Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto.com accounts had unauthorized withdrawals

crypto.com

Post reply on HN
Print view View original

211–220 of 321 posts

Re: Crypto.com accounts had unauthorized withdrawals

#211

Post by josephd79 »

kerng wrote: post #90
ceejayoz wrote: post #16

Earlier quoted context omitted.

I'm wondering if it's a badly-worded way of saying "anyone in the system gets kicked out and has to re-2FA". If they literally removed 2FA from everyone, that's insane.

crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. But basically in this case, you didn't even need a password to log back in, it was just an email to click a link, then FaceId/PIN and logged in and prompt to re-add 2fa. The app must store the password itself somehow and auto use it. Anyone know how the do auth on the app? For users in the US there is no way to…

Do they use something like this? I've never used crypto.com

https://magic.link/

Re: Crypto.com accounts had unauthorized withdrawals

#212

Post by rmbyrro »

nefitty wrote: post #77
cornedor wrote: post #66

Earlier quoted context omitted.

Wouldn't this also allow an attacker to add his own 2FA?

This is hilarious. This company is literally at the apex of the crypto industry and this is the kind of mistake they make. Yeah, immutable smart contracts written by their fellow proponents will also save the world lol

Isn't this equivalent to saying the entire health industry is fake and untrustworthy because of Theranos? I don't it looks kind of same to me, and sounds absurd.

Re: Crypto.com accounts had unauthorized withdrawals

#213

Post by giantrobot »

kerng wrote: post #90
ceejayoz wrote: post #16

Earlier quoted context omitted.

I'm wondering if it's a badly-worded way of saying "anyone in the system gets kicked out and has to re-2FA". If they literally removed 2FA from everyone, that's insane.

crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. But basically in this case, you didn't even need a password to log back in, it was just an email to click a link, then FaceId/PIN and logged in and prompt to re-add 2fa. The app must store the password itself somehow and auto use it. Anyone know how the do auth on the app? For users in the US there is no way to…

> it was just an email to click a link,

An e-mail with a link to actually click? Does anyone else see those flashing red lights and hear that alarm klaxon? Please do me a favor and drop those assholes like a bad habit. They are going to cost you whatever assets of yours they have in their control.

Re: Crypto.com accounts had unauthorized withdrawals

#214

Post by wpietri »

thebean11 wrote: post #198
wpietri wrote: post #164

Earlier quoted context omitted.

And I think that's exactly the point. Cryptocurrency promoters endlessly talk up how it's part of a decentralized wave of the future. But in practice it's quite centralized, and the incentives point in that direction for the future. That's one of the points made very well recently by Moxie Marlinspike: https://moxie.org/2022/01/07/web3-first-impressions.html

It’s not centralized though, crypto.com is one of many exchanges. Anybody can create an exchange, and a failure in one exchange doesn’t propagate to the rest of the network. Do you consider a website breaking a single point of failure for the internet?

The original vision of Bitcoin was "a peer-to-peer electronic cash system" "allowing any two willing parties to transact directly with each other without the need for a trusted third party". So yes, something like crypto.com represents significant centralization.

Re: Crypto.com accounts had unauthorized withdrawals

#215

Post by thebean11 »

wpietri wrote: post #214
thebean11 wrote: post #198

Earlier quoted context omitted.

It’s not centralized though, crypto.com is one of many exchanges. Anybody can create an exchange, and a failure in one exchange doesn’t propagate to the rest of the network. Do you consider a website breaking a single point of failure for the internet?

The original vision of Bitcoin was "a peer-to-peer electronic cash system" "allowing any two willing parties to transact directly with each other without the need for a trusted third party". So yes, something like crypto.com represents significant centralization.

Crypto.com and its customers are willing parties who can transact with each other using this system, I'm not sure what your point is. The problem here is that one party trusted another party to hold on to their funds, and the holding party lost the funds. How is that an indictment of the protocol itself?

Or put another way, how does Crypto.com and other centralized systems prevent me from using Bitcoin the "right" way?

Re: Crypto.com accounts had unauthorized withdrawals

#217

Post by SilasX »

wpietri wrote: post #161
JaggerFoo wrote: post #142

Earlier quoted context omitted.

tornado.cash is a legitimate service, that happens to be used by hackers that steal ethereum. Check out their code on github.

That's a pretty funny definition of "legitimate". By that standard, all of this malware is legitimate too! https://github.com/ytisf/theZoo

How is it different from “TOR/some VPN is a legitimate service that happens to be used by some hackers to cover their tracks”?

Re: Crypto.com accounts had unauthorized withdrawals

#218

Post by ncallaway »

GrumpyNl wrote: post #162
wpietri wrote: post #156

Earlier quoted context omitted.

> No customers experienced a loss of funds. I mean, there's still plenty of money in other people's accounts they can use to cover the losses. Does anybody know whether the regulatory regime they operate under is sound? If a US bank lost this kind of customer money in a theft, I'd have some confidence that the the FDIC and the Federal Reserve would make sure they actually had all the money they were claiming they had…

Please explain how they can use the money from other people account to cover the losses. If i had a account there, i wouldn't allow them to use my money to cover this.

> If i had a account there, i wouldn't allow them to use my money to cover this.

They're...not going to ask your permission?

If you have an account there, they have a large central pile of assets, and a database row saying that you are entitled to X amount of those assets. Someone else has a database row saying that they are entitled to Y amount of those assets.

If someone breaks into the other account, and makes an illicit transfer, then Y goes down and the central pile of assets goes down. If crypto.com makes the other account whole, they simply increase Y back to the original amount. But the central pile of assets hasn't gone up accordingly. They just used "your money" to cover this, and they don't ask you for permission.

When you go to them later and say: "I want to withdraw my X somewhere else", they might say: "I'm sorry, we don't have X right now". That's a run on the bank.

Fortunately, we have protections around specific institutions to prevent these kinds of situations. Capitalization requirements, FDIC, etc. Unfortunately, if you have an account with crypto.com, none of those protections exist for you. You're banking on them having the funds when you ask to withdraw them.

Re: Crypto.com accounts had unauthorized withdrawals

#219

Post by [deleted] »

kryogen1c wrote: post #176

Boy this whole thing just reeks. > No customers experienced a loss of funds. In the majority of cases we prevented the unauthorized withdrawal, and in all other cases customers were fully reimbursed. so which is it? no one lost funds or everyone that lost funds got paid back? where did that money come from? > transactions were being approved without the 2FA authentication control being inputted by the user. the withd…

[deleted]

Re: Crypto.com accounts had unauthorized withdrawals

#220

Post by SilasX »

somebodythere wrote: post #151
NelsonMinar wrote: post #119

Earlier quoted context omitted.

I'd love to read more about these money laundering operations like Tornado Cash. Are they just straight up 100% fraud companies? Do they have any pretense of a legitimate use case or does everyone just understand they're used for criminal activity? Are they regulated at all? I assume you have to trust your magic beans to them at some point; do the money launderers sometimes just steal them? What do they charge for th…

Tornado Cash is a smart contract system that allows you to send fixed denominations of Ethereum, and receive a cryptographic "note" that allows someone who knows the note to withdraw the same amount of Ethereum from the smart contract. Since zero-knowledge cryptography is used to ensure the generated note cannot be linked to the depositing transaction, it can be used to send money to yourself or another person withou…

Interesting! I’m surprised the regulated exchanges don’t blacklist coins connected to that smartcontract because of the ease of facilitating laundering.
Post reply on HN