[TheRecord] Hackers bypass Coinbase 2FA to steal customer funds

More than 6,000 Coinbase users had funds stolen from their accounts after hackers used a vulnerability in Coinbase’s SMS-based two-factor authentication system to breach accounts.

The intrusions took place earlier this year, between March and May, the exchange said in a data breach notification letter it has filed with US state attorney general offices.

“The third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account,” Coinbase said.

“As soon as Coinbase learned of this issue, we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process,” it added.

Coinbase said the attacks could exploit this bug only if they knew the victim’s username and password.

“While we are not able to determine conclusively how these third parties gained access to this information, this type of campaign typically involves phishing attacks or other social engineering techniques to trick a victim into unknowingly disclosing login credentials to a bad actor.

“We have not found any evidence that these third parties obtained this information from Coinbase itself,” the company said.

Coinbase said it would reimburse all users who lost funds in these intrusions.

“Some customers have already been reimbursed — we will ensure all customers affected receive the full value of what you lost. You should see this reflected in your account no later than today,” the company promised.

Coinbase is today’s second-largest cryptocurrency exchange in the world, according to CoinMarketCap, behind Binance.

The post Hackers bypass Coinbase 2FA to steal customer funds appeared first on The Record by Recorded Future.

Source: Read More (The Record by Recorded Future)

You might be interested in …

[SecurityWeek] University of Pittsburgh Medical Center Hacker Sentenced to Prison

All posts, Security Week

The individual who hacked the human resources databases of the University of Pittsburgh Medical Center was sentenced to seven years in prison, the United States Department of Justice announced. read more Source: Read More (SecurityWeek RSS Feed)

Read More

[BleepingComputer] Windows 10 KB5001391 update causes News & Interests display issues

Microsoft has confirmed a known issue causing the text on the “News and Interests” Windows Taskbar to get blurry after installing recent Windows 10 updates. […] Source: Read More (BleepingComputer)

Read More

[ZDNet] Ransomware: Now attackers are exploiting Windows PrintNightmare vulnerabilities

All posts, ZDNet

Cyber-criminal groups including Vice Society and Magiber have been spotted using vulnerabilities in Windows Print Spooler to infect victims with ransomware. Source: Read More (Latest topics for ZDNet in Security)

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.