[TheRecord] Hackers bypass Coinbase 2FA to steal customer funds

More than 6,000 Coinbase users had funds stolen from their accounts after hackers used a vulnerability in Coinbase’s SMS-based two-factor authentication system to breach accounts.

The intrusions took place earlier this year, between March and May, the exchange said in a data breach notification letter it has filed with US state attorney general offices.

“The third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account,” Coinbase said.

“As soon as Coinbase learned of this issue, we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process,” it added.

Coinbase said the attacks could exploit this bug only if they knew the victim’s username and password.

“While we are not able to determine conclusively how these third parties gained access to this information, this type of campaign typically involves phishing attacks or other social engineering techniques to trick a victim into unknowingly disclosing login credentials to a bad actor.

“We have not found any evidence that these third parties obtained this information from Coinbase itself,” the company said.

Coinbase said it would reimburse all users who lost funds in these intrusions.

“Some customers have already been reimbursed — we will ensure all customers affected receive the full value of what you lost. You should see this reflected in your account no later than today,” the company promised.

Coinbase is today’s second-largest cryptocurrency exchange in the world, according to CoinMarketCap, behind Binance.

The post Hackers bypass Coinbase 2FA to steal customer funds appeared first on The Record by Recorded Future.

Source: Read More (The Record by Recorded Future)

You might be interested in …

[ZDNet] BitConnect director pleads guilty to role in $2 billion cryptocurrency fraud

All posts, ZDNet

Prosecutors claim that the promoter earned over $24 million. Source: Read More (Latest topics for ZDNet in Security)

Read More

[BleepingComputer] iPhone WiFi bug morphs into zero-click hacking, but there’s a fix

Security researchers investigating a bug that crashed the Wifi service on iPhones found that it could be exploited for remote code execution without user interaction. […] Source: Read More (BleepingComputer)

Read More

[SecurityWeek] Critical WooCommerce Vulnerability Targeted Hours After Patch

All posts, Security Week

Hackers have started targeting a critical WooCommerce vulnerability only days after patches started rolling out, patchstack says. WooCommerce is a popular open-source eCommerce plugin for WordPress, with more than 5 million installations to date, making it an attractive target for cybercriminals. read more Source: Read More (SecurityWeek RSS Feed)

Read More

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.