Over 6,000 customers lost money – security

Nasdaq-listed cryptocurrency exchange Coinbase has revealed that at least 6,000 users fell victim to a hacking campaign to gain unauthorized access to the accounts of Coinbase customers. The hackers also exploited a flaw in Coinbase's SMS account recovery process to gain access to user accounts.

Cryptocurrencies belonging to at least 6,000 Coinbase customers stolen by hackers

Cryptocurrency exchange Coinbase supposedly taught over 6,000 customers reported their accounts were compromised and funds removed this week. A copy of letter is posted on the California Attorney General's website. In the letter, the exchange stated:

Unfortunately, between March and May 20, 2021, you became the victim of a third-party campaign to gain unauthorized access to Coinbase customers' accounts and withdraw customer funds from the Coinbase platform. At least 6,000 Coinbase customers have had funds removed from their accounts, including you.

To access a user account at Coinbase, the hackers had to know the email addresses, passwords and phone numbers associated with the accounts and have access to a personal email inbox, the company said. “This type of campaign typically involves phishing attacks or other social engineering techniques to trick a victim into unknowingly revealing credentials to a malicious actor.”

Coinbase further explained that “for customers using SMS texts for two-factor authentication, the third-party provider exploited a flaw in Coinbase’s SMS account recovery process to obtain an SMS two-factor authentication token and gain access to your account.”

The exchange noted that once the hackers got into the affected user accounts, they were able to “transfer your funds to crypto wallets not affiliated with Coinbase.”

The letter also noted that Coinbase updated its SMS account recovery protocols as soon as it learned of the issue, adding:

We will credit your account with funds equal to the value of the currency that was improperly removed from your account at the time of the incident. Some customers have already been reimbursed - we will ensure all affected customers receive the full value of their loss. This should appear in your account no later than today.

The Nasdaq-listed crypto exchange also said it is conducting an internal investigation into this incident and the company is working closely with law enforcement to find the people behind this hack.

Nonetheless, Coinbase insisted: “We have found no evidence that these third parties received [user] information from Coinbase itself.”

What do you think about this security breach affecting over 6,000 Coinbase users? Let us know in the comments section below.

Photo credits: Shutterstock, Pixabay, Wiki Commons