Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

cnbc.com

Post reply on HN
Print view View original

371–380 of 550 posts

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#371

Post by stonogo »

toomim wrote: post #362
suzzer99 wrote: post #233

Earlier quoted context omitted.

Florida teens kidnap Las Vegas man, drive him to Arizona desert, steal $4M in cryptocurrency https://www.yahoo.com/news/florida-teens-kidnap-las-vegas-20...

And this crypto CEO in Toronto was kidnapped for a $1M ransom: https://www.cbc.ca/news/canada/toronto/kidnapping-toronto-bu...

The parent post was someone literally hosting a crpyto conference, and this one was someone who runs a crypto company. A sibling story describes the father of a 'cryptocurrency influencer.' Is there any evidence of real crime happening which was targeted at Coinbase leak data, or is this just vibes

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#372

Post by bdangubic »

conductr wrote: post #201
VectorLock wrote: post #190

Earlier quoted context omitted.

I just switched to iPhone from a pixel device and I’m shook by all the spam calls. How do iPhone users deal with this?

It’s my biggest gripe. They can pretty accurately flag a number as Spam or Telemarketing but in the “Silence Unknown Callers” setting I can only silence every single unknown caller. I can’t silence every single number that’s not in my contacts. When the plumber calls to confirm he’s in route, my phone needs to ring. Stuff like that.

it is super fucking easy. it has been a decade since I answered an unknown number. if plumber calls (and I dont have her/his number stored) it goes to voicemail. I then call known company number. The communication is always one-way, I call you. I never answer. You follow this one very simple rule and you good :)

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#373

Post by AStonesThrow »

zbirkenbuel wrote: post #328
conductr wrote: post #201

Earlier quoted context omitted.

It’s my biggest gripe. They can pretty accurately flag a number as Spam or Telemarketing but in the “Silence Unknown Callers” setting I can only silence every single unknown caller. I can’t silence every single number that’s not in my contacts. When the plumber calls to confirm he’s in route, my phone needs to ring. Stuff like that.

I would have assumed an unknown caller was defined as any number not in your contacts. what is it instead?

In the realm of Caller ID, a phone number may be "PRIVATE" (or "WITHHELD") or "UNKNOWN". An "UNKNOWN" Caller ID cannot display any name nor any number, because... they are not known to the switch.

Therefore, an unknown number that can be blocked/ignored by your phone or the app is one that doesn't support Caller ID's name or number functions. It doesn't have anything to do with who's in your Contacts app, because of course those consist of known names and known numbers.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#374

Post by MrApathy »

suzzer99 wrote: post #233
panarky wrote: post #194

Earlier quoted context omitted.

If you had any significant assets on Coinbase at any time prior to this breach, spear phishing is the least of your worries. Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification. People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnappe…

Florida teens kidnap Las Vegas man, drive him to Arizona desert, steal $4M in cryptocurrency https://www.yahoo.com/news/florida-teens-kidnap-las-vegas-20...

"They Stole a Quarter-Billion in Crypto and Got Caught Within a Month. How luxury cars, $500,000 bar tabs and a mysterious kidnapping attempt helped investigators unravel the heist of a lifetime." https://www.nytimes.com/2025/04/24/magazine/crybercrime-cryp... (gift article)

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#375

Post by SoftTalker »

thepasswordis wrote: post #56

The problem is that it seems like the data that leaked is also the data that would be used to do account recovery. And what that means is that 1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore. 2) Hackers can try to “recover” accounts now using this leaked info. This is a huge problem. What coinbase needs a…

The the data that would be used to do account recovery is 99% either public record or already part of dozens of prior major data breaches.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#376

Post by devman0 »

zardo wrote: post #298
suzzer99 wrote: post #223

Earlier quoted context omitted.

The median person does not have $10k sitting in a checking account that they can easily withdraw. My gut feeling is that the threat of kidnapping is a lot more serious in some countries. The US maybe not so much.

> The median person does not have $10k sitting in a checking account that they can easily withdraw. That's true, finding someone with 10k is not as easy as picking a person at random, but it is as easy as driving to the right parking lot and picking a person at random.

Pulling $10k out of the global banking system by physical coercion in a way that isn't reversible and won't get you caught is hard problem, you might as well attempt to rob the bank instead. That's why most of the "successful" criminals in that space use social engineering and scamming where the victim is a unwitting participant rather than kidnapping someone.

With crypto, no bank or other middleman involved, it's like stealing physical cash/gold/diamonds from someone, if you know they have it in their possession, so violence can be a lot more successful at coercing a change of possession.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#377

Post by SoftTalker »

suzzer99 wrote: post #217
knowitnone wrote: post #189

Earlier quoted context omitted.

except banks staff can easily be bribed too. There is plenty of bank fraud happening.

If my bank money gets stolen from me via fraud (unless I literally just Zelle the scammer), I get it back. That's the big difference.

Zelle is ultimately a bank transfer. Yes they say to consider them like sending cash, but a bank transaction is at least tracable to a real account owner, who could then be pursued in the case of fraud, and it well might be reversible if push came to shove or if there is documented fraud.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#378

Post by ethbr1 »

andy_ppp wrote: post #343
panarky wrote: post #194

Earlier quoted context omitted.

If you had any significant assets on Coinbase at any time prior to this breach, spear phishing is the least of your worries. Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification. People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnappe…

Companies should seriously consider implementing GDPR even in the US, it certainly made taking data dumps of customer data a lot harder and certainly private images like Government IDs were encrypted on disk. I’m surprised at the lack of security if I’m honest, at Yahoo! almost nobody had access to prod user data. Essentially you cannot trust Coinbase IMO, might move the few hundred dollars of BTC out of there :-)

> I'm surprised at the lack of security if I’m honest

This is the crypto industry, who make the discrepancy between Theranos' claims and practice look conservative.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#379

Post by SoftTalker »

whyever wrote: post #50
blindriver wrote: post #33

There should be an ISO standard with respect to how much power and information that front line customer support agents have. The more information you need, like changing passwords or accessing personal information, should get forwarded to higher level customer support agents with better training and more monitoring. This way you can design customer support experience with as little exposure to security issues as poss…

They main defense against internal attacks is bookkeeping. Banks have been dealing with this for thousands of years. I recommend the corresponding chapter in Security Engineering by Ross Anderson: https://www.cl.cam.ac.uk/archive/rja14/Papers/SEv3-ch12.pdf

Bookkeeping will alert you to employees stealing your money. It won't alert you to employees selling information.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#380

Post by suzzer99 »

stonogo wrote: post #371
toomim wrote: post #362

Earlier quoted context omitted.

And this crypto CEO in Toronto was kidnapped for a $1M ransom: https://www.cbc.ca/news/canada/toronto/kidnapping-toronto-bu...

The parent post was someone literally hosting a crpyto conference, and this one was someone who runs a crypto company. A sibling story describes the father of a 'cryptocurrency influencer.' Is there any evidence of real crime happening which was targeted at Coinbase leak data, or is this just vibes

Well you start with the low-hanging fruit. Also I imagine these things take a while to plan.
Post reply on HN