to anyone that they had a Coinbase account on any social media platform.

[2muchcoffeeman]

What does “made whole” mean here? They transferred the missing crypto to the users?

[Trias11]

Person I know tried to reach Coinbase support human to no avail.

He searched google for "coinbase support number" and dialed the number found.

Friendly operator guided him to solve a problem.

$50k lesson learned.

[qzw]

He should invoice Amazon for establishing the perverse norm where googling-for-support-contact is the only way to find such info.

[MerelyMortal]

For that amount, it seems like it would be worth trying to sue Google. It may be next to impossible now if they no longer display that phone number though.

[q1w2]

This problem isn't specific to Coinbase.

[vntok]

Did he solve the problem?

[mikeywazowski]

Odd that someone capable of obtaining 50k in crypto was able to be scammed in that fashion, particularly when the real phone number shows up in big bold font when googling "coinbase support number"..

To be fair, the search results may well have changed in between now and then but the support number isn't that hard to find on the coinbase site. Are you sure this person is being truthful, and not running their own scam?

[Dracophoenix]

Mt. Gox Part Deux. This is why I go by the adage "If you don't own the keys, you don't own the crypto".

[fastball]

This is almost nothing like Mt. Gox.

[Semaphor]

As much as I agree in general, if you own the keys and fuck up, then there would be no one to make you whole.

[dna_polymerase]

You either didn’t bother to read the article or you have no idea what happened to Mt. Gox. Either way, you are wrong.

[collectedparts]

Discussion last Friday (re: California notice): https://news.ycombinator.com/item?id=28719786

[q1w2]

That notice is toes the line between disclosing the absolute minimum and remaining compliant.

They never deny being hacked, but never admit it either. ...and they pretend that it was likely all the users' fault.

[Uptrenda]

If this is the same SS7 protocol flaw that security experts have been using to justifiably avoid SMS in 2-factor auth schemes forever now it's face palm inducing. Not that this sounds like a simple hack if they also compromised inboxes. Sounds like the victims were already very well owned at that point. Lesson learned I guess. I wonder how much it cost Coinbase.

[paunthony]

Even 2FA's aren't safe from the hackers and to think that it is coming from Coinbase.

[didntknowya]

at this point i'd just expect any exchange to be breached at some stage.

if you want to be be safe you should store your crypto in cold storage rather than online

[gvv]

Banks should be banned. Waste of human effort, advanced manufactured goods, and electricity.

[ramesh31]

If you're not running a full node on your own encrypted hardware, you shouldn't be doing anything but playing with crypto. It's almost as if the current financial system evolved over hundreds of years of hard lessons learned to have certain tradeoffs like reversible transactions that mitigate this threat for the general populace.

[GoblinSlayer]

You wouldn't need deposit insurance if transactions were reversible.