MATT DAMON HOW COULD YOU DO THIS TO ME
After Interstellar it is pretty clear that you shouldn't trust Matt Damon ;-)
Crypto.com accounts had unauthorized withdrawals
31–40 of 321 posts
Re: Crypto.com accounts had unauthorized withdrawals
#32> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect. We have mandatory 2FA policies on both the frontend and backend to protect users during this revocation phase, as outflows such as withdrawals have a requirement to setup and use 2FA in order to withdraw. How is this supposed to work? They revoked all of their 2FA for all accounts? Doesn't this just open the…
Is anyone else getting the feeling from this press release that it seems they actually don't (yet?) know how their previous 2FA system was circumvented by the attackers?
Re: Crypto.com accounts had unauthorized withdrawals
#33MATT DAMON HOW COULD YOU DO THIS TO ME
It's funny how many comments are about Matt Damon. That must be a pretty sticky ad campaign. It's also bizarre that I never heard of them before this marketing blitz although they seemingly have enough cash to hire Matt Damon and buy naming rights to an NFL stadium. I guess all their budget went to marketing instead of hardening their platform.
The ad campaign is notable because, much like most Perfume ads, it's downright bizarre. The ad sells a concept extremely well and then makes the leap of a lifetime for the subject that is a crazy let down.
Edit: the funny thing for me is that if the ad ended with the SpaceX (or Boeing, or Northrop, or USAF) logo and gave the SpaceX employment site at the end, I'm sure it would be seen as one of the best ads of the last few years. The leap is what kills it.
Re: Crypto.com accounts had unauthorized withdrawals
#34how do you think it was done. said 2fa was bypassed for some accounts. maybe some sort of client side exploit.
This, they don't say, maybe they don't even know, since:
> In an abundance of caution, we revamped and migrated to a completely new 2FA infrastructure.
> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect.
Re: Crypto.com accounts had unauthorized withdrawals
#35Why shouldn't I work for Crypto.com ? That’s a tough one but I'll take a shot. -- Will from Good Will Hunting
Re: Crypto.com accounts had unauthorized withdrawals
#36Earlier quoted context omitted.
> For context, this is the startup that has been using Matt Damon as it’s face. They're also notable lately for getting the naming rights to the (former) Staples Center. > https://en.wikipedia.org/wiki/Crypto.com_Arena
I wouldn't call it a startup, it paid 700mil$ to rename an arena!
Technically, they agreed to pay $700M over 20 years for arena naming rights -- no idea what the deal actually looks like but if you flat-line it, they're "only" paying $35M/year. Which is still a ton of money but much more reasonable in terms of cash out the door for a startup.
Re: Crypto.com accounts had unauthorized withdrawals
#37How did they check if a withdrawal was unauthorized (real) or not? What if I did a withdrawal, say it was unauthorized, and claim the money (and also have the crypto in a different wallet)?
I'm guessing any withdrawal that was done while using an exploit to bypass 2FA could be called unauthorized in this case
Re: Crypto.com accounts had unauthorized withdrawals
#38How did they check if a withdrawal was unauthorized (real) or not? What if I did a withdrawal, say it was unauthorized, and claim the money (and also have the crypto in a different wallet)?
I guess they know which accounts circumvented their previous 2FA implementation.
Re: Crypto.com accounts had unauthorized withdrawals
#39By the numbers, around $34 million in funds is affected, mostly Ethereum. They say in the press release that they prevented most of the unauthorized withdrawals and reimbursed the remainder, but it’s unclear how much they had to pay for reimbursements. For context, this is the startup that has been using Matt Damon as it’s face.
Presumably they mostly stole ETH because tornado cash is the best mixer around to launder stolen funds
I assume they stole just anything they got.
I'd assume any attacker would at least transfer everything to a BTC/whatever address generated offline, then figure out later how to launder it.
Re: Crypto.com accounts had unauthorized withdrawals
#40Reminder that cliches are cliche for a reason: not your keys, not your crypto
Its cliche, but it doesn’t really mean that crypto.com or any other crypto exchange isn’t on the hook for stolen funds.
Crypto doesn’t mean regulation doesn’t apply or that companies are free from liability.
Obviously you can’t squeeze blood from a stone if someone were to steal most of the funds from a crypto exchange (Mt. Gox comes to mind)
But in the real world, if you use a crypto exchange in a reasonable location (e.g. US exchange adhering to US laws) then small thefts like this are going to be reimbursed one way or another.
Now if the entire exchange and their cold wallets were stolen somehow, it would be game over.