Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto.com accounts had unauthorized withdrawals

crypto.com

Post reply on HN
Print view View original

11–20 of 321 posts

Re: Crypto.com accounts had unauthorized withdrawals

#11

Post by JohnJamesRambo »

ammonammonammon wrote: post #3
camjohnson26 wrote: post #2

By the numbers, around $34 million in funds is affected, mostly Ethereum. They say in the press release that they prevented most of the unauthorized withdrawals and reimbursed the remainder, but it’s unclear how much they had to pay for reimbursements. For context, this is the startup that has been using Matt Damon as it’s face.

Ad even earlier started out with MCO as their iconic token, then shifted to a new crypto while leaving early stakeholders in the dark. Those early maneuvers were something of a red flag.

Yep when I found out this was Monaco Coin guy rebranded, everything Crypto.com does started making a lot more sense.

https://www.cryptovantage.com/news/opinion-the-crypto-com-mc...

Re: Crypto.com accounts had unauthorized withdrawals

#12

Post by Shank »

> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect. We have mandatory 2FA policies on both the frontend and backend to protect users during this revocation phase, as outflows such as withdrawals have a requirement to setup and use 2FA in order to withdraw.

How is this supposed to work? They revoked all of their 2FA for all accounts? Doesn't this just open them up to credential stuffing attacks? This is a really, really odd response to me. I can understand migrating to a new 2FA system, but they'd have to re-establish the chain-of-trust somehow. Are they just hoping that users don't have compromised email/SMS accounts in order to enable the new 2FA system?

Re: Crypto.com accounts had unauthorized withdrawals

#14

Post by vgeek »

camjohnson26 wrote: post #2

By the numbers, around $34 million in funds is affected, mostly Ethereum. They say in the press release that they prevented most of the unauthorized withdrawals and reimbursed the remainder, but it’s unclear how much they had to pay for reimbursements. For context, this is the startup that has been using Matt Damon as it’s face.

So does that make Crypto.com the equivalent of Teddy "KGB" and the $34 million a lot more stacks of high society?

Re: Crypto.com accounts had unauthorized withdrawals

#16

Post by ceejayoz »

Shank wrote: post #12

> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect. We have mandatory 2FA policies on both the frontend and backend to protect users during this revocation phase, as outflows such as withdrawals have a requirement to setup and use 2FA in order to withdraw. How is this supposed to work? They revoked all of their 2FA for all accounts? Doesn't this just open the…

I'm wondering if it's a badly-worded way of saying "anyone in the system gets kicked out and has to re-2FA".

If they literally removed 2FA from everyone, that's insane.

Re: Crypto.com accounts had unauthorized withdrawals

#19

Post by myth_drannon »

paulgb wrote: post #10
camjohnson26 wrote: post #2

By the numbers, around $34 million in funds is affected, mostly Ethereum. They say in the press release that they prevented most of the unauthorized withdrawals and reimbursed the remainder, but it’s unclear how much they had to pay for reimbursements. For context, this is the startup that has been using Matt Damon as it’s face.

> For context, this is the startup that has been using Matt Damon as it’s face. They're also notable lately for getting the naming rights to the (former) Staples Center. > https://en.wikipedia.org/wiki/Crypto.com_Arena

I wouldn't call it a startup, it paid 700mil$ to rename an arena!
Post reply on HN