Crypto.com accounts had unauthorized withdrawals • Hacker News Board

Re: Crypto.com accounts had unauthorized withdrawals

#51

Post by Kye » Thu, Jan 20, 2022, 3:33 PM UTC

gkoberger wrote: post #22

muttantt wrote: post #6

Exchanged are the weakest link in crypto. If anything can kill crypto, it will be due to the exchangers, from hacking to over regulation, etc.

Maybe, but I think you can make a case for the opposite too. Without exchanges, there'd be no crypto. Exchanges are the only reason 99% of people who have crypto can figure out how.

Especially with mobile devices taking over. An increasing number of people don't even have a laptop or desktop to hold a whole blockchain on. Even an iPhone 13 Pro with 1TB of storage would lose 10-20% of its space to that. That isn't going to improve. The more popular it gets, the faster it grows, and it would compete with all the other storage needs that also grow.

Get someone to load up and maintain a whole blockchain on their 1TB phone, and you lose them the moment they need more room for photos or offline synced music and files.

Re: Crypto.com accounts had unauthorized withdrawals

#52

Post by ashtonkem » Thu, Jan 20, 2022, 3:33 PM UTC

paulgb wrote: post #10

camjohnson26 wrote: post #2

By the numbers, around $34 million in funds is affected, mostly Ethereum. They say in the press release that they prevented most of the unauthorized withdrawals and reimbursed the remainder, but it’s unclear how much they had to pay for reimbursements. For context, this is the startup that has been using Matt Damon as it’s face.

> For context, this is the startup that has been using Matt Damon as it’s face. They're also notable lately for getting the naming rights to the (former) Staples Center. > https://en.wikipedia.org/wiki/Crypto.com_Arena

They took out huge ads in Vegas for re:invent. Personally that set my alarm bells off pretty badly.

Re: Crypto.com accounts had unauthorized withdrawals

#53

Post by foobiekr » Thu, Jan 20, 2022, 3:33 PM UTC

arkitaip wrote: post #30

gercott wrote: post #18

This is why CRO requires 24 hours whitelist before you can transact withdrawals...

Understandable yet totally absurd. Can you imagine if your bank had the same requirement?

I would actually love such a feature, especially in a brokerage context.

Re: Crypto.com accounts had unauthorized withdrawals

#54

Post by mritchie712 » Thu, Jan 20, 2022, 3:34 PM UTC

n_time wrote: post #28

Thank goodness it's decentralized and there are no single points of failure.

I'm guessing this is sarcasm? crypto.com is very very far from a single point of failure.

Re: Crypto.com accounts had unauthorized withdrawals

#55

Post by mcescalante » Thu, Jan 20, 2022, 3:35 PM UTC

arkitaip wrote: post #30

gercott wrote: post #18

This is why CRO requires 24 hours whitelist before you can transact withdrawals...

Understandable yet totally absurd. Can you imagine if your bank had the same requirement?

At least one US investment banks I've used require a waiting period before transacting with a newly added account/routing number for wires/ACH. I've even got calls from customer service manually confirming transfers/withdrawals if it's a new account or one that's been unused for a long period of time.

That said, there is no waiting period on me withdrawing from my checking account.

Re: Crypto.com accounts had unauthorized withdrawals

#56

Post by JaggerFoo » Thu, Jan 20, 2022, 3:36 PM UTC

So their backend allowed withdrawal transactions without 2FA control. Not a good sign for a system that should thrive on secure transactions.

Ethereum seems to be the token most prized during a breach, most likely to be used on tornado.cash.

Cheers

Re: Crypto.com accounts had unauthorized withdrawals

#57

Post by criddell » Thu, Jan 20, 2022, 3:36 PM UTC

GiorgioG wrote: post #5

I guess fortune doesn't always favor the brave.

That depends on whether or not you consider stealing cryptocurrency to be brave.

Re: Crypto.com accounts had unauthorized withdrawals

#58

Post by thebean11 » Thu, Jan 20, 2022, 3:36 PM UTC

n_time wrote: post #28

Thank goodness it's decentralized and there are no single points of failure.

How is this a single point of failure? The issue was limited to a subset of users keeping funds in a Crypto.com wallet.

Unless by "it" you mean crypto.com and not Ethereum. Crypto.com is not decentralized.

Re: Crypto.com accounts had unauthorized withdrawals

#59

Post by criddell » Thu, Jan 20, 2022, 3:37 PM UTC

arkitaip wrote: post #30

gercott wrote: post #18

This is why CRO requires 24 hours whitelist before you can transact withdrawals...

Understandable yet totally absurd. Can you imagine if your bank had the same requirement?

Maybe it shouldn't be mandatory, but it might be a nice (default) option to have.

Re: Crypto.com accounts had unauthorized withdrawals

#60

Post by mritchie712 » Thu, Jan 20, 2022, 3:37 PM UTC

gitfan86 wrote: post #46

I am a cyber security consultant for startups. The first thing that I communicate is that just by not being in crypto you have drastically lowered your risk profile. Attackers care a lot about what they can get to if they are able to breach your security.

How many startups do you talk to that are "on the fence" with somehow using crypto in their product? Seems pretty core to what the company would be doing.