Home
News
- 6,000 coinbase clients were hacked due to system failure
- Account breach warning has been sent to the affected clients
- Hackers were able to steal the one-time passcode in some circumstances
Hackers were able to steal bitcoin from at least 6,000 Coinbase clients this spring, thanks in part to a weakness in the cryptocurrency exchange’s two-factor authentication system. In a data breach warning sent out to affected clients this week, Coinbase detailed the hacker campaign. According to the message, at least 6,000 Coinbase clients had funds withdrawn from their accounts, including you.
Between March 2021 and May 20, 2021, account breaches occurred. Hackers are suspected of using a large-scale email phishing effort to mislead a number of Coinbase customers into handing over their email addresses, passwords, and phone numbers. Furthermore, the unknown perpetrators acquired access to the victims’ email inboxes by using a rogue programme that allows the user to view and write to the inbox if they provide permission.
Even yet, breaking into a Coinbase account requires more than just a password. The company secures an account by default with two-factor authentication, which means you’ll need both a password and a one-time passcode issued on your phone to log in.
However, hackers were able to steal the one-time passcode in some circumstances. This happened to consumers who used the two-factor authentication mechanism, which relies on delivering codes via SMS texts, to safeguard their accounts.
Hacking one-time passcode
However, hackers were able to steal the one-time passcode in some circumstances. This happened to consumers who used the two-factor authentication mechanism, which relies on delivering codes via SMS texts, to safeguard their accounts.
Once the attackers had access to the user’s email inbox and Coinbase credentials, they were able to impersonate the user, receive an SMS two-factor authentication code, and gain access to the Coinbase customer account in a small number of cases, as per the spokesperson. The cryptocurrency funds were then looted by the hackers.
The impersonation was carried out in an unknown manner, according to Coinbase. However, according to the statement, the attackers employed a SIM-swapping attack to fool the cell phone carrier into transferring the victim’s phone number to them.
Accusations for the exchange
Following accusations that the business did nothing to help victims of the attacks, Coinbase said that it has started compensating victims for the stolen cryptocurrency. A firm spokeswoman stated, the exchange immediately corrected the flaw and worked with these consumers to restore control of their accounts and refund them for the monies they lost.
It’s also unclear how the problem was repaired. Coinbase, on the other hand, is urging clients to abandon the SMS-based two-factor verification scheme in favour of more secure options. This includes employing a hardware-based security key or using a mobile app to generate the one-time passcode.
The bitcoin exchange also stated in a blog post earlier this week that the hackers never gained access to Coinbase’s security infrastructure or broader networks. The exchange has discovered no evidence that these third parties received this information directly from Coinbase.
Andrew is a blockchain developer who developed his interest in cryptocurrencies while pursuing his post-graduation major in blockchain development. He is a keen observer of details and shares his passion for writing, along with coding. His backend knowledge about blockchain helps him give a unique perspective to his writing skills, and a reliable craft at explaining the concepts such as blockchain programming, languages and token minting. He also frequently shares technical details and performance indicators of ICOs and IDOs.
