Hackers Stole Cryptocurrency from at Least 6,000 Coinbase Customers Who Likely Fell for Phishing Emails
Posted on 10/02/2021
By exploiting a multi-factor authentication flaw, hackers were able to infiltrate the accounts of and steal cryptocurrency from around 6,000 Coinbase customers. The large-scale phishing campaign (clicking on malicious email links) or social engineering tactics targeted Coinbase users between April 2021 and early May 2021. This information was partially revealed in a breach notification letter sent by the cryptocurrency exchange to affected customers. There is a copy of the letter posted on the website of California’s Attorney General.
“We immediately fixed the flaw and have worked with these customers to regain control of their accounts and reimburse them for the funds they lost,” a Coinbase spokesperson said on Friday to the media.
According to the letter, “As soon as Coinbase learned of this issue, we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process.
We will be depositing funds into your account equal to the value of the currency improperly removed from your account at the time of the incident. Some customers have already been reimbursed — we will ensure all customers affected receive the full value of what you lost. You should see this reflected in your account no later than today.”
The hackers needed to know the email addresses, passwords, and phone numbers linked to the affected Coinbase accounts, and have access to personal emails, according to Coinbase. Coinbase also disclosed that there was no evidence to suggest the information was obtained from Coinbase.
Keywords: Coinbase Global Inc.
