Live data from Hacker News

So, my Coinbase account was hacked, bitcoin stolen, now what?

news.ycombinator.com

41–50 of 61 posts

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#41
post #20

Did you have a mac / windows computer? Do you have any antivirus software installed?

It most likely had nothing to do with his computer. I could buy a new computer, use it only to consummate a transaction on Coinbase, and destroy it, and I've done little to minimize my risk.

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#42
A hacker can simply break into your account, steal your bitcoin by sending it off to his own account, and no one has to hold any type of accountability? Is there no way to trace, cancel, or reverse a transaction?

It would seem that you understand Bitcoin very well.

A review of all of the hacks/breakins/inside jobs since 2011 would have told you this already. You DID research its history, rather than jumping in blind, right?

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#43
post #36
post #9

This is a reason why I never leave my BTC in Coinbase. As soon as my purchase goes through, I transfer the BTC to a paper wallet[1] or digital wallet that I control. [1] https://en.bitcoin.it/wiki/Paper_wallet

Well, in my view CoinBase with two factor auth is as or more secure than leaving it on my physical computer. If this person had enabled two factor auth this wouldn't have happened. I was under the impression that 2 factor auth on CoinBase wasn't optional, but I guess not. CoinBase should also be failbanning any computer trying to brute force the same account with more than one password.

Because you can withdraw your coins from Coinbase, that means Coinbase has a copy of the private key associated with the BTC address that your BTC resides in. Two factor auth is not going to prevent a rogue attacker or employee from taking these keys.

By immediately transferring the BTC to a paper wallet address generated on a secure, offline computer, it is simply impossible to withdraw the BTC without possession of the information on that physical piece of paper. This is far more secure than any digital or two factor auth.

Edit: I notice that Coinbase does store the vast majority of their BTC in paper wallets[1]. The problem is, Coinbase still has a copy of the private keys associated with your BTC address. While this may hinder the efforts of outside attackers, there still exists a vulnerability with those employees who have access to the systems that move BTC from cold to warm storage. That's why your BTC should always reside in an address you generated yourself and solely possess the private key to.

[1] http://blog.coinbase.com/post/33197656699/coinbase-now-stori...

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#44
Authy founder here (we do Two-Factor Auth for Coinbase).

Looks like you didn't have Two-Factor enabled https://news.ycombinator.com/item?id=6947037). Enable it now. We've stopped lots of Coinbase account password compromises. Most of the time we see that the e-mail was hacked.

Do the following:

1. Enable Two-Factor Authentication on your e-mail.

2. If you use GMail, go to Settings -> Forwarding POP/Imap. Check that no "weird" addresses are added to your account.

3. Change your E-mail password.

4. Change your Coinbase password.

If you have Two-Factor enabled we can also temporarily block your account if you suspect a hacker is trying to get into it. Contact us at support@authy.com and we'll block it.

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#45

Authy founder here (we do Two-Factor Auth for Coinbase). Looks like you didn't have Two-Factor enabled https://news.ycombinator.com/item?id=6947037 ). Enable it now. We've stopped lots of Coinbase account password compromises. Most of the time we see that the e-mail was hacked. Do the following: 1. Enable Two-Factor Authentication on your e-mail. 2. If you use GMail, go to Settings -> Forwarding POP/Imap. Check that…

I highly recommend the above advice. 2-factor auth is a simple step that hugely increases security. You must have it on your email at minimum - since having access to your email typically gives you access to many accounts connected to your email - and probably most of your financial accounts.

I might also encourage Coinbase to limit the maximum dollar value of transfer from an account to, say, $100 per day until someone enables two-factor auth. Typically people have very poor security habits, and strongly encouraging them to improve them will help both users and Coinbase's reputation.

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#46
post #23

Hilarious. The reason for bitcoin is lack of regulation. You know that right? You're using bitcoins and not dollars because it's not regulated and subject to the same oversights and related fees. So basically you want the government to have no ability to lock down funds or regulate transfers, yet you also want the ability for the government to step in and stop people who have stolen your bitcoins. Can people really b…

You can still have an open and secure currency that's protected by the law. It would follow a minarchist philosophy that protects two parties from breach of contract.

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#48
post #27
post #23

Hilarious. The reason for bitcoin is lack of regulation. You know that right? You're using bitcoins and not dollars because it's not regulated and subject to the same oversights and related fees. So basically you want the government to have no ability to lock down funds or regulate transfers, yet you also want the ability for the government to step in and stop people who have stolen your bitcoins. Can people really b…

What do you mean "random websites"? It's Coinbase, the most reputable bitcoin wallet that exists. (Though they have had a few troubles as of late.)

Yes, please get back to us when you have verifiable proof of their security. This is Bitcoin we're talking about. It doesn't matter how "reputable" they appear to be.

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#49
post #4

> A hacker can simply break into your account, steal your bitcoin by sending it off to his own account, and no one has to hold any type of accountability? I thought lack of regulation was one of the features of Bitcoin.

Why are you comparing Coinbase features with Bitcoin features?

Well, for example: My understanding is that if you bank with dollars (in the US), the FDIC insures your deposit up to a certain amount. A feature of the currency is also a feature of the bank holding that currency. It's hard to pull the two completely apart.

Re: So, my Coinbase account was hacked, bitcoin stolen, now what?

#50

If you turned on your API key Coinbase and someone obtains that key, they can transfer coin on your behalf. From a productive paranoia perspective, I think this is a REALLY BAD IDEA for exactly the reasons posted here. People will use that key to 'try out' coinbase, and then end up forgetting to check their code and upload it to Github or Pastebin and then WHAM, you've got two problems: your Bitcoin is gone and Coinb…

I disagree. They shouldn't turn off the API access for payments because some people might use it incorrectly. Let's be honest, it takes a special kind of stupid to upload secret keys of any kind to their repos. And if they do, well, they deserve whatever happens to them.
Post reply on HN