Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto.com accounts had unauthorized withdrawals

crypto.com

Post reply on HN
Print view View original

171–180 of 321 posts

Re: Crypto.com accounts had unauthorized withdrawals

#171

Post by Scoundreller »

mdoms wrote: post #100
Scoundreller wrote: post #84

Earlier quoted context omitted.

Doesn’t really matter if your 2FA keygen algo got completely compromised.

Of course it matters. Even if we assume someone figured out how to own the 2FA system, that knowledge doesn't magically make its way into the brain of every script kiddy capable of credential stuffing a login form. They're two totally different vectors with different surface area.

My thought is that it’s not really 2FA, and 2FA means temporary tokens, and there’s a method to gain entry with just login+token, e.g. via password reset.

Re: Crypto.com accounts had unauthorized withdrawals

#172

Post by wahnfrieden »

thow-58d4e8b wrote: post #68
myth_drannon wrote: post #19

Earlier quoted context omitted.

I wouldn't call it a startup, it paid 700mil$ to rename an arena!

Venture capital used to be about placing small, diverse bets on a lot promising startups - everybody in the process was trying to make the world a better place Since about 2018, VC game changed - now it's about brazenly placing massive bets on a small set of startups of increasingly questionable utility, using the funds and clout to ram their way through into monopoly positions. Not a speck of morality involved anymo…

we don’t know if CDC funding is VC

Re: Crypto.com accounts had unauthorized withdrawals

#173

Post by wahnfrieden »

marcusjt wrote: post #86
ashtonkem wrote: post #52

Earlier quoted context omitted.

They took out huge ads in Vegas for re:invent. Personally that set my alarm bells off pretty badly.

Yeah, seeing huge marketing spend by an organisation that's not a massive brand with deep pockets always makes me wonder where the money is coming from

they are already making a huge amount from spread etc.

Re: Crypto.com accounts had unauthorized withdrawals

#174

Post by gilrain »

JaggerFoo wrote: post #142
NelsonMinar wrote: post #119

Earlier quoted context omitted.

I'd love to read more about these money laundering operations like Tornado Cash. Are they just straight up 100% fraud companies? Do they have any pretense of a legitimate use case or does everyone just understand they're used for criminal activity? Are they regulated at all? I assume you have to trust your magic beans to them at some point; do the money launderers sometimes just steal them? What do they charge for th…

tornado.cash is a legitimate service, that happens to be used by hackers that steal ethereum. Check out their code on github.

I wonder what percentage of their total volume it is that “happens” to be used by hackers.

Re: Crypto.com accounts had unauthorized withdrawals

#175

Post by Scoundreller »

GrumpyNl wrote: post #162
wpietri wrote: post #156

Earlier quoted context omitted.

> No customers experienced a loss of funds. I mean, there's still plenty of money in other people's accounts they can use to cover the losses. Does anybody know whether the regulatory regime they operate under is sound? If a US bank lost this kind of customer money in a theft, I'd have some confidence that the the FDIC and the Federal Reserve would make sure they actually had all the money they were claiming they had…

Please explain how they can use the money from other people account to cover the losses. If i had a account there, i wouldn't allow them to use my money to cover this.

Banks pay out losses from the profits generated by other account holders all the time. Just gotta hope their losses never exceed their profits.

Re: Crypto.com accounts had unauthorized withdrawals

#176

Post by kryogen1c »

Boy this whole thing just reeks.

> No customers experienced a loss of funds. In the majority of cases we prevented the unauthorized withdrawal, and in all other cases customers were fully reimbursed.

so which is it? no one lost funds or everyone that lost funds got paid back? where did that money come from?

> transactions were being approved without the 2FA authentication control being inputted by the user.

the withdrawal system allows for non-2fa when its enabled, but informs the risk system when it happens? what kind of feature is that?

> While Crypto.com already performs internal and external penetration tests, Crypto.com has immediately engaged with third-party security firms to perform additional security checks

ah yes. the "we already had 7 double checkers, better add an 8th" solution. sounds like maybe the problem is not with the testing and auditing suite.

> releasing additional end-user security features as we move away from 2-Factor Authentication and to true Multi-Factor Authentication (MFA)

2fa isnt true MFA? did we evolve some new jargon im not aware of?

> WAPP is designed to protect user funds in cases where a third party gains unauthorized access to their account and withdraws funds without the user’s permission. WAPP restores funds

wait i thought they said they already did this? are they gonna start charging for it now because they lost money?

> To qualify for the WAPP program, users must: Set up an anti-phishing code at least 21 days prior to the reported unauthorized transaction

wtf is that? a PSK? a TOTP?

> File a police report and provide a copy of it to Crypto.com; and

hello, local police department? i need to file a report - my cryptocurrency wallet just had an unauthorized funds withdrawal. no, i dont have a suspect, or evidence, or any action for you to take. just come down here and write down that i said this happened please.

Re: Crypto.com accounts had unauthorized withdrawals

#177

Post by ashtonkem »

Applejinx wrote: post #95
lolinder wrote: post #69

Earlier quoted context omitted.

Somehow I doubt a fraudulent company on the verge of an exit scam would spend $700 million to rename an arena right before pulling the plug. Incompetent? Probably. Fraudulent? Unlikely. https://www.latimes.com/business/story/2021-11-16/crypto-sta...

No, that's normal pyramid scam behavior. I would say it was more likely that they were fraudulent if they were escalating their meaningless promo gestures to keep anybody from cracking as their scam gets too big to keep together. The bigger the risk, the bigger the colorful gesture. I'm imagining it as '$700 million IN CRYPTO, which is of course better than money'. For a name: which could easily be restored if it tur…

Even your basic Ponzi schemes often involved generous and public philanthropic gifts even as the scheme was falling apart behind the scenes, just to maintain the public image.

Re: Crypto.com accounts had unauthorized withdrawals

#178

Post by 5560675260 »

croon wrote: post #103
PragmaticPulp wrote: post #40

Earlier quoted context omitted.

Its cliche, but it doesn’t really mean that crypto.com or any other crypto exchange isn’t on the hook for stolen funds. Crypto doesn’t mean regulation doesn’t apply or that companies are free from liability. Obviously you can’t squeeze blood from a stone if someone were to steal most of the funds from a crypto exchange (Mt. Gox comes to mind) But in the real world, if you use a crypto exchange in a reasonable locatio…

So in the real world when using a regulated crypto exchange, what's the point of a blockchain other than asset speculation (which can also be done through traditional trading instruments at this point)?

It similar to what SWIFT is to banking system.

Re: Crypto.com accounts had unauthorized withdrawals

#179

Post by wpietri »

GrumpyNl wrote: post #162
wpietri wrote: post #156

Earlier quoted context omitted.

> No customers experienced a loss of funds. I mean, there's still plenty of money in other people's accounts they can use to cover the losses. Does anybody know whether the regulatory regime they operate under is sound? If a US bank lost this kind of customer money in a theft, I'd have some confidence that the the FDIC and the Federal Reserve would make sure they actually had all the money they were claiming they had…

Please explain how they can use the money from other people account to cover the losses. If i had a account there, i wouldn't allow them to use my money to cover this.

That's touchingly innocent.

As an example, take Bernie Madoff. He took in people's cash and then sent them regular statements about how much money they had. But they were just statements doctored to look good. When some people withdrew money, he just gave them money that was handy. At some point, the difference between the numbers on the statements and the actual assets was over $50 billion. More details here: https://en.wikipedia.org/wiki/Madoff_investment_scandal

None of the Madoff investors "allowed" it. I don't know anything about Crypto.com, but the same thing is surely happening with other "crypto" companies. It doesn't even have to be malice; often a failure starts out with some event like a sudden loss to theft. Insiders believe they can make the money back, so they just keep on operating and hope nobody notices.

This opportunity for divergence between reported and actual funds is one of the big reasons US banks are highly regulated. The FDIC is on the hook for large sums in the event of failures, so they're quite vigorous in making making sure that doesn't happen too often.

Post reply on HN