Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto.com accounts had unauthorized withdrawals

crypto.com

Post reply on HN
Print view View original

21–30 of 321 posts

Re: Crypto.com accounts had unauthorized withdrawals

#21

Post by PinguTS »

Shank wrote: post #12

> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect. We have mandatory 2FA policies on both the frontend and backend to protect users during this revocation phase, as outflows such as withdrawals have a requirement to setup and use 2FA in order to withdraw. How is this supposed to work? They revoked all of their 2FA for all accounts? Doesn't this just open the…

That was exactly my question when I read this. How do they establish trust, when 2FA is revoked? How they prevent that the bad guy enables now 2FA and the god guy is locked out of his account?

May the god guy didn't get the message that Crypto.com had an issue, because s/he is unavailable.

Re: Crypto.com accounts had unauthorized withdrawals

#22

Post by gkoberger »

muttantt wrote: post #6

Exchanged are the weakest link in crypto. If anything can kill crypto, it will be due to the exchangers, from hacking to over regulation, etc.

Maybe, but I think you can make a case for the opposite too. Without exchanges, there'd be no crypto. Exchanges are the only reason 99% of people who have crypto can figure out how.

Re: Crypto.com accounts had unauthorized withdrawals

#24

Post by [deleted] »

camjohnson26 wrote: post #2

By the numbers, around $34 million in funds is affected, mostly Ethereum. They say in the press release that they prevented most of the unauthorized withdrawals and reimbursed the remainder, but it’s unclear how much they had to pay for reimbursements. For context, this is the startup that has been using Matt Damon as it’s face.

[deleted]

Re: Crypto.com accounts had unauthorized withdrawals

#25

Post by tootie »

VHRanger wrote: post #4

MATT DAMON HOW COULD YOU DO THIS TO ME

It's funny how many comments are about Matt Damon. That must be a pretty sticky ad campaign. It's also bizarre that I never heard of them before this marketing blitz although they seemingly have enough cash to hire Matt Damon and buy naming rights to an NFL stadium. I guess all their budget went to marketing instead of hardening their platform.

Re: Crypto.com accounts had unauthorized withdrawals

#26

Post by idop »

ceejayoz wrote: post #16
Shank wrote: post #12

> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect. We have mandatory 2FA policies on both the frontend and backend to protect users during this revocation phase, as outflows such as withdrawals have a requirement to setup and use 2FA in order to withdraw. How is this supposed to work? They revoked all of their 2FA for all accounts? Doesn't this just open the…

I'm wondering if it's a badly-worded way of saying "anyone in the system gets kicked out and has to re-2FA". If they literally removed 2FA from everyone, that's insane.

Pretty sure that's what they meant. They said "tokens."

Re: Crypto.com accounts had unauthorized withdrawals

#29

Post by Miner49er »

paulpauper wrote: post #9

how do you think it was done. said 2fa was bypassed for some accounts. maybe some sort of client side exploit.

Seems really unlikely, but maybe someone guessed or discovered the keys? Would likely only happen if Crypto.com somehow was generating them insecurely or if someone had inside access to their systems or something. Maybe a leak?

Since it is across multiple currencies, I think it is unlikely it has to do with generation. Maybe could still be a leak or something.

Post reply on HN