Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

cnbc.com

Post reply on HN
Print view View original

171–180 of 550 posts

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#171

Post by Ozarkian »

rtkwe wrote: post #93
ArtTimeInvestor wrote: post #86

From the Coinbase website: https://www.coinbase.com/en-de/blog/protecting-our-customers... What they got - Name, address, phone, and email - Masked Social Security (last 4 digits only) - Masked bank‑account numbers and some bank account identifiers - Government‑ID images (e.g., driver’s license, passport) - Account data (balance snapshots and transaction history) Wow. Why does customer support staff have access to im…

I also like 'last 4 digits only' as if that's not the most important parts and the part so many places use to validate your identity, the first 5 are just area and group so they're not exactly random.

Everyone's social security number is available. If you go download the leak referring to in this HN post [1], your SSN is certainly in it. Mine was, everyone in my family's was, almost all of my friends' were.

The world needs to stop pretending that SSNs are secret. They aren't.

[1] https://news.ycombinator.com/item?id=41248104

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#172

Post by justapassenger »

molticrystal wrote: post #121

And the reason Coinbase has to keep all that sensitive stuff, much more than what would be required to identify and authenticate you, which you hope will never be stolen, is because of know your customer laws, so you can thank your government that pictures of your passport got stolen and for whatever criminals and rogue Coinbase employees do with that info.

[dead]

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#174

Post by chaosbolt »

dowager_dan99 wrote: post #87
piva00 wrote: post #59

Earlier quoted context omitted.

> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this) That's just a bank.

Beyond the regulatory-dodge and crypto marketing explain to me how Coinbase is NOT a bank

lol they even do fractional reserve things like banks, except they're more shady and don't acknowledge it, now I'm either connecting dots that shouldn't be connected or some withdrawal locks that happened through some big arbitrage opportunities were very suspicious.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#175

Post by TheAmazingRace »

voidspark wrote: post #158
lovich wrote: post #148

Earlier quoted context omitted.

Watching crypto enthusiasts run into every problem that society already tackled with in the past when developing currency and its controls, and then coming up with solutions that look exactly the same as what dirty fiat currency uses, has been a source of much entertainment the past few years

This is an exchange problem, not a crypto problem. You don’t need an exchange to hold crypto.

But they need exchanges to get real money to flow in and out of cryptocurrency easily. Without it, cryptocurrency by itself would likely be worth far less than it is today.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#176

Post by modeless »

sgarman wrote: post #150

I tried to reach out to coinbase customer support to see if I was impacted. Once I wasted my time with the AI bot and got a human they were unaware of the breach. I was the first person to inform them about it.

They emailed impacted accounts. Source: I was impacted

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#177

Post by voidspark »

TheAmazingRace wrote: post #175
voidspark wrote: post #158

Earlier quoted context omitted.

This is an exchange problem, not a crypto problem. You don’t need an exchange to hold crypto.

But they need exchanges to get real money to flow in and out of cryptocurrency easily. Without it, cryptocurrency by itself would likely be worth far less than it is today.

Yes that's true, but no need to hold your crypto there as a permanent storage. Once your fiat is exchanged to crypto, immediately transfer the crypto to your private wallet.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#178

Post by scotty79 »

gkoberger wrote: post #149
skybrian wrote: post #131

Blog post is here: https://www.coinbase.com/blog/protecting-our-customers-stand... > We will reimburse customers who were tricked into sending funds to the attacker due to social engineering attacks. If your data was accessed, you have already received an email from no-reply@info.coinbase.com; all notifications went out at 7:20 a.m. ET on 5/15 to affected customers.

The no-reply is an interesting decision. I get how difficult it is to run a company like Coinbase (their biggest strength, centralized + customer support, is also what enables this social engineering), but feels like an odd choice.

no-reply is a good practice. No business should ever encourage their customers to reply to the emails they are sending out. That's what scammers do.

To contact the company you should go to company website at the address you know (which shouldn't be given in email as well), log in and send a message through internal message system, possibly referring to the email that you recieved through a random code (those can be auto-suggested if they recently tried to contact you by email).

If you do anything else your communication knwowingly mimics communication of a scammer.

Unrequested email should always only be one way communication. Email is too untrustworthy for it to be anything more.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#179

Post by modeless »

I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening feature takes good care of the rest. Wish I could forward them to Kitboga[1].

I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves.

[1] https://www.youtube.com/watch?v=HNziOoXDBeg

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#180

Post by kelvinjps10 »

ArtTimeInvestor wrote: post #86

From the Coinbase website: https://www.coinbase.com/en-de/blog/protecting-our-customers... What they got - Name, address, phone, and email - Masked Social Security (last 4 digits only) - Masked bank‑account numbers and some bank account identifiers - Government‑ID images (e.g., driver’s license, passport) - Account data (balance snapshots and transaction history) Wow. Why does customer support staff have access to im…

Usually it's to assist people that upload the information incorrectly
Post reply on HN