Coinbase admitted that thousands of clients’ cash have been robbed in a phishing attempt.
Coinbase stated that “at least 6,000 Coinbase users had funds taken from their accounts” as a result of a recent phishing attempt in which hackers circumvented an SMS-based verification tool that the business employed to secure many accounts.
The phishing attack was originally discovered in August, but the extent of it was revealed only after a letter issued by the company to affected consumers began to spread.
According to the letter, hackers got access to victims’ email accounts and then exploited those hacked accounts to drain those users’ cryptocurrency. Despite the fact that Coinbase required a commonly used security technique known as “two-factor authentication,” the SMS version of this, in which customers receive a text message to confirm a transaction, failed.
“However, in this event, for customers who use SMS texts for two-factor authentication, the third party exploited a weakness in Coinbase’s SMS Account Recovery process to receive an SMS two-factor authentication token and gain access to your account,” the letter states.
Coinbase also claims that it will compensate those who lost money as a result of the phishing attempt, and that it has already started making consumers whole. The entire sum stolen by the hackers was not disclosed by the company.
The event did not result in Coinbase being hacked, as some have claimed, because the hackers did not appear to have accessed the company’s internal infrastructure. Instead, the robberies occurred as a result of customers falling for phishing attempts aimed at their personal email, which is a very typical occurrence.
It’s unclear, though, why Coinbase took so long to disclose the occurrences, which occurred between March and May. While the corporation described a sophisticated phishing campaign in a blog post earlier this week, it did not reveal that hackers exploited it to effectively defraud thousands of clients. Coinbase also does not appear to have done anything to notify its customer base during the hacks, or even in the months that followed.
According to a Coinbase spokeswoman, the company did not want to interfere with the investigation of the incident by law enforcement agencies.