Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

cnbc.com

Post reply on HN
Print view View original

461–470 of 550 posts

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#461

Post by AStonesThrow »

VectorLock wrote: post #386
bdangubic wrote: post #372

Earlier quoted context omitted.

it is super fucking easy. it has been a decade since I answered an unknown number. if plumber calls (and I dont have her/his number stored) it goes to voicemail. I then call known company number. The communication is always one-way, I call you. I never answer. You follow this one very simple rule and you good :)

Theres plenty of situations where this doesn't work. If you're called from a business central line and you don't know their extension you just call back and get the normal call tree which can take you forever to get through. Or if you're on the "cancellation list" for an appointment if they can't get through to you, they don't wait for you to call back, they just go on to the next person to schedule in their open slo…

Taxi cab dispatchers will do this for sure. They do callbacks to “confirm” your ride, especially when busy, because if you don’t answer, they simply drop your request on the sticky office floor.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#462

Post by mafriese »

smeej wrote: post #458
mafriese wrote: post #420

Earlier quoted context omitted.

You can easily establish the connection from a bank account to a person. A connection from a crypto wallet to a person is extremely difficult. Money laundering with crypto is also much easier (and cheaper usually).

In the vast majority of cases, it's actually extremely easy. It took less than an afternoon for me to learn how to trace 90%+ of transactions on either BTC or any of the networks built on Ethereum or an Ethereum-like protocol. There are large companies that specialize in exactly this, which make tools that allow government agents who have no particular crypto expertise to trace the majority of transactions. It is pos…

I never doubted that it's possible but it's way harder than identifying bank accounts. There is a massive business behind crypto tracking, that's why companies like MasterCard have acquired CipherTrace. Some years ago there was a really good article / case study from them. I think it was related to a ransomware gang and they were able to identify the threat actor's wallets through crypto tumblers and chain hopping. It's just a matter of how much money and time are you willing to invest into finding out and not a matter of possibility.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#463

Post by orwin »

maeln wrote: post #424
lm28469 wrote: post #419

Earlier quoted context omitted.

The state takes a flat 30% tax on capital gains regardless of the source, I'd say they paid their fair share

Depends on if they cashed out and how they did it. There was a big trend for a while to go live in Portugal for a while, enough to be considered a tax resident there, and then cash out there because (at the time, idk if it's still true), they had no (or little) tax on crypto cash out.

Yeah, I know two French people who did it (one of them avoided UK taxes as he was paid in crypto while working in the UK, the other it's muddier). I know three people in the space, and only those two were on the financial side, so to me, while Blockchain is still a legit tech, anybody using cryptocurrency I peg as a tax evader.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#464

Post by olalonde »

koakuma-chan wrote: post #436
olalonde wrote: post #427

Brian Armstrong (Coinbase CEO) posted a video about this today: https://x.com/brian_armstrong/status/1922967787309256807

"But customer support agents do have access to personal information like name, date of birth, address, et cetera" Apparently "et cetera" includes photos of my ID? Why do they even keep it?

They are required to by law (thanks to AML regulations).

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#465

Post by csomar »

rsynnott wrote: post #439
dachris wrote: post #387

Earlier quoted context omitted.

Why is this such an issue with crypto? Wealth status is often very well known for public figures and entrepreneurs. People are driving around in $200k cars. Is it due to the liquidity of cryptocurrencies that $5 wrench attacks work better?

If you're kidnapping a generic very rich person, how are you expecting them to pay the ransom, a big burlap sack of cash? There's a lot that can go wrong there. A bank transfer or other conventional financial instrument? Few criminals would be comfortable with that approach. (John Grisham novels, and 'Archer's beloved bearer bonds, aside, it's virtually impossible to make this untraceable). Magic internet money is pr…

They can use their bank account to buy crypto and then pay the ransom. Kidnapping is a thing in latin america before crypto became cool.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#466

Post by csomar »

andy_ppp wrote: post #343
panarky wrote: post #194

Earlier quoted context omitted.

If you had any significant assets on Coinbase at any time prior to this breach, spear phishing is the least of your worries. Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification. People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnappe…

Companies should seriously consider implementing GDPR even in the US, it certainly made taking data dumps of customer data a lot harder and certainly private images like Government IDs were encrypted on disk. I’m surprised at the lack of security if I’m honest, at Yahoo! almost nobody had access to prod user data. Essentially you cannot trust Coinbase IMO, might move the few hundred dollars of BTC out of there :-)

How would GDPR help in this case where the employees were bribed?

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#467

Post by shireboy »

As bad and annoying as this is, I do think “we won’t pay the ransom but set up a reward fund in the same amount to find the perps” is an interesting approach. It turns the tables such that any of the criminals or associates now are incentivized to turn on each other. I could see ways it wouldn’t work (they lie to get the reward, future scammers set up the scam with a patsy so they can collect reward), and am not sure it plays the same if there is actual exposed keys, etc.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#468

Post by csomar »

stringsandchars wrote: post #418
lm28469 wrote: post #408

Earlier quoted context omitted.

> •Name, address, phone, and email;\ > blackmail each individual user Blackmail would be the least of my worries, in France we had at least five kidnappings/attempted kidnappings related to crypto investors since the beginning of the year.

This may seem callous, but isn't a large point of crypto that you are 'free' from the shackles imposed by the State? And I guess that includes protection from criminals by the oppressive forces of the State (aka the police). In which case being kidnapped and having your fingers sent to your family is an integral part of your 'freedom'.

The persons in France probably paid their taxes. So no, your premise is wrong in that the state will help vs. in a crypto no-tax world. Actually the de-jour crypto paradise didn’t have any kidnappings so far and you don’t have to pay taxes either.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#469

Post by csomar »

stringsandchars wrote: post #441
machtiani-chat wrote: post #428

Earlier quoted context omitted.

Crypto isn’t synonymous with anarchy, just like the internet isn’t synonymous with pornography. Both are cliches from long ago. All of the victims are likely tax payers. Law and order is a fundamental service that a legitimate state must provide to all in its jurisdiction, even those who are only resident non-citizens and those that pay little to no taxes in a progressive tax system.

> Crypto isn’t synonymous with anarchy, just like the internet isn’t synonymous with pornography. Both are cliches from long ago. Saying crypto isn’t synonymous with anarchy, like the internet isn’t with pornography, sidesteps the point. Pornography is just one use of the internet — not its central purpose. But crypto wasn’t just built to host financial activity — it was designed to restructure it, removing reliance…

Most (developed states at least) don’t claim the monetary system as a taxation medium. Debasement of currency is a bug not a feature. In the US, you are not required to process your transaction in USD but only need it to pay taxes.

Failed countries (ie: Turkey) rely on the financial system for taxation. Functioning countries shouldn’t care or be bothered by it.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#470

Post by csomar »

orwin wrote: post #463
maeln wrote: post #424

Earlier quoted context omitted.

Depends on if they cashed out and how they did it. There was a big trend for a while to go live in Portugal for a while, enough to be considered a tax resident there, and then cash out there because (at the time, idk if it's still true), they had no (or little) tax on crypto cash out.

Yeah, I know two French people who did it (one of them avoided UK taxes as he was paid in crypto while working in the UK, the other it's muddier). I know three people in the space, and only those two were on the financial side, so to me, while Blockchain is still a legit tech, anybody using cryptocurrency I peg as a tax evader.

Good thing we have courts, lawyers and judges for that. It’s funny everyone here hates on Trump but as soon as something align with their view, they want a defacto no due process application.
Post reply on HN