Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto.com accounts had unauthorized withdrawals

crypto.com

Post reply on HN
Print view View original

191–200 of 321 posts

Re: Crypto.com accounts had unauthorized withdrawals

#191

Post by wepple »

paulpauper wrote: post #9

how do you think it was done. said 2fa was bypassed for some accounts. maybe some sort of client side exploit.

In practice, there’s often so much complexity that finding a path isn’t all that hard. Some examples:

- abuse the logic flow and simply don’t submit the 2FA step

- submit an empty 2FA token (I’ve seen it work)

- get a signed transaction from a legitimate transfer and replay it in a compromised account

- find the admin API that their help desk uses that doesn’t require 2FA

- brute force 2FA code. If you get 3x attempts at a 6-digit pin you have a 1/333,333 chance. Multiply by a few thousand accounts you can find reused creds for

- Find an API to abuse to disable 2FA (maybe via CSRF?)

- move the money into an account that doesn’t require 2FA (some kind of whitelisted arbitrage account maybe?) then cash out from there

- keep transfers under a 2FA threshold but then either script up the transfer to repeat or change the transfer amount after the threshold check has occurred

I could riff on for ages. Some more plausible than others. Some I’ve definitely seen (and used in legal testing)

Re: Crypto.com accounts had unauthorized withdrawals

#192

Post by barkingcat »

smt88 wrote: post #163
capableweb wrote: post #143

Earlier quoted context omitted.

Calling crypto.com anything near "apex of the cryptocurrency industry" is a very broad lie. Crypto.com is for people who just "wanna invest in crypto and get rich", others who are actually involved in the space (developers, companies and others) are nowhere near crypto.com as they have proven time and time again they are not serious about anything, even the basics like security.

Aren't they one of the largest exchanges? EDIT: They're #3 (bigger than Coinbase). Only OKX and Binance are bigger[1]. 1. https://www.coingecko.com/en/exchanges

No!

Coinbase is a large exchange...

Re: Crypto.com accounts had unauthorized withdrawals

#193

Post by mbesto »

wahnfrieden wrote: post #172
thow-58d4e8b wrote: post #68

Earlier quoted context omitted.

Venture capital used to be about placing small, diverse bets on a lot promising startups - everybody in the process was trying to make the world a better place Since about 2018, VC game changed - now it's about brazenly placing massive bets on a small set of startups of increasingly questionable utility, using the funds and clout to ram their way through into monopoly positions. Not a speck of morality involved anymo…

we don’t know if CDC funding is VC

It's irrelevant what the funding comes from or how you define it. VC, PE and Hedge funds all have fairly loose definitions. But, someone is funding it because it sure ain't coming from profits.

Re: Crypto.com accounts had unauthorized withdrawals

#194

Post by cuteboy19 »

wpietri wrote: post #161
JaggerFoo wrote: post #142

Earlier quoted context omitted.

tornado.cash is a legitimate service, that happens to be used by hackers that steal ethereum. Check out their code on github.

That's a pretty funny definition of "legitimate". By that standard, all of this malware is legitimate too! https://github.com/ytisf/theZoo

I'm sure someone can come up with some legitimate use for those. We came up with 'Linux isos' for torrents after all

Re: Crypto.com accounts had unauthorized withdrawals

#195

Post by thebean11 »

barkingcat wrote: post #192
smt88 wrote: post #163

Earlier quoted context omitted.

Aren't they one of the largest exchanges? EDIT: They're #3 (bigger than Coinbase). Only OKX and Binance are bigger[1]. 1. https://www.coingecko.com/en/exchanges

No! Coinbase is a large exchange...

I don’t think that’s true..bigger than Binance? By what metric?

Re: Crypto.com accounts had unauthorized withdrawals

#196

Post by cuteboy19 »

the_snooze wrote: post #64
agloeregrets wrote: post #33

Earlier quoted context omitted.

The ad campaign is notable because, much like most Perfume ads, it's downright bizarre. The ad sells a concept extremely well and then makes the leap of a lifetime for the subject that is a crazy let down. Edit: the funny thing for me is that if the ad ended with the SpaceX (or Boeing, or Northrop, or USAF) logo and gave the SpaceX employment site at the end, I'm sure it would be seen as one of the best ads of the la…

To be fair, a more honest ad wouldn't be as compelling: "Exchange your real money for online scrip because reasons!"

Exchange your real money for IOUs of online scrips

Remember, not your keys, not your coins!

Re: Crypto.com accounts had unauthorized withdrawals

#197

Post by ashtonkem »

secondaryacct wrote: post #168
GrumpyNl wrote: post #162

Earlier quoted context omitted.

Please explain how they can use the money from other people account to cover the losses. If i had a account there, i wouldn't allow them to use my money to cover this.

Easy: imagine one of the poor sobs decides to withdraw, hop a bit of creative accounting and your money is borrowed to pay for the withdrawal. It s not each of the user individually seeing their balance go down, it s the company lying even more about its ability to liquidate all accounts. Your number on their html page they graciously present to you will go unchanged. It s not a new phenomenon, every bank does it, ex…

Also, banks are insured by the government (FDIC) and heavily regulated to reduce the risk of failure. Crypto exchanges are not, which is why they seem to fail about as often as a 19th century bank would.

Re: Crypto.com accounts had unauthorized withdrawals

#198

Post by thebean11 »

wpietri wrote: post #164
thebean11 wrote: post #58

Earlier quoted context omitted.

How is this a single point of failure? The issue was limited to a subset of users keeping funds in a Crypto.com wallet. Unless by "it" you mean crypto.com and not Ethereum. Crypto.com is not decentralized.

And I think that's exactly the point. Cryptocurrency promoters endlessly talk up how it's part of a decentralized wave of the future. But in practice it's quite centralized, and the incentives point in that direction for the future. That's one of the points made very well recently by Moxie Marlinspike: https://moxie.org/2022/01/07/web3-first-impressions.html

It’s not centralized though, crypto.com is one of many exchanges. Anybody can create an exchange, and a failure in one exchange doesn’t propagate to the rest of the network.

Do you consider a website breaking a single point of failure for the internet?

Re: Crypto.com accounts had unauthorized withdrawals

#199

Post by TameAntelope »

wpietri wrote: post #164
thebean11 wrote: post #58

Earlier quoted context omitted.

How is this a single point of failure? The issue was limited to a subset of users keeping funds in a Crypto.com wallet. Unless by "it" you mean crypto.com and not Ethereum. Crypto.com is not decentralized.

And I think that's exactly the point. Cryptocurrency promoters endlessly talk up how it's part of a decentralized wave of the future. But in practice it's quite centralized, and the incentives point in that direction for the future. That's one of the points made very well recently by Moxie Marlinspike: https://moxie.org/2022/01/07/web3-first-impressions.html

But crypto is decentralized? This Crypto.com security issue is wholly unrelated to how blockchain technology works...

Re: Crypto.com accounts had unauthorized withdrawals

#200

Post by thebean11 »

danuker wrote: post #148
smokey_circles wrote: post #116

Earlier quoted context omitted.

It is the implementation. I believe in bitcoin, works well and I don't blame the consumer for the producer's problems when it comes to power. But exchanges have become a key part of the implementation. That's not the real issue though. The issue is the _need_ for exchanges. They provide a host of services, mostly all of which are antithetical to the loftier ideals espoused by bitcoin. Too many crypto fans waltz passe…

> and I'm pretty confident being a locally popular trading commodity amongst edge communities is not the central goal for bitcoin Given the transaction fees needed for a distributed-enough network, and the bureaucracy needed when trading, it is not very useful as a currency, at least not for small payments, excluding Lightning. So it's a commodity.

Excluding lightning and layer 2 solutions like rollups. Why would you make those exclusions though?
Post reply on HN