Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom(cnbc.com)
cnbc.com
Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom
https://www.cnbc.com/2025/05/15/coinbase-says-hackers-bribed-staff-to-steal-customer-data-and-are-demanding-20-million-ransom.html
548 comments
I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening feature takes good care of the rest. Wish I could forward them to Kitboga[1].
I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves.
[1] https://www.youtube.com/watch?v=HNziOoXDBeg
I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves.
[1] https://www.youtube.com/watch?v=HNziOoXDBeg
If you had any significant assets on Coinbase at any time prior to this breach, spear phishing is the least of your worries.
Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification.
People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnapped for ransom.
"Significant" in this case can be $10k or less.
Until now, your best defense secrecy. Never talk about crypto in public in any way that could be traced to your real-world identity.
Thanks to Coinbase that defense is now gone.
The bad guys can see who has ever had a significant balance on Coinbase (even if they don't right now), whether that balance was sold for cash and how much, or if you've ever transferred tokens off the exchange to a self-custody wallet.
Now the bad guys know who's worth kidnapping for ransom and where you live. For most people, a Google search of your name and home address turns up the names of family members who would would also be lucrative targets for kidnapping and threats of violence.
Coinbase will never be forced to reimburse all the damage they've done because the true cost would bankrupt the company.
Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification.
People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnapped for ransom.
"Significant" in this case can be $10k or less.
Until now, your best defense secrecy. Never talk about crypto in public in any way that could be traced to your real-world identity.
Thanks to Coinbase that defense is now gone.
The bad guys can see who has ever had a significant balance on Coinbase (even if they don't right now), whether that balance was sold for cash and how much, or if you've ever transferred tokens off the exchange to a self-custody wallet.
Now the bad guys know who's worth kidnapping for ransom and where you live. For most people, a Google search of your name and home address turns up the names of family members who would would also be lucrative targets for kidnapping and threats of violence.
Coinbase will never be forced to reimburse all the damage they've done because the true cost would bankrupt the company.
Florida teens kidnap Las Vegas man, drive him to Arizona desert, steal $4M in cryptocurrency
https://www.yahoo.com/news/florida-teens-kidnap-las-vegas-20...
https://www.yahoo.com/news/florida-teens-kidnap-las-vegas-20...
"They Stole a Quarter-Billion in Crypto and Got Caught Within a Month. How luxury cars, $500,000 bar tabs and a mysterious kidnapping attempt helped investigators unravel the heist of a lifetime."
https://www.nytimes.com/2025/04/24/magazine/crybercrime-cryp... (gift article)
And this crypto CEO in Toronto was kidnapped for a $1M ransom: https://www.cbc.ca/news/canada/toronto/kidnapping-toronto-bu...
The parent post was someone literally hosting a crpyto conference, and this one was someone who runs a crypto company. A sibling story describes the father of a 'cryptocurrency influencer.' Is there any evidence of real crime happening which was targeted at Coinbase leak data, or is this just vibes
Well you start with the low-hanging fruit. Also I imagine these things take a while to plan.
The point is, it didn't need a coinbase data breach to identify these victims - they're high profile, public users of crypto.
Right. But it's an example of what could be coming for coinbase whales.
Seems to be a whole thing in France too: https://www.theguardian.com/world/2025/may/04/french-police-....
> will never be forced to reimburse all the damage they've done because the true cost would bankrupt the company
This story keeps repeating. Maybe we should try it and see if it works as a deterrent.
This story keeps repeating. Maybe we should try it and see if it works as a deterrent.
It's worked before; Arthur Andersen ceased to exist after the Enron accounting scandal.
So you’re saying that one year of complementary credit monitoring by Experian isn’t enough??? /s
Why is this such an issue with crypto?
Wealth status is often very well known for public figures and entrepreneurs. People are driving around in $200k cars.
Is it due to the liquidity of cryptocurrencies that $5 wrench attacks work better?
Wealth status is often very well known for public figures and entrepreneurs. People are driving around in $200k cars.
Is it due to the liquidity of cryptocurrencies that $5 wrench attacks work better?
If you're kidnapping a generic very rich person, how are you expecting them to pay the ransom, a big burlap sack of cash? There's a lot that can go wrong there. A bank transfer or other conventional financial instrument? Few criminals would be comfortable with that approach. (John Grisham novels, and 'Archer's beloved bearer bonds, aside, it's virtually impossible to make this untraceable). Magic internet money is presumably far less messy.
Also, a decent proportion of crypto-millionaires came by their riches in... not entirely above-board ways (in particular, securities fraud; all those pump and dump scamcoins are paying off for _someone_), and may be reluctant to involve the authorities. And the crypto industry as a whole is unusually comfortable with extortion; hacked crypto companies paying a kind of bounty to hackers to get the rest of the funds back is a common thing.
Also, a decent proportion of crypto-millionaires came by their riches in... not entirely above-board ways (in particular, securities fraud; all those pump and dump scamcoins are paying off for _someone_), and may be reluctant to involve the authorities. And the crypto industry as a whole is unusually comfortable with extortion; hacked crypto companies paying a kind of bounty to hackers to get the rest of the funds back is a common thing.
They can use their bank account to buy crypto and then pay the ransom. Kidnapping is a thing in latin america before crypto became cool.
> They can use their bank account to buy crypto and then pay the ransom.
This is actually more difficult than it sounds. Most banks and crypto exchanges won't allow a person to make meaningfully large crypto transactions without some account history.
This is actually more difficult than it sounds. Most banks and crypto exchanges won't allow a person to make meaningfully large crypto transactions without some account history.
“Hey, cryptocurrency exchange, I, a random rich person, would like to, having never interacted with you before, buy a million dollars of bitcoin and transfer it out. Today, please.”
That is simply not going to happen.
That is simply not going to happen.
Eh, million dollars would not raise a single eyebrow from an exchange side. Your bank, maybe, will have some questions about the transaction, but the things they can do to prevent you spending your money are thankfully fairly limited.
How long do you think it takes to create an account, get your KYC documents verified, get your trading and withdrawal limits raised to a million or more, transfer funds from your brokerage account, buy tokens and then re-verify when you try to transfer the tokens out of the exchange?
You'd be lucky to complete this in less than a week.
You'd be lucky to complete this in less than a week.
It takes about 3 days on kraken. Much less than a week.
Kraken is literally warning about delays in opening new accounts and getting verified right now.
https://imgur.com/a/k8zuSH1
https://imgur.com/a/k8zuSH1
My experience with banks in UK / EU is that they will bother you for much smaller amounts than 1M. I had banks bother me for 10k transfers and other banks completely ignore me for 100k transfers.
Companies do exactly this frequently to get their hacked servers and data decrypted.
It happens with cash sometimes but people are limited to the amount they can get out of an ATM where with crypto you can force someone to hand over all their wealth with a few keystrokes.
Scammers attract scammers?
But hey, at least by being forced to give crypto exchanges all our personal details we're all super protected from the four horsemen: money laundering, drugs, terrorism and pornography.
I think that the right lesson to learn here is not "I should store my money with a company I can't trust not to advertise where I live, but without telling them where I live ".
No one is forced to use a "crypto exchange" in the first place.
or cryptocurrencies
[deleted]
> People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnapped for ransom. "Significant" in this case can be $10k or less.
I wonder why, select a person completely at random and by median you'll get just as much from what they have sitting in their checking account. Select a nicer area for an order of magnitude more. That's not encouragement to go assault people in their homes or kidnap families... just confusion.
I wonder why, select a person completely at random and by median you'll get just as much from what they have sitting in their checking account. Select a nicer area for an order of magnitude more. That's not encouragement to go assault people in their homes or kidnap families... just confusion.
Yeah, but banks and the normie monetary system has a lot more safeguards in it when it comes to account transfers. Or at least, they appear to have them.
Crypto? It's wild, and people think it's wild.
Crypto? It's wild, and people think it's wild.
I tried to use Coinbase a few months ago to pay for something, and I couldn't even make a transaction because it was deemed suspicious, and my account got locked or something.
Someone with a lot of cryptocurrency in Coinbase is also quite likely (at least relative to the average person) to have lots of on-chain cryptocurrency, too, though.
of course, you need to point out that Crypto has ended up being indistinguishable from the banking system in all the important parts.
The distinguishing parts are things you don't want: easily corrupted, grifted, cheated and otherwise duped.
The distinguishing parts are things you don't want: easily corrupted, grifted, cheated and otherwise duped.
The median person does not have $10k sitting in a checking account that they can easily withdraw. My gut feeling is that the threat of kidnapping is a lot more serious in some countries. The US maybe not so much.
> The median person does not have $10k sitting in a checking account that they can easily withdraw.
That's true, finding someone with 10k is not as easy as picking a person at random, but it is as easy as driving to the right parking lot and picking a person at random.
That's true, finding someone with 10k is not as easy as picking a person at random, but it is as easy as driving to the right parking lot and picking a person at random.
Pulling $10k out of the global banking system by physical coercion in a way that isn't reversible and won't get you caught is hard problem, you might as well attempt to rob the bank instead. That's why most of the "successful" criminals in that space use social engineering and scamming where the victim is a unwitting participant rather than kidnapping someone.
With crypto, no bank or other middleman involved, it's like stealing physical cash/gold/diamonds from someone, if you know they have it in their possession, so violence can be a lot more successful at coercing a change of possession.
With crypto, no bank or other middleman involved, it's like stealing physical cash/gold/diamonds from someone, if you know they have it in their possession, so violence can be a lot more successful at coercing a change of possession.
Good point, perhaps the lower $ examples are about other countries where that may be a lot more than median transactional account holdings and maybe that concern is part of why folks were using crypto holdings.
[deleted]
Bank transactions are reversible, crypto transactions are not.
Also, people do point guns in people’s faces and force them to pay them via Venmo or Cashapp. Google ‘Venmo robbery’ or ‘cashapp robbery’ for plenty of examples. Pointing a gun in someone’s face for $4M in crypto is a lot more lucrative.
Also, people do point guns in people’s faces and force them to pay them via Venmo or Cashapp. Google ‘Venmo robbery’ or ‘cashapp robbery’ for plenty of examples. Pointing a gun in someone’s face for $4M in crypto is a lot more lucrative.
The average American can't deal with a $1000 emergency.
Maybe they wouldn't be able to cover other planned expenses with said loss or something but the median (I intentionally avoid referring to "average" for reasons also mentioned in this article) amount American have access to in their transactional bank accounts is $8,000 according to the Federal Reserve: https://www.fool.com/money/research/average-savings-account-...
Someone else made a great mention though: Coinbase didn't just serve the US. For the vast majority of countries these amounts are more than the yearly disposable income of a typical household. From that angle the numbers in the stories make a bit more sense.
Someone else made a great mention though: Coinbase didn't just serve the US. For the vast majority of countries these amounts are more than the yearly disposable income of a typical household. From that angle the numbers in the stories make a bit more sense.
Companies should seriously consider implementing GDPR even in the US, it certainly made taking data dumps of customer data a lot harder and certainly private images like Government IDs were encrypted on disk. I’m surprised at the lack of security if I’m honest, at Yahoo! almost nobody had access to prod user data.
Essentially you cannot trust Coinbase IMO, might move the few hundred dollars of BTC out of there :-)
Essentially you cannot trust Coinbase IMO, might move the few hundred dollars of BTC out of there :-)
> I'm surprised at the lack of security if I’m honest
This is the crypto industry, who make the discrepancy between Theranos' claims and practice look conservative.
This is the crypto industry, who make the discrepancy between Theranos' claims and practice look conservative.
> How does Coinbase protect data in transit and data at rest?
> Coinbase employs a range of technical and organizational measures to defeat efforts to intercept, surveil, or otherwise access without authorization data in transit. For instance, Coinbase encrypts all confidential data transfers to prevent interception or tampering of that data by unauthorized third parties.
Coinbase does business in the EU and thus, already has to comply with the GDPR. Moreover, the US also requires safeguards for sensitive customer information by financial services companies.
> Coinbase employs a range of technical and organizational measures to defeat efforts to intercept, surveil, or otherwise access without authorization data in transit. For instance, Coinbase encrypts all confidential data transfers to prevent interception or tampering of that data by unauthorized third parties.
Coinbase does business in the EU and thus, already has to comply with the GDPR. Moreover, the US also requires safeguards for sensitive customer information by financial services companies.
> Companies should seriously consider implementing GDPR even in the US
... and save the data in US cloud where everybody can access it.
It is really funny how FAANG can get away with data colkection in spite of GDPR.
... and save the data in US cloud where everybody can access it.
It is really funny how FAANG can get away with data colkection in spite of GDPR.
Yeah this is really frustrating, especially the way the EU commission keep coming up with workarounds that the court will almost certainly strike down.
How can I check if I am affected by this?
If you were affected, you should have gotten an email yesterday.
I checked my email to see if I received anything and, interestingly, I received an email from Coinbase on April 14 that they're updating the User Agreement. The new terms only apply to disputes initiated by me or Coinbase after May 15, 2025. Timing seems suspect.
And yet, Coinbase goes Scott free
Someone, someone at that company should be going to prison for negligence
Someone, someone at that company should be going to prison for negligence
Can you point to a specific law that was broken where prosecutors have a chance at jail time, or is this a fantasy of yours?
The comment said "should be" which you glibly interpret as "should be going to jail based on the law" but could very easily be "the law should be such that this kind of negligence results in jail time".
I assume they mean that someone from the company going to prison for this would be a just outcome, not that a path to such an outcome exists today (it likely does not).
> Someone, someone at that company should be going to prison for negligence
That's not how capitalism works. /s
That's not how capitalism works. /s
"decentralized currency"
Bitcoin is plenty decentralized. Coinbase deals with dollars, that's the non-decentralized part.
so, the part that makes bitcoin useful to 99% of the people is the non-decentralized part.
Sounds like an appendix.
Sounds like an appendix.
Only because of US law. It didn't have to be this way; the US wanted to destroy Bitcoin as a currency because it threatened their surveillance state, and they effectively have.
No entity is obligated to enforce contracts in BTC. The real reason what makes a currency valuable.
Btc whales want to destroy the dollar because it benefits them.
Neither the dollar or crypto are anything but social illusions, neither have an inherent right to exist.
It’s just people manipulating people. Such an intellectually dishonest forum to sit here and discuss meaningless layers of obfuscation.
The most important thing to any individual is enough other humans around their own life isn’t so hard. Specific humans, like those on this forum, are not essential.
You all can bleat on as hard as you want about the existence of crypto but it’s not an evenly distributed belief. And your individual value is non existent to the majority on the planet. No reason to prop up your hallucinations
Neither the dollar or crypto are anything but social illusions, neither have an inherent right to exist.
It’s just people manipulating people. Such an intellectually dishonest forum to sit here and discuss meaningless layers of obfuscation.
The most important thing to any individual is enough other humans around their own life isn’t so hard. Specific humans, like those on this forum, are not essential.
You all can bleat on as hard as you want about the existence of crypto but it’s not an evenly distributed belief. And your individual value is non existent to the majority on the planet. No reason to prop up your hallucinations
Why do you see this as the fault of Coinbase? Do other companies somehow have employees that are immune to bribes and blackmail?
This is due to US Government KYC laws that forced Coinbase to associate government identification with all accounts. No crypto company required ID until they were forced to.
This is due to US Government KYC laws that forced Coinbase to associate government identification with all accounts. No crypto company required ID until they were forced to.
The US Government didn't provide high-volume, bulk access to this extremely sensitive information to contractors in foreign countries with no controls over their ability to mass-exfiltrate the data.
Coinbase is the entity that set up this dangerous system.
Coinbase did it because it was cheap for them, not because they were being trustworthy custodians of information that put their customers at risk.
Sure, yes, obviously every company's employees and contractors are vulnerable to bribes and blackmail. That's why a trustworthy, competent custodian would establish systems and controls to prevent bribed and blackmailed insiders from mass-exfiltrating information that could get their customers killed.
The fact that other companies manage to be trustworthy, competent custodians while Coinbase doesn't is not the fault of KYC.
Coinbase is the entity that set up this dangerous system.
Coinbase did it because it was cheap for them, not because they were being trustworthy custodians of information that put their customers at risk.
Sure, yes, obviously every company's employees and contractors are vulnerable to bribes and blackmail. That's why a trustworthy, competent custodian would establish systems and controls to prevent bribed and blackmailed insiders from mass-exfiltrating information that could get their customers killed.
The fact that other companies manage to be trustworthy, competent custodians while Coinbase doesn't is not the fault of KYC.
Fair enough, and it does sound like they had limits given that not all customer data was exfiltrated but those limits were probably far too high at tens of thousands affected.
Outsourcing also led to the Ledger leak of customer data. You'd think Coinbase would have learned a lesson from that.
Generally, staff do not have unfettered access to all customer data in most financial companies.
You don't think Coinbase is responsible for restricting access to member data for support agents?
[deleted]
[deleted]
[deleted]
There is no valid reason why Coinbase or any other financial services company should ever be excepted from AML/KYC laws. If anything the laws ought to be even tighter to slow down financial flows to criminals and sanctioned entities.
I just switched to iPhone from a pixel device and I’m shook by all the spam calls. How do iPhone users deal with this?
It’s my biggest gripe. They can pretty accurately flag a number as Spam or Telemarketing but in the “Silence Unknown Callers” setting I can only silence every single unknown caller. I can’t silence every single number that’s not in my contacts. When the plumber calls to confirm he’s in route, my phone needs to ring. Stuff like that.
I would have assumed an unknown caller was defined as any number not in your contacts. what is it instead?
In the realm of Caller ID, a phone number may be "PRIVATE" (or "WITHHELD") or "UNKNOWN". An "UNKNOWN" Caller ID cannot display any name nor any number, because... they are not known to the switch.
Therefore, an unknown number that can be blocked/ignored by your phone or the app is one that doesn't support Caller ID's name or number functions. It doesn't have anything to do with who's in your Contacts app, because of course those consist of known names and known numbers.
Therefore, an unknown number that can be blocked/ignored by your phone or the app is one that doesn't support Caller ID's name or number functions. It doesn't have anything to do with who's in your Contacts app, because of course those consist of known names and known numbers.
There is a defined type “Unknown” which I think you’re describing but it’s Not exactly how the iOS feature works. It says let’s through those in your contacts or who you’ve had recent conversations with and Siri suggestions. It’s basically a dumb proxy for letting through people you might actually want to talk with. Except sometimes you don’t know who/where/when those calls are coming from and I haven’t spoken to them before.
it is super fucking easy. it has been a decade since I answered an unknown number. if plumber calls (and I dont have her/his number stored) it goes to voicemail. I then call known company number. The communication is always one-way, I call you. I never answer. You follow this one very simple rule and you good :)
Theres plenty of situations where this doesn't work. If you're called from a business central line and you don't know their extension you just call back and get the normal call tree which can take you forever to get through. Or if you're on the "cancellation list" for an appointment if they can't get through to you, they don't wait for you to call back, they just go on to the next person to schedule in their open slot.
Taxi cab dispatchers will do this for sure. They do callbacks to “confirm” your ride, especially when busy, because if you don’t answer, they simply drop your request on the sticky office floor.
this is a loss of business for them, not my problem. it is 2025, if they do not have map where i can track where they are etc.. imma not going to be using that service...
So this app that millions of people use, probably most of the ~1.4 billion iPhone users… instead of making some minor edits to the settings to make it better for a lot of people, the solution is we all just need to use the app the way you do?
Not even going to consider that some people are more phone dependent and not just fielding an occasional call from their lost dasher or uber driver. Overly simplistic view on the world, you need to think beyond your use cases and make software that is beneficial to the entire user base. It’s the whole point of having a settings section of the app, to allow some custom behaviors tailored to your needs and some you won’t use because they are tailored towards someone else’s needs
Not even going to consider that some people are more phone dependent and not just fielding an occasional call from their lost dasher or uber driver. Overly simplistic view on the world, you need to think beyond your use cases and make software that is beneficial to the entire user base. It’s the whole point of having a settings section of the app, to allow some custom behaviors tailored to your needs and some you won’t use because they are tailored towards someone else’s needs
it always works mate, it always works
Glad it works for you, I’m not allergic to the phone like seemingly everyone else so I strive to minimize phone tag BS and would rather answer the calls I get and filter out known spam, it’s not rocket science it’s probably only 2 lines of code in the phone app
If call is spam and ignore spam option enabled, send call to voicemail.
That’s it, a simple line of code. Just make the option selectable and it’s done.
If call is spam and ignore spam option enabled, send call to voicemail.
That’s it, a simple line of code. Just make the option selectable and it’s done.
Why would a number in your contacts be considered "unknown"
I've failed to semantically parse your statements
This could have been solved with regulation. Mandate delivery of all available phone call metadata to every digital telephone. Mandate that mobile phone operating systems must expose that data to apps approved by the user.
We'd have hundreds of enshittification-ready VC-backed apps to fix spam calls overnight.
Instead, we got STIR/SHAKEN mandates, which is just a soft way of having the legacy telcos "promise to fix it for you."
We'd have hundreds of enshittification-ready VC-backed apps to fix spam calls overnight.
Instead, we got STIR/SHAKEN mandates, which is just a soft way of having the legacy telcos "promise to fix it for you."
I believe there are Phone app alternatives, I just don’t trust them
I feel like Apples M.O. on software is to build the lowest passable set of features in their apps, never enhance them, allow third parties to delve into the high functionality/spec software. Mail is horrible, Camera good enough for most people, for me personally even Safari is in this camp; I’d swap any of those for a third party solution without much thought. Phone app becomes a bit to much of a security risk to use a third party, such that I’d never even consider leaving the default Phone app.
I feel like Apples M.O. on software is to build the lowest passable set of features in their apps, never enhance them, allow third parties to delve into the high functionality/spec software. Mail is horrible, Camera good enough for most people, for me personally even Safari is in this camp; I’d swap any of those for a third party solution without much thought. Phone app becomes a bit to much of a security risk to use a third party, such that I’d never even consider leaving the default Phone app.
iphone has been enshittified for several years now, it seems apple engineers are not using their own phones any more. I can understand it - when you're a millionaire just from your corporate job you won't be a stressed power user of your own iphones.
It’s not that it got worse, this feature has just never been great. It just feels half baked , which I agree a lot of Apple software has been trending towards. That said, what has increased is the volume of spam calls. So the importance of this feature has also increased.
It’s sad because this seems like such a low hanging fruit for a big improvement. At some point in the relatively recent past, they added the indicator of the caller being a spammer or telemarketer. Seems like that would have been a good time to also enhance this filter but it seems nobody ever connected the dots on that one. Or if I’m being even more cynical, some engineer actually decided he’d rather everyone see his work on every incoming spam call instead of his work quietly improving everyone’s experience
It’s sad because this seems like such a low hanging fruit for a big improvement. At some point in the relatively recent past, they added the indicator of the caller being a spammer or telemarketer. Seems like that would have been a good time to also enhance this filter but it seems nobody ever connected the dots on that one. Or if I’m being even more cynical, some engineer actually decided he’d rather everyone see his work on every incoming spam call instead of his work quietly improving everyone’s experience
>some engineer actually decided
No sane person would flaunt Apple secrecy in such a fashion whilst employed there.
>instead of his work quietly improving everyone’s experiBence
Laughable that you feel that Apple engineers have the capacity for this kind of desire in 2025. If they did, Xcode would be way better to use. They cant even quietly improve their own experience.
No sane person would flaunt Apple secrecy in such a fashion whilst employed there.
>instead of his work quietly improving everyone’s experiBence
Laughable that you feel that Apple engineers have the capacity for this kind of desire in 2025. If they did, Xcode would be way better to use. They cant even quietly improve their own experience.
Whatever man, I'm not trying to shit on them like you want me to. I think adding this simple feature that is likely little more than a line or two of code is a night an day comparison to overhauling something like Xcode to meet your definition of what "better" means
That seems...overly dramatic. Further, enshittification as a concept generally refers to VC/growth-hacking style situations.
Also, on TMobile if you dial #662#, it'll block the Scam Likely calls at the carrier.
Oh man. They start at 7AM and end around 4-5ish PM. I was hoping the war between Pakistan and India would make these stop. Jk obv. Nobody likes wars. But other than Tmobile are there similar methods for different providers? It can get so annoying. I did restrict calls from known numbers only.
I had no idea. Thank you!
Yeup, I finally broke down went from Android -> IPhone 16 Pro. I like a lot about Apple's personal security policies for their consumers vs Google, but damn, I miss google's automatic call spam detection and management. All day long my Apple phone rings, and I just have to ignore the calls.
Verizon (and I assume many other US carriers) offer junk call identification which your iPhone can block if you have ”Silence Junk Callers” toggled in Settings > Phone > Call Blocking & Identification.
https://support.apple.com/guide/iphone/block-or-avoid-unwant...
https://support.apple.com/guide/iphone/block-or-avoid-unwant...
Unfortunately blocking all unknown calls is the only way to sanity. Otherwise we're talking 6-9 calls coming in ALL DAY, EVERY DAY.
The calls are coming from new numbers, across multiple area codes. A few months ago I would have advised using Begone (https://apps.apple.com/us/app/begone-spam-call-blocker/id159...) to block but that only worked since these calls were isolated to blocks of area codes that were pretty safe to block like 888-XXX-XXXX, but now ZERO of these calls are using a fixed area code that would be relative safe to block.
The calls are coming from new numbers, across multiple area codes. A few months ago I would have advised using Begone (https://apps.apple.com/us/app/begone-spam-call-blocker/id159...) to block but that only worked since these calls were isolated to blocks of area codes that were pretty safe to block like 888-XXX-XXXX, but now ZERO of these calls are using a fixed area code that would be relative safe to block.
I can't block all calls, but the screening feature on my Pixel did an immense job of filtering out the spam.
answer the call and immediately put it on mute. they will hang up and stop calling
Don't you have caller-pays in the US?
I have my phone set to silence Unknown callers. What did you have setup on the Pixel before to block them?
That’s too heavy handed for me. I get valid calls that I need to answer that aren’t in my contacts.
The calls they flag as potential spam and telemarketers has been 100% accurate in my experience so i wish I could just silence those
The calls they flag as potential spam and telemarketers has been 100% accurate in my experience so i wish I could just silence those
Usually you are expecting these calls tho so you can turn off that feature when you do. If said person calls often, add them to your contacts.
They could also just easily enhance the feature right? It’s an extra if statement in the code. I get enough calls that it’s not practical to constantly edit a setting that’s like this. There’s nothing else in the settings app I change regularly, it’s mostly set and forget.
It’s much better to just silence every spam call manually instead of having to go into voicemail, listen , decide if I need to respond, hope that I’m acting quickly enough that the other person answers when I ring them back, etc. i imagine this works for a lot of people. But if you get enough calls, or get urgent calls for any reason, it’s not ideal.
For those that can’t imagine the use cases. Consider you are primary contact for your elderly parent. If they fall in the middle of the night you might be getting a call from any random number. Do not disturb isn’t an option and sometimes the EMS guys will call you from their personal cell phone. Even some services like home security will call from random numbers. If ask a plumber to come over, some random technician will call from their device to talk. If a potential client gets my number somehow, I’d prefer to answer versus them get my voicemail.
You have to also factor in that a lot of people don’t even like leaving voicemail so they don’t leave one and I’m left guessing if it mattered that
It’s much better to just silence every spam call manually instead of having to go into voicemail, listen , decide if I need to respond, hope that I’m acting quickly enough that the other person answers when I ring them back, etc. i imagine this works for a lot of people. But if you get enough calls, or get urgent calls for any reason, it’s not ideal.
For those that can’t imagine the use cases. Consider you are primary contact for your elderly parent. If they fall in the middle of the night you might be getting a call from any random number. Do not disturb isn’t an option and sometimes the EMS guys will call you from their personal cell phone. Even some services like home security will call from random numbers. If ask a plumber to come over, some random technician will call from their device to talk. If a potential client gets my number somehow, I’d prefer to answer versus them get my voicemail.
You have to also factor in that a lot of people don’t even like leaving voicemail so they don’t leave one and I’m left guessing if it mattered that
I just see if they leave a message. If they don’t, they’re sorted. If they do I can always call them back.
I need calls from unknown numbers (doctors, vendors, etc.) Pixel would flag spam calls and not ring, all the unknown-but-valid callers got through without issue.
Settings -> Phone -> Silence Unknown callers
I have the exact same experience. I felt like I went back to a phone from 2018.
You turn off the notifications from unknown callers? How does Android handle it?
Sometimes you need to answer calls from unknown numbers.
Google's call screening feature picks up the phone before it rings and asks the caller why they're calling. If they actually give a good reason, then it shows you the reason as text and you can decide whether to hang up on them or answer. https://support.google.com/phoneapp/answer/9118387
Google's call screening feature picks up the phone before it rings and asks the caller why they're calling. If they actually give a good reason, then it shows you the reason as text and you can decide whether to hang up on them or answer. https://support.google.com/phoneapp/answer/9118387
Yeah you went the wrong way there brother.
If it’s says Rogers you know it’s a scam
iPhone user here. I put on airplane mode unless I'm making or expecting a call. Otherwise, I make it clear that email is my primary form of communication.
"Yeah yeah... installing your app now... oh there is an error... will try again..."
I started getting regular Coinbase login confirmation codes text messages with no attempts on my end
Same with my Microsoft account actually
I usually just ignore it but I assume someone is testing if my email can be used to login.
Same with my Microsoft account actually
I usually just ignore it but I assume someone is testing if my email can be used to login.
Oh yeah I get the Microsoft account emails, and Instagram ones, randomly (I have an account but never use it). I'm pretty sure SMS 2FA is turned off on my Coinbase account, which is highly recommended.
> I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction.
And how long has this been at an increased level? Because i'm not buying the coinbase narrative that they thought this was a systemic issue until they were contacted by the 'cybercriminals'.
And how long has this been at an increased level? Because i'm not buying the coinbase narrative that they thought this was a systemic issue until they were contacted by the 'cybercriminals'.
It started around the beginning of April, at the same time as I got an initial email from them about my account information being accessed. Which I'm thinking is probably the same breach as they're talking about here.
Scams have gotten better since AI. Most of the common spelling mistakes are gone.
I was looking through some phishing e-mails the other day out of curiosity and found a weird unicode character mistranslated. Immediately knew it was an artifact of bad translation. So they're not perfect, but they're damn good.
I was looking through some phishing e-mails the other day out of curiosity and found a weird unicode character mistranslated. Immediately knew it was an artifact of bad translation. So they're not perfect, but they're damn good.
The common spelling mistakes are there for a reason most of the time.
> a reason
Because people who read the message and think it's professionally written despite the spelling errors have a large overlap with people who will fall for the scam, at least far enough that money is transferred.
Because people who read the message and think it's professionally written despite the spelling errors have a large overlap with people who will fall for the scam, at least far enough that money is transferred.
Where was the number from? I received an impressive number of phonecalls attempt but thankfully I never answer to unknown numbers. With google call screen they hung up everytime so I assume its a scam.
I got probably three or four in the past week.
I wonder if some of that perfect accent might be ML.
> They speak perfect English, sound very friendly, and have knowledge of your account balance.
.. and are former employees of Coinbase .. oh! just imagining!!
.. and are former employees of Coinbase .. oh! just imagining!!
its a shame it'll never stop, and the criminal element is now a legal capitalism
The problem is that it seems like the data that leaked is also the data that would be used to do account recovery.
And what that means is that
1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore.
2) Hackers can try to “recover” accounts now using this leaked info.
This is a huge problem. What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)
The only solution here is: hardware 2 factor like yubikeys.
And what that means is that
1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore.
2) Hackers can try to “recover” accounts now using this leaked info.
This is a huge problem. What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)
The only solution here is: hardware 2 factor like yubikeys.
The Crypto industry continues their speedrun of rediscovering all of the reasons for why the global financial system exists.
What you've described is the same thing that many Crypto enthusiasts call a "Bank"
What you've described is the same thing that many Crypto enthusiasts call a "Bank"
Many banks don't have physical branches.
One that I'm using does, but I find it extremely annoying when they have me go to a branch to unblock my account that they locked due to a poorly calibrated risk system (that they need due to not supporting actually secure 2FA methods).
One that I'm using does, but I find it extremely annoying when they have me go to a branch to unblock my account that they locked due to a poorly calibrated risk system (that they need due to not supporting actually secure 2FA methods).
except banks staff can easily be bribed too. There is plenty of bank fraud happening.
If my bank money gets stolen from me via fraud (unless I literally just Zelle the scammer), I get it back. That's the big difference.
I know it's the massive exception but I was reimbursed when the exchange that tried to rugpull its users felt legal pressure. Things have changed slightly over the years - don't get me wrong, scams are still rampant.
It's been ages since I was in college and had an overdraft or some other bs bank related fee, but the bank manages to 'scam' you legally too. I'm just playing devils advocate and sharing an anecdote, I'm minimally involved in crypto anymore.
It's been ages since I was in college and had an overdraft or some other bs bank related fee, but the bank manages to 'scam' you legally too. I'm just playing devils advocate and sharing an anecdote, I'm minimally involved in crypto anymore.
Zelle is ultimately a bank transfer. Yes they say to consider them like sending cash, but a bank transaction is at least tracable to a real account owner, who could then be pursued in the case of fraud, and it well might be reversible if push came to shove or if there is documented fraud.
I can walk into a bank branch and show documents.
I guess I can walk downtown to CB HQ, but something tells me I won't get past the front desk.
I guess I can walk downtown to CB HQ, but something tells me I won't get past the front desk.
Can you show us that? Where the consumer is left with no money at all and bank does not take the loss.
Go Zelle someone and try to get the money back.
If YOU are the one sending the money of course it is not a hack etc becuase YOU are sending it. If Zelle is hacked and someone steals your money through that hack you will not be left with the loss.
When I was "hacked" two years ago, their final hurrah before I finally got everything offline for a time, they sent zelles as much as they could and was able to recover it without any loss on my end.
I guess things have changed since it has not always been the case that the bank would reimburse you.
https://www.nytimes.com/2022/03/06/business/payments-fraud-z...
https://www.nytimes.com/2022/03/06/business/payments-fraud-z...
Yeah, I think it truly depends on whether you hit the send button or not. Since I was hacked, it wasn't me hitting the send button.
Coinbase is identical to a bank because it holds customer funds. Your comment isn't quite the dunk you think it is. Blockchains allow money to be held anonymously without any banks involved. Centralized exchanges are just profiting on speculation and probably should be banned.
My money in the bank in case of fraud is protected unless I voluntarily gave the fraudster my money. If a bank goes bankrupt, my money is protected by the government
First one might be kind true in the US. Second one is only true up to $250k and how much Yellen likes you. But they are not true around the world and probably for most of it.
By law yes it’s only $250K. But when the banks collapsed last year, the government made sure that no one lost money. In fact, no one has ever lost money because of an FDIC insured bank failure.
No they don’t. “Cryptocurrency” isn’t money at all. Just because you can trade it in for money, doesn’t make it so. I can also trade in my hat to the Buffalo Exchange for money. But my hat is not money.
I am paid my salary in crypto. I pay my rent in crypto. I pay for flights and car rentals in crypto. That's surely enough to be considered money.
There is no bright line separating "money" from any other type of fungible asset
Except for, you know, being able to spend it where you buy things? And deposit it into an actual bank? Those seem sort of intrinsic to how we use money today.
https://en.wikipedia.org/wiki/Legal_tender
https://en.wikipedia.org/wiki/Legal_tender
> > There is no bright line [...]
> Except for, you know, being able to spend it where you buy things? [...]
The extent to which you can use it to buy things is a good metric, but I think that comes in varying degrees rather than being a sharp line or binary true/false. There are at least some things you can buy with cryptocurrency, and arguably there are some forms of "regular" (fiat, national, government-issued) money that aren't very widely accepted.
> Except for, you know, being able to spend it where you buy things? [...]
The extent to which you can use it to buy things is a good metric, but I think that comes in varying degrees rather than being a sharp line or binary true/false. There are at least some things you can buy with cryptocurrency, and arguably there are some forms of "regular" (fiat, national, government-issued) money that aren't very widely accepted.
Yeah, it would be more accurate to say that Coinbase is de facto a brokerage but does not have the same level of regulation as traditional brokerages. The result is the same though.
what's more important to me is how quickly can you trade your hat, how quickly can you determine the marketable value of your hat for selling, how close in value can you buy that hat for the same price you sold it, how many hats can you buy or sell at that price?
and that's where hats fail in all metrics to cryptocurrency and how cryptocurrency satisfies my criteria for money
and that's where hats fail in all metrics to cryptocurrency and how cryptocurrency satisfies my criteria for money
> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)
That's just a bank.
That's just a bank.
Watching crypto enthusiasts run into every problem that society already tackled with in the past when developing currency and its controls, and then coming up with solutions that look exactly the same as what dirty fiat currency uses, has been a source of much entertainment the past few years
> every problem that society already tackled with in the past
More KYC creates more problems while solving some others. Why didn't the same society despite KYC/AML tackle the problem pointed at in a previous comment? "Florida teens kidnap Las Vegas man, drive him to Arizona desert, steal $4M in cryptocurrency"[1] Why is there this crime?
Without mandatory KYC laws, this particular attack would be near pointless. No name tied to account, bookkeeping doesn't archive wire transaction details for the past 10 years.
Let businesses easily accept cryptocurrency (like... regular cash?), without a blade to their throat held by the government, and the need for such centralization points will greatly diminish. People get in trouble by p2p-exchanging money with unknown peers; in some instances this "trouble" has the unit of "years".
It's in nobodies' interest to protect cryptocurrency payments as the alternative, other than the activists, and the big groups jumping in on it for the speculation purposes - something they had refined decades ago. There's CBDC is on the horizon.
[1]: https://news.ycombinator.com/item?id=43999011
More KYC creates more problems while solving some others. Why didn't the same society despite KYC/AML tackle the problem pointed at in a previous comment? "Florida teens kidnap Las Vegas man, drive him to Arizona desert, steal $4M in cryptocurrency"[1] Why is there this crime?
Without mandatory KYC laws, this particular attack would be near pointless. No name tied to account, bookkeeping doesn't archive wire transaction details for the past 10 years.
Let businesses easily accept cryptocurrency (like... regular cash?), without a blade to their throat held by the government, and the need for such centralization points will greatly diminish. People get in trouble by p2p-exchanging money with unknown peers; in some instances this "trouble" has the unit of "years".
It's in nobodies' interest to protect cryptocurrency payments as the alternative, other than the activists, and the big groups jumping in on it for the speculation purposes - something they had refined decades ago. There's CBDC is on the horizon.
[1]: https://news.ycombinator.com/item?id=43999011
> Without mandatory KYC laws, this particular attack would be near pointless. No name tied to account, bookkeeping doesn't archive wire transaction details for the past 10 years.
But this attack is already fully pointless with traditional finance. You can't steal someone's bank account at gun point.
Conversely, even without KYC, blockchain based currencies paint a huge target on anyone who uses a small number of wallets to store a large amount of money. Dedicated criminals and even state actors can figure out who owns the wallets by tracking transaction patterns, getting information from vendors, etc. As long as you're actually using your crypto wallets (unlike, say, Satoshi), you can quite easily be tracked. Anyone who you order a pizza from in BTC knows the address of whoever has that wallet. Sure, you can take a lot of steps to protect yourself from it, but it's hard, and one slip-up is all it takes. Opsec is not for the careless.
Also, crypto's reliance on secrets instead of legal personhood to ascertain ownership fundamentally makes it prone to stealing money in this way. Since the money doesn't belong to a legal person, but to whoever knows some secret key, that key can be stolen from whoever has it through simple violence. Even if you're extremely careful not to leak details of your accounts, use XMR for untraceable payments, etc - someone who is physically close to you could see that you're rich and decide to attack just on the chance that you may have crypto, without knowing anything specific.
But this attack is already fully pointless with traditional finance. You can't steal someone's bank account at gun point.
Conversely, even without KYC, blockchain based currencies paint a huge target on anyone who uses a small number of wallets to store a large amount of money. Dedicated criminals and even state actors can figure out who owns the wallets by tracking transaction patterns, getting information from vendors, etc. As long as you're actually using your crypto wallets (unlike, say, Satoshi), you can quite easily be tracked. Anyone who you order a pizza from in BTC knows the address of whoever has that wallet. Sure, you can take a lot of steps to protect yourself from it, but it's hard, and one slip-up is all it takes. Opsec is not for the careless.
Also, crypto's reliance on secrets instead of legal personhood to ascertain ownership fundamentally makes it prone to stealing money in this way. Since the money doesn't belong to a legal person, but to whoever knows some secret key, that key can be stolen from whoever has it through simple violence. Even if you're extremely careful not to leak details of your accounts, use XMR for untraceable payments, etc - someone who is physically close to you could see that you're rich and decide to attack just on the chance that you may have crypto, without knowing anything specific.
> the address of whoever has that wallet.
Good points overall, thank you. This one could be managed by wallet software that'd do its own account tracing in order to separate your histories by generating new addresses for incoming transfers.
> physically close to you could see that you're rich and decide to attack just on the chance
The wearers of premium watches or smartphones don't seem to be concerned for their safety. For an increased payout they could be followed to their home. I think https://xkcd.com/538/ strucks either way.
... I think this is a good counterargument: what's the difference between a wallet and a banking account when everyone today can issue a wire transfer from the comfort of their home. Instant payments and all that. It just adds an extra step of waiting a couple more minutes for the transaction to come through. I assume the money laundering step is figured out by the criminals doing this to you.
Good points overall, thank you. This one could be managed by wallet software that'd do its own account tracing in order to separate your histories by generating new addresses for incoming transfers.
> physically close to you could see that you're rich and decide to attack just on the chance
The wearers of premium watches or smartphones don't seem to be concerned for their safety. For an increased payout they could be followed to their home. I think https://xkcd.com/538/ strucks either way.
... I think this is a good counterargument: what's the difference between a wallet and a banking account when everyone today can issue a wire transfer from the comfort of their home. Instant payments and all that. It just adds an extra step of waiting a couple more minutes for the transaction to come through. I assume the money laundering step is figured out by the criminals doing this to you.
Yea see the problem is that you are arguing under some implicit idea that you’ll just accept the results of the system.
Every single crypto property I’ve talked to has ended up at a point where they believes that someone cheated them outside the bounds of the system and then look to authority figures to rectify the situation, like the government.
If you are someone who actually believes that crypto transactions should be unmodifiable by any third party then what you said makes sense. I just don’t think that anyone telling me they believe that isn’t lying to themselves at best, and lying to everyone else at worst
Every single crypto property I’ve talked to has ended up at a point where they believes that someone cheated them outside the bounds of the system and then look to authority figures to rectify the situation, like the government.
If you are someone who actually believes that crypto transactions should be unmodifiable by any third party then what you said makes sense. I just don’t think that anyone telling me they believe that isn’t lying to themselves at best, and lying to everyone else at worst
> unmodifiable by any third party then what you said makes sense.
You are right, I do. The same reason I don't think the cryptocurrency is for everyone. And the reason I accept this, is because "traditional institutions" still can be "easily" gamed: enough cases of social engineering around to be considered a norm. Where law enforcement won't try enough or can't do enough to return the money transferred to a hostile account. Following this, if someone smart enough to avoid the banking scams, they are probably smart enough to manage their own wallet safely.
You are right, I do. The same reason I don't think the cryptocurrency is for everyone. And the reason I accept this, is because "traditional institutions" still can be "easily" gamed: enough cases of social engineering around to be considered a norm. Where law enforcement won't try enough or can't do enough to return the money transferred to a hostile account. Following this, if someone smart enough to avoid the banking scams, they are probably smart enough to manage their own wallet safely.
As others have said, it has nothing to do with crypto, it is an exchange problem, and a government intervention problem.
Spherical cow in a vacuum
As I understand, the root of the problem is that Coinbase kept lot of sensitive information, including photos of IDs. If Coinbase was fully anonymous, and didn't require any KYC, the impact of the leak would be insignificant because it would be difficult to link user number 12345 with some real-world person.
So if we want to constrain impact of such attacks, we must make companies keep less data and delete them faster. For example, instead of storing a photo of ID, store just a checkbox that the person showed their ID and it was valid.
This applies not only to cryptocurrency, but to any company like Google, Uber, Amazon etc - if they didn't keep extra data, there would be little value in the leaks.
So the blame is not at cryptocurrency, but on companies not wishing to delete the data and governments demanding them to collect the data not necessary for operation. It's the government and capitalists who create problems out of nowhere.
So if we want to constrain impact of such attacks, we must make companies keep less data and delete them faster. For example, instead of storing a photo of ID, store just a checkbox that the person showed their ID and it was valid.
This applies not only to cryptocurrency, but to any company like Google, Uber, Amazon etc - if they didn't keep extra data, there would be little value in the leaks.
So the blame is not at cryptocurrency, but on companies not wishing to delete the data and governments demanding them to collect the data not necessary for operation. It's the government and capitalists who create problems out of nowhere.
> store just a checkbox that the person showed their ID and it was valid.
Doesn't work at scale. You get bribes, rogue employees, socially engineered employees. In the US, look up the articles about phone/SIM unlocks and SIM card copies. Russia has a problem with e-signatures, that most people have no idea about. It's possible to sell somebody's real estate with one of these. Loans granted just based on passport data. Neither politics nor media highlight these issues. Overall in this case your suggestion tries to handle the symptoms of the KYC requirement.
Here's a more extreme treatment: let people change their full legal name at will. Gender's already kinda possible.
Doesn't work at scale. You get bribes, rogue employees, socially engineered employees. In the US, look up the articles about phone/SIM unlocks and SIM card copies. Russia has a problem with e-signatures, that most people have no idea about. It's possible to sell somebody's real estate with one of these. Loans granted just based on passport data. Neither politics nor media highlight these issues. Overall in this case your suggestion tries to handle the symptoms of the KYC requirement.
Here's a more extreme treatment: let people change their full legal name at will. Gender's already kinda possible.
In Russia one can change their name, although it is a lot of pain as you need to change it in all agreements (like bank agreement) and documents. So a better idea is simply not store customer names.
This is an exchange problem, not a crypto problem. You don’t need an exchange to hold crypto.
You need an exchange to do some core things that people want to use cryptocurrencies for.
It may not be a crypto-as-a-theoretically/ideologically-pure-construct problem, but it absolutely is a crypto-as-a-real-world-asset problem.
It may not be a crypto-as-a-theoretically/ideologically-pure-construct problem, but it absolutely is a crypto-as-a-real-world-asset problem.
But they need exchanges to get real money to flow in and out of cryptocurrency easily. Without it, cryptocurrency by itself would likely be worth far less than it is today.
Yes that's true, but no need to hold your crypto there as a permanent storage. Once your fiat is exchanged to crypto, immediately transfer the crypto to your private wallet.
This just trades the unsolved exchange hacking problem for the unsolved lost/stolen keys problem.
That problem is trivially solved by backups.
Backups don't solve seed phrase phishing for example.
As opposed to the bank's ...? Or your other account's ..., what exactly, passwords? Phising is everywhere. How many times have you heard the elderly have their money stolen, both online and in real life? It happened to my grandma. The mailman is bringing her own pension as cash, and guess what, he has scammed my grandma for years! The food delivery guy who has been delivering lunch for my grandma, guess what he did? He scammed my grandma out of her money! We are talking about cash, right now, and no phising involved, just good old "lying".
Hence why cryptocurrency would never replace regular banks for regular people. The situation with scams and thefts has only gotten worse. Not your keys, not your coin.
I definitely cannot imagine my grandma making use of crypto, or PayPal, or her bank's online site. :)
[deleted]
Theft or loss has always been a problem since life evolved on Earth.
I don't think anyone claimed that crypto was un-losable or un-stealable. It's not magic.
https://cryptosteel.com
I don't think anyone claimed that crypto was un-losable or un-stealable. It's not magic.
https://cryptosteel.com
[deleted]
Yes, I think I’m familiar with the crypto enthusiasts defenses that all boil down to looking at a single aspect of their system in a vacuum and not realizing that if anyone wants to functionally use crypto as a currency and not as a speculative asset or tool in crime, then all these aspects actually have to work and work together
I don't really care about crypto personally (volatile shitcoins) but I think that's a straw man argument. They all know it gets troublesome when it comes to dealing with fiat transactions. The hardcore crypto enthusiasts want to avoid fiat entirely.
If only hardcore crypto enthusiasts who didn't want any fiat had cryptocurrency bitcoin would be worth a couple dollars a piece and 99% of other cryptocurrencies wouldn't exist. The vast vast majority of people who have crypto are doing it because they think they can get rich from it and that's why anytime it's talked about it's talked about in terms of fiat values
[deleted]
Is there anything crypto does that paper currency doesn’t?
Paper currency can be devalued by the government by printing lot of paper (this has happened many times in our history). Cryptocurrency cannot.
Is there anything crypto does that paper currency doesn’t?
Gets you the equivalent of mugged by people on the other side of the planet?
At least with cash, it's a one-on-one involuntary transaction.
Gets you the equivalent of mugged by people on the other side of the planet?
At least with cash, it's a one-on-one involuntary transaction.
Yes, electronic transfer.
Come on, if you’re going to copy someone else’s snark, pick a good one.
Come on, if you’re going to copy someone else’s snark, pick a good one.
"Cryptocurrency" is a misnomer, because none of them are actual currencies.
Cryptocurrencies are classified, for now, as securities.
Currency is currency and cryptocurrency is not. So please do not attempt to compare apples to oranges here.
https://en.wikipedia.org/wiki/Security_(finance)
If you wish to compare cryptosecurities to other securities, then do that, but don't try to act like it is some sort of future utopian currency.
Cryptocurrencies are classified, for now, as securities.
Currency is currency and cryptocurrency is not. So please do not attempt to compare apples to oranges here.
https://en.wikipedia.org/wiki/Security_(finance)
If you wish to compare cryptosecurities to other securities, then do that, but don't try to act like it is some sort of future utopian currency.
Cryptocurrencies are not classified as securities. Bitcoin and Ethereum, the largest cryptocurrencies, were both declared as non securities by the SEC.
Beyond the regulatory-dodge and crypto marketing explain to me how Coinbase is NOT a bank
Well, right now they’re applying for a charter which suggests they don’t think they’re a bank, but I can think of some other reasons, too.
I mean this isn't the criteria you're looking for but I can trade assets within coinbase's website. It looks like a stock trading platform. I don't for the record.
I don't think commodity, forex or stock trading is built into any bank interface but I don't have enough money to know for sure.
So it's different in that way I guess.
I don't think commodity, forex or stock trading is built into any bank interface but I don't have enough money to know for sure.
So it's different in that way I guess.
lol they even do fractional reserve things like banks, except they're more shady and don't acknowledge it, now I'm either connecting dots that shouldn't be connected or some withdrawal locks that happened through some big arbitrage opportunities were very suspicious.
Correct. Coinbase is a bank that holds cryptocurrency.
And OpenSea is a zoo that holds apes.
> The only solution here is: hardware 2 factor like yubikeys.
And when that’s lost, what do you do? Aren’t you back to account recovery step?
And when that’s lost, what do you do? Aren’t you back to account recovery step?
Then you send your iris scan to sama
If you ever sent money to or from a wallet you control, I'd think a reliable recovery factor would be to use that key to sign a message that Coinbase can verify with the address in their records. Cryptocurrency after all is just another PKI.
And dumb-dumb me just realized how trivial that would be to break. Social engineer someone into sending/receiving money to/from your wallet then pretend to be them requesting an account recovery.
Coinbase would have to make you sign a challenge ahead of time that would mark the wallet as the authorized public key for your account.
Coinbase would have to make you sign a challenge ahead of time that would mark the wallet as the authorized public key for your account.
The the data that would be used to do account recovery is 99% either public record or already part of dozens of prior major data breaches.
> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted
People getting locked out of their account (which can happen due to no fault of the user, e.g. by an overly nervous risk system) will be really happy to have to potentially travel to a different city to regain account access...
People getting locked out of their account (which can happen due to no fault of the user, e.g. by an overly nervous risk system) will be really happy to have to potentially travel to a different city to regain account access...
I would be very happy to do this.
Fine, make it optional. I actually would love a version of cold storage that is: never release this money unless I personally travel to an office if NYC and authorize it.
Fine, make it optional. I actually would love a version of cold storage that is: never release this money unless I personally travel to an office if NYC and authorize it.
Just buy sone gold bars, and bury them in your yard.
Extremely vulnerable to rubber hose attacks.
[deleted]
I'd imagine that anyone who's sophisticated enough to use a yubikey would just buy a hardware wallet and self custody.
> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted
Is this satire?
Is this satire?
I tried to reach out to coinbase customer support to see if I was impacted. Once I wasted my time with the AI bot and got a human they were unaware of the breach. I was the first person to inform them about it.
They emailed impacted accounts. Source: I was impacted
Not sure what to say about that, I had an account with them, but I couldn't verify it, had email, phone and could be some sort of ID scanned - don't remember. Haven't used the account ever since and had nothing there, since January I have been getting regularly calls about my account being "compromised". This leak probably happened way earlier, because there was no way someone knew I had an account there and knew exactly the email I had with them.
I don't believe they did, and I also believe they have known about this issue for a long time, and they should have been required to disclose their mandatory 8k a lot earlier.
Was this the general "Important Notice" email that went out this morning, or something more specific.
The "Important Notice" I got says "This included information related to your account". Also I got an email earlier on April 1 about a breach that sounds very similar if it's not the same one.
Sorry to pester, that exact wording?
I see "We wanted to let you know that we detected activity suggesting that information related to your account may have been accessed in a way that did not align with our internal policies." in the email i got this morning
I see "We wanted to let you know that we detected activity suggesting that information related to your account may have been accessed in a way that did not align with our internal policies." in the email i got this morning
What was the title of the email? I got a generic looking email at 7AM EST this morning describing the breach.
You were read "Wow we didnt know about it, you are the first person talking about it to me" script line.
Maybe the actual first person got unlucky with a lazy customer support agent.
And the reason Coinbase has to keep all that sensitive stuff, much more than what would be required to identify and authenticate you, which you hope will never be stolen, is because of know your customer laws, so you can thank your government that pictures of your passport got stolen and for whatever criminals and rogue Coinbase employees do with that info.
There are very good reasons for KYC, the problem here is not the government regulation, it's once again private companies being sloppy with their customer's data because sloppy is cheap and it's not their info on the line, it's yours, so there's little motivation for them to safeguard it _unless_ they're compelled to do it by law.
The people who designed a government regulation to deputize private companies couldn't possibly have known how sloppy private companies are with other people's data?
They could have designed KYC to minimize long-term storage requirements etc at some cost to what they could enforce, but a government like the US is inherently sloppy with the rights that are reserved for parties besides itself.
They could have designed KYC to minimize long-term storage requirements etc at some cost to what they could enforce, but a government like the US is inherently sloppy with the rights that are reserved for parties besides itself.
I think if I coloured it as [gov't] deputizing [companies], and prioritized financial banks not knowing their customers, in case they decide they get hacked, I could sort of get excited about blaming regulation.
At the end of the day it'd be hard for me to continue holding that because, on the balance, we expect companies to keep data private and to not enable illegal activity, not gov't to avoid asking companies to do things, lest they screw up.
At the end of the day it'd be hard for me to continue holding that because, on the balance, we expect companies to keep data private and to not enable illegal activity, not gov't to avoid asking companies to do things, lest they screw up.
This is costing Coinbase $400M. They are well incentivized to prevent this.
In formal logic we would call this kind of argument a "post hoc justification". Any company who does anything payments-related is going to be primarily motivated to allow the most amount of transactions possible (including risky ones), everything else is a secondary consideration (including data security). I mean think about it, even if your company has a data breech, it's primarily brand reputation that's on the line, at that point your money has already been made. Of course, now that damage has been done there is a motivation to prevent it from happening in the future, but for companies like Coinbase who operate in emerging markets with little regulatory oversight, it's extremely hard to argue that they have are motivated to do anything besides grow and make money. After all, the mantra has always been "move fast and break things".
Well their stock is up 6bn today
They're not just another free-to-use site where you're the product. Their reputation and viability are on the line.
For a site such as this the odds aren't in their favor anymore.
For a site such as this the odds aren't in their favor anymore.
> And the reason Coinbase has to keep all that sensitive stuff, much more than what would be required to identify and authenticate you, which you hope will never be stolen, is because of know your customer laws
Real cop out here, be honest. Why should every single agent have access to your identity documentation (which is only required for KYC) in perpetuity?
Real cop out here, be honest. Why should every single agent have access to your identity documentation (which is only required for KYC) in perpetuity?
Coinbase seems to be going to great lengths to try and distance themselves from the so-called "rogue overseas support agents".
If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom.
Reimbursing duped customers makes sense, as it seems like they would have a pretty straightforward case to make in court that Coinbase's actions led to their loss.
I'm more curious if someone who feels the need to move, change banks, change their email, hire a security detail etc. could successfully sue the company to recover some or all of those costs.
If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom.
Reimbursing duped customers makes sense, as it seems like they would have a pretty straightforward case to make in court that Coinbase's actions led to their loss.
I'm more curious if someone who feels the need to move, change banks, change their email, hire a security detail etc. could successfully sue the company to recover some or all of those costs.
>If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom.
This seems like a strange interpretation. If an employee at your company, against policy and likely illegally extracts proprietary data and gives it to hackers in exchange for money you can hardly say that "My company sold it's data".
This seems like a strange interpretation. If an employee at your company, against policy and likely illegally extracts proprietary data and gives it to hackers in exchange for money you can hardly say that "My company sold it's data".
I agree it wasn't authorized, but I should absolutely still be able to hold the company responsible for the damage. My business relationship is with you, not your employees or vendors.
They in turn could go after the perpetrator. If they're using contractors who are cheap, unvetted, untrustworthy or don't carry liability insurance that's their problem and shouldn't excuse them of accountability.
They in turn could go after the perpetrator. If they're using contractors who are cheap, unvetted, untrustworthy or don't carry liability insurance that's their problem and shouldn't excuse them of accountability.
I'm not up to date on Tort law but it does seem likely the company has some liability here. I still think it's wrong to say the company did the thing. Someone employed by the company did it of their own volition. The company just gave them the ability to do the thing.
In a way you can. A company is its employees. If you want employees with integrity you might need to pay better than bottom dollar employees from the cheapest countries possible.
I once applied for a bank position, and they wanted to run a credit check. If you're in a position of handling money, the company has a responsibility to vet its employees. Do I agree with credit checks? Absolutely not, but the point is, Coinbase is partially responsible and that's why they're refunding duped customers.
How far that responsibility goes is up for debate.
I once applied for a bank position, and they wanted to run a credit check. If you're in a position of handling money, the company has a responsibility to vet its employees. Do I agree with credit checks? Absolutely not, but the point is, Coinbase is partially responsible and that's why they're refunding duped customers.
How far that responsibility goes is up for debate.
> This seems like a strange interpretation. If an employee at your company, against policy and likely illegally extracts proprietary data and gives it to hackers in exchange for money you can hardly say that "My company sold it's data".
When an employee ships a new feature, do you say "My company shipped a new feature?"
When an employee ships a new feature, do you say "My company shipped a new feature?"
Did the employee ship the feature this against their employer's will? 'Cause if so, I'm not sure we would say the company shipped it.
If an Amazon Delivery driver murders someone in their home while working would we say "Amazon Murdered an Old Lady" ?
? No...we wouldn't. No US paper would use that headline, anyway. Maybe it's different in other countries.
Blog post is here:
https://www.coinbase.com/blog/protecting-our-customers-stand...
> We will reimburse customers who were tricked into sending funds to the attacker due to social engineering attacks. If your data was accessed, you have already received an email from [email protected]; all notifications went out at 7:20 a.m. ET on 5/15 to affected customers.
https://www.coinbase.com/blog/protecting-our-customers-stand...
> We will reimburse customers who were tricked into sending funds to the attacker due to social engineering attacks. If your data was accessed, you have already received an email from [email protected]; all notifications went out at 7:20 a.m. ET on 5/15 to affected customers.
The no-reply is an interesting decision. I get how difficult it is to run a company like Coinbase (their biggest strength, centralized + customer support, is also what enables this social engineering), but feels like an odd choice.
no-reply is a good practice. No business should ever encourage their customers to reply to the emails they are sending out. That's what scammers do.
To contact the company you should go to company website at the address you know (which shouldn't be given in email as well), log in and send a message through internal message system, possibly referring to the email that you recieved through a random code (those can be auto-suggested if they recently tried to contact you by email).
If you do anything else your communication knwowingly mimics communication of a scammer.
Unrequested email should always only be one way communication. Email is too untrustworthy for it to be anything more.
To contact the company you should go to company website at the address you know (which shouldn't be given in email as well), log in and send a message through internal message system, possibly referring to the email that you recieved through a random code (those can be auto-suggested if they recently tried to contact you by email).
If you do anything else your communication knwowingly mimics communication of a scammer.
Unrequested email should always only be one way communication. Email is too untrustworthy for it to be anything more.
> No business should ever encourage their customers to reply to the emails they are sending out.
It’s fascinating that we keep creating new technology and then find out that in practice most of it cannot be trusted. Which means it cannot be used for anything serious.
IT revolution is a bit of a failure
It’s fascinating that we keep creating new technology and then find out that in practice most of it cannot be trusted. Which means it cannot be used for anything serious.
IT revolution is a bit of a failure
The first "email" was sent in the 1971 and SMTP was designed in 1983. Back then the implementers didn't dream of the adoption levels of these protocols that we see today. Your same complaint could be levied against the best practices for phone calls in order to avoid scams, and that's also a slightly older technology.
Some of these technologies that have been mass adopted because they're easily accessible also have glaring security holes and ways to be exploited built into them. It's a tale as old as time, and I can hardly blame businesses in this specific case (using no-reply addresses.)
Some of these technologies that have been mass adopted because they're easily accessible also have glaring security holes and ways to be exploited built into them. It's a tale as old as time, and I can hardly blame businesses in this specific case (using no-reply addresses.)
Their "customer support" includes not expecting users to set up PGP to communicate with them. Email is not a secure method of communication by default.
It's fine to send a notification instructing them to visit the secure portal for more info, though. Hence, no-reply.
It's fine to send a notification instructing them to visit the secure portal for more info, though. Hence, no-reply.
Yeah, I totally understand it!
[deleted]
> No passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched.
I'm curious why no Coinbase Prime accounts were part of the leak (assuming that's what they mean). Is there some sort of additional layer of data protection behind the Coinbase Prime paywall? Or perhaps those accounts were intentionally avoided as they would presumably belong to more savvy users.
I'm curious why no Coinbase Prime accounts were part of the leak (assuming that's what they mean). Is there some sort of additional layer of data protection behind the Coinbase Prime paywall? Or perhaps those accounts were intentionally avoided as they would presumably belong to more savvy users.
Coinbase Prime is its own exchange with its own support (actual humans in the USA that are available to chat to). It's for "institutional investors" so unavailable to most customers without the proper credentials/paperwork. They don't share the same outsourced "support" as the regular exchange, which appears to be the attack vector here.
> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities
Based on the information present in the breach, I think it's likely that the source was their customer support in the Philippines. Monthly salary is usually < 1000$/month (entry-level probably even less than 500$) and a 5000$ bribe could be more than a year worth of money, tax-free. Considering the money you can make with that dataset now, this is just a small investment.
> •Name, address, phone, and email; •Masked Social Security (last 4 digits only); •Masked bank-account numbers and some bank account identifiers; •Government‑ID images (e.g., driver’s license, passport); •Account data (balance snapshots and transaction history); and •Limited corporate data (including documents, training material, and communications available to support agents).
This is every threat actor's dream. Even if you only had email addresses and account balances, this is a nightmare. Instead of blackmailing the company, you can now blackmail each individual user. "Send me 50% of your BTC and I won't publish all of your information on the internet". My guess is that we will have a similar situation like we had with the Vastaamo data breach...
https://en.wikipedia.org/wiki/Vastaamo_data_breach
Based on the information present in the breach, I think it's likely that the source was their customer support in the Philippines. Monthly salary is usually < 1000$/month (entry-level probably even less than 500$) and a 5000$ bribe could be more than a year worth of money, tax-free. Considering the money you can make with that dataset now, this is just a small investment.
> •Name, address, phone, and email; •Masked Social Security (last 4 digits only); •Masked bank-account numbers and some bank account identifiers; •Government‑ID images (e.g., driver’s license, passport); •Account data (balance snapshots and transaction history); and •Limited corporate data (including documents, training material, and communications available to support agents).
This is every threat actor's dream. Even if you only had email addresses and account balances, this is a nightmare. Instead of blackmailing the company, you can now blackmail each individual user. "Send me 50% of your BTC and I won't publish all of your information on the internet". My guess is that we will have a similar situation like we had with the Vastaamo data breach...
https://en.wikipedia.org/wiki/Vastaamo_data_breach
> •Name, address, phone, and email;\
> blackmail each individual user
Blackmail would be the least of my worries, in France we had at least five kidnappings/attempted kidnappings related to crypto investors since the beginning of the year.
> blackmail each individual user
Blackmail would be the least of my worries, in France we had at least five kidnappings/attempted kidnappings related to crypto investors since the beginning of the year.
And more than one finger sent in the post.
Yes that's true but it's weird they only focus on crypto investors' families? There are many rich people in France, what's the deal with cryptobros?
Crypto is advertised as providing irreversible transfers, and having ownership of assets solely established by ownership of keys. It shouldn't be surprising that such features would attract criminals.
You can easily establish the connection from a bank account to a person. A connection from a crypto wallet to a person is extremely difficult.
Money laundering with crypto is also much easier (and cheaper usually).
In the vast majority of cases, it's actually extremely easy. It took less than an afternoon for me to learn how to trace 90%+ of transactions on either BTC or any of the networks built on Ethereum or an Ethereum-like protocol. There are large companies that specialize in exactly this, which make tools that allow government agents who have no particular crypto expertise to trace the majority of transactions.
It is possible to make your transactions extremely difficult to trace, but you really, really, REALLY have to know what you're doing.
Law enforcement loves that people think it's easy and cheap to launder money with crypto, though. It's made it vastly easier for them to catch those people!
It is possible to make your transactions extremely difficult to trace, but you really, really, REALLY have to know what you're doing.
Law enforcement loves that people think it's easy and cheap to launder money with crypto, though. It's made it vastly easier for them to catch those people!
I never doubted that it's possible but it's way harder than identifying bank accounts.
There is a massive business behind crypto tracking, that's why companies like MasterCard have acquired CipherTrace. Some years ago there was a really good article / case study from them. I think it was related to a ransomware gang and they were able to identify the threat actor's wallets through crypto tumblers and chain hopping.
It's just a matter of how much money and time are you willing to invest into finding out and not a matter of possibility.
You can trace the BTC or Ethereal transaction of coins, but you cannot trace the criminals after it's converted to Monero or some other "privacy" chain on an exchange run on the dark web. After that you're just tracing other owners, possibly who have no idea where that it was stolen. It literally takes a few hours to wash it all out.
It’s harder but not totally impossible with the traditional banking system. https://en.m.wikipedia.org/wiki/Bangladesh_Bank_robbery
Because it's easier to move crypto than physical cash.
Guessing their profits are regularly illegal or untaxed, so they're less likely to involve the police.
Seems unlikely given who has been targeted. I doubt the Ledger or Paymium guys have been evading tax on crypto given that they're publicly involved in it and likely would be scrutinised more than the average person by tax authorities.
It's easier and faster to send the money without having to go to the bank.
This may seem callous, but isn't a large point of crypto that you are 'free' from the shackles imposed by the State?
And I guess that includes protection from criminals by the oppressive forces of the State (aka the police). In which case being kidnapped and having your fingers sent to your family is an integral part of your 'freedom'.
And I guess that includes protection from criminals by the oppressive forces of the State (aka the police). In which case being kidnapped and having your fingers sent to your family is an integral part of your 'freedom'.
Crypto isn’t synonymous with anarchy, just like the internet isn’t synonymous with pornography. Both are cliches from long ago.
All of the victims are likely tax payers. Law and order is a fundamental service that a legitimate state must provide to all in its jurisdiction, even those who are only resident non-citizens and those that pay little to no taxes in a progressive tax system.
All of the victims are likely tax payers. Law and order is a fundamental service that a legitimate state must provide to all in its jurisdiction, even those who are only resident non-citizens and those that pay little to no taxes in a progressive tax system.
> Crypto isn’t synonymous with anarchy, just like the internet isn’t synonymous with pornography. Both are cliches from long ago.
Saying crypto isn’t synonymous with anarchy, like the internet isn’t with pornography, sidesteps the point. Pornography is just one use of the internet — not its central purpose.
But crypto wasn’t just built to host financial activity — it was designed to restructure it, removing reliance on central authorities. That core intent isn’t a cliché; it’s a defining feature.
Comparing it to incidental internet content is a rhetorical deflection, not a real counterpoint.
Saying crypto isn’t synonymous with anarchy, like the internet isn’t with pornography, sidesteps the point. Pornography is just one use of the internet — not its central purpose.
But crypto wasn’t just built to host financial activity — it was designed to restructure it, removing reliance on central authorities. That core intent isn’t a cliché; it’s a defining feature.
Comparing it to incidental internet content is a rhetorical deflection, not a real counterpoint.
That's not what it was designed for, that's just a mixture of propaganda and confusion.
It was designed to solve the double-spending problem with digital currencies, replacing the need for "a authoritative ledger" with a one difficult to forge.
The political project around this was to provide people with a deflationary currency akin to gold, whose inflation could not be controlled by government.
The lack of government control over the inflation of this particular currency, and the lack of an authoritative ledger, are an extremely minimal sense of currency protections (, freedoms). They have as much to do with anarchy as the internet had with porn.
It was designed to solve the double-spending problem with digital currencies, replacing the need for "a authoritative ledger" with a one difficult to forge.
The political project around this was to provide people with a deflationary currency akin to gold, whose inflation could not be controlled by government.
The lack of government control over the inflation of this particular currency, and the lack of an authoritative ledger, are an extremely minimal sense of currency protections (, freedoms). They have as much to do with anarchy as the internet had with porn.
It was designed to avoid the need for existing financial institutions. The doublespend problem was merely the blocker that prevented people from otherwise doing it.
> A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution.
> A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution.
That's not anarchy though, that's paypal c. yr 2000
Your point is merely a non sequitur: a change in banking isn’t related to paying taxes or the state as a whole, nor anarchy.
You’re not supporting your central thesis that disintermediating finance is in any way related to removing government — and people using Coinbase, a service that is centralized and does collaborate with government regulation seems to directly counter your stereotype of the customers.
Their point is correct: people who match your fantasy wouldn’t be Coinbase customers — you’re relying on old tropes.
You’re not supporting your central thesis that disintermediating finance is in any way related to removing government — and people using Coinbase, a service that is centralized and does collaborate with government regulation seems to directly counter your stereotype of the customers.
Their point is correct: people who match your fantasy wouldn’t be Coinbase customers — you’re relying on old tropes.
Most (developed states at least) don’t claim the monetary system as a taxation medium. Debasement of currency is a bug not a feature. In the US, you are not required to process your transaction in USD but only need it to pay taxes.
Failed countries (ie: Turkey) rely on the financial system for taxation. Functioning countries shouldn’t care or be bothered by it.
Failed countries (ie: Turkey) rely on the financial system for taxation. Functioning countries shouldn’t care or be bothered by it.
It seems that law-abiding citizens often bear the greatest risk by declaring their assets to tax authorities and relying on so-called "trusted custodians" for savings. Ironically, for many, the safest course of action is likely non-disclosure, though this is, of course, illegal in much of the world.
I only have to declare crypto < 1 year in my holding which means that, while technically illegal to buy 1 second after the new tax year start and not declaring it, in practice, obviously, no-one cares about that. Especially as crypto is not a 1 second buy; it can take hours.
This may be surprising, but I actually don't think opting for a payment method with less consumer protections (that I pay cap gains tax on when if I dispose of it for a profit) is me ceding my right to be protected by the police. You're right that it does seem extremely callous and is honestly a disturbing mindset to have. Hopefully you never experience terror like the victims of the last few months in France experienced in your life.
> You're right that it does seem extremely callous and is honestly a disturbing mindset to have. Hopefully you never experience terror like the victims of the last few months in France experienced in your life.
Thanks for the tone-policing. But instead of implicitly suggesting that my mindset or tone is inappropriate, it would be great if we discussed the substance of the points.
Thanks for the tone-policing. But instead of implicitly suggesting that my mindset or tone is inappropriate, it would be great if we discussed the substance of the points.
> it would be great if we discussed the substance of the points.
Sure, just read the sentence from my response that you skipped over.
To be clear: I didn't implicitly suggest that your mindset of people who use crypto somehow ceding their right to protection from the state was inappropriate, I stated outright that it was a disturbing and callous mindset.
It's like suggesting that people who protest against police brutality shouldn't get protection from the police in emergency situations, or believe people who are racist to healthcare workers should lose all right to healthcare. The type of mindset held by those who care more about retribution against those who hold different views than a just society.
Sure, just read the sentence from my response that you skipped over.
To be clear: I didn't implicitly suggest that your mindset of people who use crypto somehow ceding their right to protection from the state was inappropriate, I stated outright that it was a disturbing and callous mindset.
It's like suggesting that people who protest against police brutality shouldn't get protection from the police in emergency situations, or believe people who are racist to healthcare workers should lose all right to healthcare. The type of mindset held by those who care more about retribution against those who hold different views than a just society.
You can argue that once you are 'free' to own guns, defend yourself, and seek revenge. The state limits your ability to protect yourself, so it has to assume that responsibility.
The persons in France probably paid their taxes. So no, your premise is wrong in that the state will help vs. in a crypto no-tax world. Actually the de-jour crypto paradise didn’t have any kidnappings so far and you don’t have to pay taxes either.
> isn't a large point of crypto that you are 'free' from the shackles imposed by the State?
That's what people say, but it's probably not true given everyone leaves their coins on exchanges.
That's what people say, but it's probably not true given everyone leaves their coins on exchanges.
It's simply about separating money and state. It's imperative that this happens.
The state takes a flat 30% tax on capital gains regardless of the source, I'd say they paid their fair share
Depends on if they cashed out and how they did it. There was a big trend for a while to go live in Portugal for a while, enough to be considered a tax resident there, and then cash out there because (at the time, idk if it's still true), they had no (or little) tax on crypto cash out.
Yeah, I know two French people who did it (one of them avoided UK taxes as he was paid in crypto while working in the UK, the other it's muddier). I know three people in the space, and only those two were on the financial side, so to me, while Blockchain is still a legit tech, anybody using cryptocurrency I peg as a tax evader.
Good thing we have courts, lawyers and judges for that. It’s funny everyone here hates on Trump but as soon as something align with their view, they want a defacto no due process application.
Sorry if i implied anything, i must have missed part of the conversation, i was just confirming that did happen (taking the portugese residency to avoid crypto tax) a few years ago. In my opinion, police should protect even violent criminals from violence when possible, so of course i'm not advocating for anything to happen on tax "avoiders", and they should be protected. I was just stating that i know people in the crypto space, and if you are, i immediately peg you as a small-time sociopath from my past experience.
Also i don't care about them getting judged for tax evasion, i know they won't be and honestly, good for them. I also don't care for nonviolent thieves and think the same thing about them. Profiteering was not how i was raised, but i understand different people have different standards (and parents, luckily mine are great, it's not the case for everybody). People do what they need to do, i found some comportment sociopathic, but as long as it is nonviolent, i'm not mad.
Also i don't care about them getting judged for tax evasion, i know they won't be and honestly, good for them. I also don't care for nonviolent thieves and think the same thing about them. Profiteering was not how i was raised, but i understand different people have different standards (and parents, luckily mine are great, it's not the case for everybody). People do what they need to do, i found some comportment sociopathic, but as long as it is nonviolent, i'm not mad.
Which state are you talking about? The 0% tax bracket for long-term capital gains in the U.S. for 2024 for single filers was $47,024, never mind the standard deduction. Then it goes up to 15%, then 20%.
It way worse. The US companies, pay $3-$6 per hour to outsource their support to the Philippines. The companies which provide the service have very high turnover rate. For some companies the employees stay on average about 6 months. There is absolutely no reason to be loyal.
We are getting zero government regulations on AI, no punishment data breaches, and no human protections against wide scale abuse. The opposite is happening.
I suspect to see America in chaos from these disruptions in the very near future.
I suspect to see America in chaos from these disruptions in the very near future.
Beyond the Philippines low wage, the point is that there is a price for "everybody" if it were in the US it will be a much higher price, and most probably paying for higher attack benefits.
Whatever you think of Coinbase, this is a pretty good response IMO:
> and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible
> and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible
No it isn’t! The headline they used is “Protecting Our Customers - Standing Up to Extortionists.” My issue with it is that they word their announcement in a way that leads people to congratulate them instead of saying we’re sorry for leaking your private information. I’m so angry at them over this.
Additionally the email they sent me had the subject “important notice” and that my personal account was affected as the third sentence in a rather wordy paragraph. None of this is ok and this is not a company taking this seriously.
Additionally the email they sent me had the subject “important notice” and that my personal account was affected as the third sentence in a rather wordy paragraph. None of this is ok and this is not a company taking this seriously.
That's the same move from the Ransom movie from 1996 https://youtu.be/haThIxPnYro?si=Jxu0elA-ylB5Z15q
I love it. This also would have been a great opportunity to break out of corporate speak for a moment for a good “Up yours hacker assholes!” Even us folks in the Bible Belt appreciate a well timed swear word here and there.
I’d say the better thing for customers would be to pay the ransom demand and get the PII back. If they want to fund a reward scheme too, well great, but if it were my data, I’d care more about Coinbase limiting the breach of the data, not playing around with retaliatory rewards.
There is no guarantee that an anonymous criminal is going to hold up their end of the agreement. Coinbase has no idea who they're negotiating with or where that data has been shared.
That, and they're reimbursing customers who were tricked.
That, and they're reimbursing customers who were tricked.
In addition, paying the ransom would be an open invitation for everybody else to try the same attack, with the net result that all customers are less secure in the long run.
Limiting? The damage is already done.
It's really unfortunate that KYC regulations required Coinbase to have this information in the first place. We should be establishing strong social norms against sharing PII without a legitimate reason; this is not just an individual theft risk but a national security risk. Coinbase doesn't pay into your Social Security account, so they shouldn't have your Social Security number. They don't visit your house, so they shouldn't have your address. Etc.
Historically, although KYC regulations were widespread in Communist countries, they were unthinkable in most democratic countries until 9/11, which provided spy agencies with their golden chance to write their wishlist into law. But unfortunately that helps foreign spy agencies just as much as, maybe more than, it helps domestic ones.
In https://en.wikipedia.org/wiki/Know_your_customer#Laws_by_cou... you can see when they were introduced in different countries.
Historically, although KYC regulations were widespread in Communist countries, they were unthinkable in most democratic countries until 9/11, which provided spy agencies with their golden chance to write their wishlist into law. But unfortunately that helps foreign spy agencies just as much as, maybe more than, it helps domestic ones.
In https://en.wikipedia.org/wiki/Know_your_customer#Laws_by_cou... you can see when they were introduced in different countries.
Let's hear you repeat this position after your Coinbase account is compromised and you're looking for recourse.
You seem to believe that AML/KYC regulation exists to benefit customers or to prevent or recover from account compromises. It does not, and I have no idea why you would think it does. Something like a Yubikey or iris-scanning stations could help to prevent Coinbase account compromises, but AML/KYC regulations do not require or even encourage them, though perhaps someday they will.
You... want to replace KYC with iris scanning stations?
It has real drawbacks, but I wasn't talking about what would be a good idea; I was talking about what would be a useful measure for preventing or recovering from account compromises. Iris scanning would be; KYC isn't.
That is know your eye, not know your customer.
Yeah I know eventually these will be linked by some data broker and will meld into the same thing.
But I compare it to using a fingerprint to unlock a password manager on your phone. That ain't KYC.
Yeah I know eventually these will be linked by some data broker and will meld into the same thing.
But I compare it to using a fingerprint to unlock a password manager on your phone. That ain't KYC.
We're not allowed to say this but hashed biometrics with proof of liveness is probably the strongest authentication.
> Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.
I’m not usually a huge fan of crypto folks, but I applaud this.
I hope they are serious about paying the reward, and aren’t planning to rug-pull it.
I’m not usually a huge fan of crypto folks, but I applaud this.
I hope they are serious about paying the reward, and aren’t planning to rug-pull it.
I hope they are serious about paying the reward, and aren’t planning to rug-pull it.
They could always pay it in crypto.
They could always pay it in crypto.
It might not be a bad idea for the various crypto exchanges to pool their resources into a non-denominational security organization. It could offer hardening services, and some kind of accreditation.
It would also make many Ponzi schemes easier to spot, as they wouldn’t want to contribute.
It would also make many Ponzi schemes easier to spot, as they wouldn’t want to contribute.
They make money selling the ponzi schemes, they don't want to make them easier to spot
> the Company has preliminarily estimated expenses to be within the range of approximately $180 million to $400 million relating to remediation costs
Hopefully companies take this as a lesson about bottom dollar outsourcing your CS.
For those amounts, they could afford to have hired regionally local support agents, and paid them well over industry standard...
Hopefully companies take this as a lesson about bottom dollar outsourcing your CS.
For those amounts, they could afford to have hired regionally local support agents, and paid them well over industry standard...
But do they consider it a CS risk or a business-wide risk? Is there any role at CoinBase that isn’t susceptible to insider risk? I would argue they would treat it as a security department / business risk issue and not a CS-only issue.
Onshoring CS and paying some more for that role may result in a net change of 0 risk (eg. The same possibility of a breach over the same time interval).
Would a lower class (for that region) Alabama man have less the susceptibility to insider risk as a middle class (for that region) Philippino man?
Most likely, the company will focus on better segmentation and better adherence to least permissions for all roles.
Also, your logic is clouded by the fact that you know it happened. In all aspects of security/cybersecurity, risk is incredibly difficult to calculate because you have to accurately know how much a counterfactual would cost in order to accurately choose one option over the other.
Onshoring CS and paying some more for that role may result in a net change of 0 risk (eg. The same possibility of a breach over the same time interval).
Would a lower class (for that region) Alabama man have less the susceptibility to insider risk as a middle class (for that region) Philippino man?
Most likely, the company will focus on better segmentation and better adherence to least permissions for all roles.
Also, your logic is clouded by the fact that you know it happened. In all aspects of security/cybersecurity, risk is incredibly difficult to calculate because you have to accurately know how much a counterfactual would cost in order to accurately choose one option over the other.
>Would a lower class (for that region) Alabama man have less the susceptibility to insider risk as a middle class (for that region) Philippino man?
The american could be facing jail time, depending on the data. The Philippino man, not so much.
The american could be facing jail time, depending on the data. The Philippino man, not so much.
The global trend is racing to the bottom, so even if they could, every business consultant or MBA would push them to rather put more AI agents instead. Because that's all what matters (to them). Did anybody learn anything out of this? Of course not.
HA! Good one. They won't.
The costs will likely be covered by insurance, which is hilariously cheap and also covers events you could never feasibly prepare for.
A few days ago I missed a delivery from UPS (in the UK). The next day I got a text from an unrecognised cell phone that just said “Hello” and didn’t respond further. The day after that I got a scam call (another UK cell number) from someone trying to hack into my Amazon account. They wanted me to supply the OTP code that Amazon texts you for 2FA. Anyway I eventually tracked down my package (it was at a convenience store awaiting pick up), and lo and behold they had printed my phone number along with name/address on the package. I suspect someone harvested that and passed it to the scammers (not necessarily a UPS employee, could be the drop off locations they contract with). I suppose I’ll report it to the police in the slim hope that it will help them catch the scammers.
Not sure how you relate your UPS delivery with the scam call? Just because it happened the following day you expected a delivery? I could be just a coincidence.
I'm sure scammer's got get your phone number from many other sources and data breaches.
I'm sure scammer's got get your phone number from many other sources and data breaches.
It could have been a coincidence, but I don’t receive deliveries often, and I don’t get scam calls often, so the timing and circumstances make it highly suspicious.
Why did those employees have access to such sensitive data? We could argue about the legal requirement to submit this data in general, but I really don't understand why (most of) this data isn't stored in an encrypted way and only accessible by a few people in the company.
Video response from Coinbase's CEO: https://x.com/brian_armstrong/status/1922967787309256807
[deleted]
neilv(1)
There should be an ISO standard with respect to how much power and information that front line customer support agents have. The more information you need, like changing passwords or accessing personal information, should get forwarded to higher level customer support agents with better training and more monitoring. This way you can design customer support experience with as little exposure to security issues as possible.
They main defense against internal attacks is bookkeeping. Banks have been dealing with this for thousands of years. I recommend the corresponding chapter in Security Engineering by Ross Anderson: https://www.cl.cam.ac.uk/archive/rja14/Papers/SEv3-ch12.pdf
Bookkeeping will alert you to employees stealing your money. It won't alert you to employees selling information.
Access logs do help with this. They have been successfully used by the police to identify rogue officers abusing their access to police databases.
> better training and more monitoring.
That’s very load-bearing. It won’t help.
The CS reps are based in a LCOL country so the opportunity for theft is simply incredibly lucrative.
What is really needed, is customer-in-the-loop for access to their data. The problem is, not all accesses would make sense. Doing analytics over the data of the top 1% of customers, for example, requires some level of access, but would freak out those customers if they had to approve it.
That’s very load-bearing. It won’t help.
The CS reps are based in a LCOL country so the opportunity for theft is simply incredibly lucrative.
What is really needed, is customer-in-the-loop for access to their data. The problem is, not all accesses would make sense. Doing analytics over the data of the top 1% of customers, for example, requires some level of access, but would freak out those customers if they had to approve it.
Compartmentalization is a very expensive customer support model.
So are $20M ransoms and the reputational damage from data breaches.
So this is probably why the phishing calls have increased from ~1 per month to ~3 per week.. good to know... Wish coinbase would let me DO something about it... Maybe fresh accounts for everyone? Maybe KYC data not directly linked to accounts? There should be SOMETHING they can do because the sheer volume of people constantly harassing CB customers is nuts.
> So this is probably why the phishing calls have increased from ~1 per month to ~3 per week.
Yes and their timeline doesn't add up with what they disclosed. If you take the Coinbase narrative, they only believed this was a 'material' issue once contacted by the hackers for a $20m demand, they weren't able to put the pieces together themselves.
The phishing has been elevated for weeks, especially via text message, and their lack of internal controls for access and monitoring are clearly severely lacking.
Yes and their timeline doesn't add up with what they disclosed. If you take the Coinbase narrative, they only believed this was a 'material' issue once contacted by the hackers for a $20m demand, they weren't able to put the pieces together themselves.
The phishing has been elevated for weeks, especially via text message, and their lack of internal controls for access and monitoring are clearly severely lacking.
When i get those calls, i usually tell them “why dont i just save everyones time and just give you my bank account number, password and social security number? That sound good?”
Forget relying on brokerages like COIN. If you care about the security of your digital assets, use a cold wallet or non-custodial account.
The comment you're replying to was complaining about scam calls, not about wallet security.
Using a hardware/"cold-ish" wallet does not protect you from scam calls: https://www.bleepingcomputer.com/news/security/physical-addr...
Using a hardware/"cold-ish" wallet does not protect you from scam calls: https://www.bleepingcomputer.com/news/security/physical-addr...
I'm having de ja vu here. If they only found out when they attempted to extort them does it mean they don't even bother to log employee access? Is there any means for accountability at all internally?
It would be so simple to have access tracking and flag or lock out rogue employees... I look forward to seeing what the golden parachutes look like.
It would be so simple to have access tracking and flag or lock out rogue employees... I look forward to seeing what the golden parachutes look like.
I built the admin panel used by internal employees and contractors at a major fintech payments processor (PCI Level 1). We had to add multiple levels of safety once we decided to hire a team outside of our US office including logging, monitoring and also rate-limiting (ask for manager to approve if more than 5 full details requests, etc.)
I think these requirements are much stringent due to PCI-DSS standards for credit card processors. I wonder if a lack of such standards in crypto makes the companies holding customer funds more lax.
Looking at their blog post, it seems like they paid customer support agents to hand over sensitive data. The attackers did not have access to any agent accounts themselves, and the customer service agents were accessing data they were already privileged to anyways.
https://www.coinbase.com/blog/protecting-our-customers-stand...
https://www.coinbase.com/blog/protecting-our-customers-stand...
The customer service agents were accessing data they were already privileged to anyways.
That's not how front line support agent access should work. You get access based on active cases you are working on, not the keys to the kingdom because you might need to support a member at some future point in time.
That's not how front line support agent access should work. You get access based on active cases you are working on, not the keys to the kingdom because you might need to support a member at some future point in time.
It makes me wonder what type of access support agents have in the first place. A lot of this information should require "unlocking" on a case-by-case basis by challenge/response while interacting with a customer.
Logging and retroactive auditing seems like the very least they should do. Even asking the customer service agent to first provide identifying details of the customer they can't easily know or guess by themselves doesn't seem excessive, given the sensitivity of the information.
It won't work for 100% of all calls (what if the customer is locked out themselves etc.), but those calls can then be handled by even more closely monitored agents.
"Less than 1% of monthly transacting customers" means up to 1% were accessed – that seems very high, i.e. much higher than the number of customer service contacts I'd expect.
It won't work for 100% of all calls (what if the customer is locked out themselves etc.), but those calls can then be handled by even more closely monitored agents.
"Less than 1% of monthly transacting customers" means up to 1% were accessed – that seems very high, i.e. much higher than the number of customer service contacts I'd expect.
The article says they sent an email, but I usually ignore emails from Coinbase. I hope there's going to be a better way to find out if your data was breached. I was locked out of my account before, and had to upload an ID. I thought they didn't store it... :o
Maybe it’s a naive question, but in many breach reports I see things like 'No passwords, private keys, or funds were exposed.' How come companies can usually protect that kind of data, but not emails, names, and other personal info?
Companies want the ability to use things like emails, names, and other data for user experiences (go to settings, see name and change it), advertising (target this address book for X ad), etc. So these are typically plaintext (oversimplified) and accessible by different systems while passwords or private keys have one use case only and can have a higher bar of protection.
A properly implemented login system will never store a password in the first place. Properly hashed passwords can still be cracked in some cases, but if your password is strong and the hash is good, it’s safe.
Such data is typically encrypted and purely write-only, only read by the system itself. Thus it is only exposed if the database itself is exposed. If the leak was compromise of the systems that access the data (which appears to be the case here--insiders copied data they could access) the write-only info is not exposed.
It was some BI/analyst database that leaked?
If you want to be alerted to new/updated SEC cybersecurity filings, you can subscribe to my free alerts [1] or see the full index of cybersecurity incidents [2] on my tracker (I check SEC EDGAR every 5 mins).
[1] https://www.board-cybersecurity.com/alerts/
[2] https://www.board-cybersecurity.com/incidents/tracker/
[1] https://www.board-cybersecurity.com/alerts/
[2] https://www.board-cybersecurity.com/incidents/tracker/
I’ve been getting scam texts from scammers who claimed my Coinbase account was compromised and to contact them. I wonder if this incident was the root cause
> recruited a group of rogue overseas support agents
Why not just say what country the are from and how they hired them to start with. It's presented as those sneaky "overseas" people that somehow got access to our systems. This company makes what, a few billions in revenue but they couldn't vet and hire the right people?
Why not just say what country the are from and how they hired them to start with. It's presented as those sneaky "overseas" people that somehow got access to our systems. This company makes what, a few billions in revenue but they couldn't vet and hire the right people?
Given how little customer support agents in cheaper countries are paid, i'm surprised this type of serious attack has not happened sooner.
Corruption in these countries is extremely common. We're used to having a government that actually works in western countries. In these cheaper countries, bribes are routine and almost unavoidable.
Given the culture of corruption and how little the support agents are paid, it was only a matter of time before some bad actor tried to bribe them. Medical bills are expensive and need to be paid, making the agents highly vulnerable to this type of attack.
For many, the choice would be to accept the bribe, or let their sick child suffer from a treatable condition.
Now that a high profile attack has happened, expect copycat attacks from other bad actors.
Corruption in these countries is extremely common. We're used to having a government that actually works in western countries. In these cheaper countries, bribes are routine and almost unavoidable.
Given the culture of corruption and how little the support agents are paid, it was only a matter of time before some bad actor tried to bribe them. Medical bills are expensive and need to be paid, making the agents highly vulnerable to this type of attack.
For many, the choice would be to accept the bribe, or let their sick child suffer from a treatable condition.
Now that a high profile attack has happened, expect copycat attacks from other bad actors.
[deleted]
It's ironic this came [out] the day after COIN is going to be added to the SP500.
And also the same day as it was reported the SEC is investigating Coinbase over claims it overstated user numbers in past filings (https://www.thestreet.com/crypto/policy/sec-is-investigating...).
It's been a bad day.
It's been a bad day.
As bad and annoying as this is, I do think “we won’t pay the ransom but set up a reward fund in the same amount to find the perps” is an interesting approach. It turns the tables such that any of the criminals or associates now are incentivized to turn on each other. I could see ways it wouldn’t work (they lie to get the reward, future scammers set up the scam with a patsy so they can collect reward), and am not sure it plays the same if there is actual exposed keys, etc.
Assuming they will have to inform the individuals who's data was actually breached/taken? Or is this basically the entire customer base? In which case that is VERY bad.
Their blog post says they notified affected users yesterday:
https://www.coinbase.com/blog/protecting-our-customers-stand...
https://www.coinbase.com/blog/protecting-our-customers-stand...
From the sounds of it, this is limited to US customers? Just going by the mention of social security number which does not exist in other countries like the UK.
>We will reimburse customers who were tricked into sending funds to the attacker.
How many people are going to anonymously attack themselves now, just to get a reimbursement!
How many people are going to anonymously attack themselves now, just to get a reimbursement!
Great timing: https://www.citationneeded.news/issue-84/
Just when it was included in S&P500 :(
Brian Armstrong (Coinbase CEO) posted a video about this today: https://x.com/brian_armstrong/status/1922967787309256807
"But customer support agents do have access to personal information like name, date of birth, address, et cetera"
Apparently "et cetera" includes photos of my ID? Why do they even keep it?
Apparently "et cetera" includes photos of my ID? Why do they even keep it?
The more alarming part for me is that, given the scale of the breach, there was clearly some way for this CS access to (a) query and download data from a database and (b) exfil that data in bulk. Where on earth were the controls?
They are required to by law (thanks to AML regulations).
I'm surprised they only demanded $20M. Surely that customer data is potentially worth, like, potentially orders-of-magnitude more.
Correspondingly I'd assume either a) paying the ransom doesn't take it off the market or b) the info they stole isn't that interesting.
Correspondingly I'd assume either a) paying the ransom doesn't take it off the market or b) the info they stole isn't that interesting.
They only stole 80000 emails (1% of their monthly active users) not the whole userlist
> less than 1% of Coinbase monthly transacting users
Unclear if users whose data was stolen, but did NOT transact in the last month are included in this statistic. Feels like a very intentional phrasing on their part
https://www.coinbase.com/en-gb/blog/protecting-our-customers...
Unclear if users whose data was stolen, but did NOT transact in the last month are included in this statistic. Feels like a very intentional phrasing on their part
https://www.coinbase.com/en-gb/blog/protecting-our-customers...
One more reason to ignore Coinbase’s weekly harassment email to update my information.
I wonder what percentage of Coinbase's (but also any other company storing PII data) support is done by AI at this point, and whether they could focus on and invest much more heavily to make that as close as possible to 100%.
Discussion forming (14 points, 8 comments) https://news.ycombinator.com/item?id=43994545
[deleted]
They've been constantly bugging me to upload my government ID, never did. Now I'm really glad I didn't.
[deleted]
"et cetera"
Interesting coincidence?
>On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection.
https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647...
>On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection.
https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647...
This should be illegal.
1 day after they were emailed.
Also, "Coinbase had detected the breach independently in previous months", aren't they required to disclose this? In the EU they are: Every EU institution must do this within 72 hours of becoming aware of the breach, where feasible
Also, "Coinbase had detected the breach independently in previous months", aren't they required to disclose this? In the EU they are: Every EU institution must do this within 72 hours of becoming aware of the breach, where feasible
The classic added arbitration clause after a massive breach. Happened with Sony and iirc Valve (through Steam) off the top of my head.
[deleted]
Hats off to the hackers for getting through to Coinbase support
Underappreciated comment.
[deleted]
From the Coinbase website:
https://www.coinbase.com/en-de/blog/protecting-our-customers...
https://www.coinbase.com/en-de/blog/protecting-our-customers...
What they got
- Name, address, phone, and email
- Masked Social Security (last 4 digits only)
- Masked bank‑account numbers and some bank account identifiers
- Government‑ID images (e.g., driver’s license, passport)
- Account data (balance snapshots and transaction history)
I also like 'last 4 digits only' as if that's not the most important parts and the part so many places use to validate your identity, the first 5 are just area and group so they're not exactly random.
Everyone's social security number is available. If you go download the leak referring to in this HN post [1], your SSN is certainly in it. Mine was, everyone in my family's was, almost all of my friends' were.
The world needs to stop pretending that SSNs are secret. They aren't.
[1] https://news.ycombinator.com/item?id=41248104
The world needs to stop pretending that SSNs are secret. They aren't.
[1] https://news.ycombinator.com/item?id=41248104
Does it require the skills of using powershell to open and search? I'm very curious but am not a coder, I do audio and graphic design. That being said I've copy pasted pieces of python, tailored it to my use and made it work.*
I'm just very curious to check for myself and my family.
*hah, here's me making it work https://www.youtube.com/watch?v=PMeRFnkHgBc&t=97s
I'm just very curious to check for myself and my family.
*hah, here's me making it work https://www.youtube.com/watch?v=PMeRFnkHgBc&t=97s
The world has stopped pretending a long time ago. In my country SSN is public information.
Ah, cool. My name, home address, phone number, social security number, and images of my drivers license and passport as well as what bank I use.
Spy agencies regulating financial institutions (really): https://news.ycombinator.com/item?id=43996848
Who else would verify the user passports if not the customer support staff? Who verifies (and photocopies! in Asia and Europe) your passport at a hotel or car rental office?
A separate KYC department that verifies identity then immediately deletes the images?
When was the last time your passport was copied in Europe?
I don't think that this is still legal under the GDPR.
I don't think that this is still legal under the GDPR.
All KYC processes require copying in Europe. There's nothing that's blanket illegal under GDPR. If you have consent you can collect and store whatever you want.
It's not that easy. The consent has to be freely given. And data collection has to be kept at a minimum.
If hotel staff says "Ok, last step we need to do to check you in is to copy your passport" that would probably neither count as freely given consent nor as keeping data collection to a minimum.
And KYC also does not mean you have to copy the passport of a person.
If hotel staff says "Ok, last step we need to do to check you in is to copy your passport" that would probably neither count as freely given consent nor as keeping data collection to a minimum.
And KYC also does not mean you have to copy the passport of a person.
Usually it's to assist people that upload the information incorrectly
I always thought that the government ID photos were claimed to be wiped out immediately after document verification. Guess not.
The attackers bribed customer service agents to hand over data and documents, they were not breached directly. It's possible this stuff may have been handed over before being destroyed.
[deleted]
The article keeps saying overseas employees or contractors, but isn't more specific on who Coinbase entrusted with this sensitive customer PII.
The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked.
Not, "Gosh, 'overseas' people, what can ya do?"
The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked.
Not, "Gosh, 'overseas' people, what can ya do?"
It's probably hard to keep call-center workers bribe-proof.
Yes, but I do think an organization like Coinbase or a cell phone carrier - which are extreme targets of fraud - have an obligation to recognize that their employees are targets and implement greater security measures than most organizations. Maybe Coinbase should even pay higher wages and use onshore customer service agents.
Well, it sounds like they do implement greater security measures than most organizations.
Doesn't matter when Coinbase still got exploited
In a broad sense I agree, but it does matter to orionsbelt's comment.
You can take the Google approach of basically not empowering the agents at all. It's not worth trying to social engineer Google CS, because they can't do anything anyway.
Coinbase has the same approach. It's a miracle that ransomware operators got in touch with Coinbase support at all.
It would be pretty simple actually
>Go on LinkedIn
>Look up profiles of people who work at Coinbase
>Contact and bribe them with a burner account
>Go on LinkedIn
>Look up profiles of people who work at Coinbase
>Contact and bribe them with a burner account
[flagged]
You are writing this as if you know what countries Coinbase's call centers are located in and the role of organized crime in their economies, but you don't actually know either of those things.
Lol, that's because while Coinbase emphasizes its commitment to security and compliance specific details about the geographic distribution of its offshore personnel are not disclosed in its public filings.
My perspective was more "That's because you post contentious statements in public fora with no reason to believe that they are true, hoping to get a big reaction by offending people."
The fact that offshore support is allowed to access KYC information for US-based customers should be against some sort of regulation.
You mean like in the USA?
> ...bribed AT&T employees at a call center in Bothell, Washington, to "use their network credentials and exceed their authorized access to AT&T's computers to submit large numbers of fraudulent and unauthorized unlock requests on behalf of the conspiracy and to install malware and unauthorized hardware on AT&T's systems," according to the indictment.
https://abcnews.go.com/Politics/att-employees-bribed-1m-unlo...
> ...bribed AT&T employees at a call center in Bothell, Washington, to "use their network credentials and exceed their authorized access to AT&T's computers to submit large numbers of fraudulent and unauthorized unlock requests on behalf of the conspiracy and to install malware and unauthorized hardware on AT&T's systems," according to the indictment.
https://abcnews.go.com/Politics/att-employees-bribed-1m-unlo...
Not sure how bribing employees to unlock phones early is comparable to defrauding elderly people.
Read my comment further:
> ..install malware and unauthorized hardware on AT&T's systems
That's not as harmless as unlocking phones early. A major carrier that has access to texts, geolocations, and call logs being hacked like that is extremely concerning.
> ..install malware and unauthorized hardware on AT&T's systems
That's not as harmless as unlocking phones early. A major carrier that has access to texts, geolocations, and call logs being hacked like that is extremely concerning.
Call center workers who have access PII and financial abilities should probably be vetted a little bit better.
How are you going to vet people to find out if they're vulnerable to bribery? Offer them a bribe during their probationary period, during which they only have access to fake customer data?
You can do a background check, but the reality of the matter is that you pay citizens a living wage to do the work instead of offshore it into a country that pays pennies.
Bank tellers can take thousands out of the vault at any time and yet it seems it’s not a very big issue.
Bank tellers can take thousands out of the vault at any time and yet it seems it’s not a very big issue.
Bank tellers do steal money from the banks they work for though and banks invest a significant amount of resources and have a lot of policies to prevent it.
For example at many banks the teller might need to get manager approval for some cash withdrawals, even for seemingly smaller amounts of money. Despite what it may seem, it's not because of some distrust towards the client but a safeguard against internal fraud.
For example at many banks the teller might need to get manager approval for some cash withdrawals, even for seemingly smaller amounts of money. Despite what it may seem, it's not because of some distrust towards the client but a safeguard against internal fraud.
Bank tellers are constantly surveilled by cameras, security guards, and several-times-daily cash counting, and it's still easy to find accounts of them having stolen significant amounts of money before getting caught. These are all from within the last year:
Vannia Chatt: https://6abc.com/post/former-citizens-bank-teller-accused-st...
Karen Farrell Tigler: https://www.irs.gov/compliance/criminal-investigation/former...
Stephanie Rose Kilbert: https://people.com/bank-teller-stole-money-while-pretending-...
Derek Aut: https://www.justice.gov/usao-ma/pr/former-bank-teller-arrest... https://www.usatoday.com/story/news/nation/2025/03/28/boston...
Mountee Brown: https://www.justice.gov/usao-md/pr/maryland-bank-teller-plea...
Being US citizens doesn't make people incorruptible. In fact, many other countries are less corrupt than the US. Someone in this very thread reports having witnessed bank tellers getting bribed in one of those countries: https://news.ycombinator.com/item?id=43996765
I've been through a background check designed to screen out people who were vulnerable to bribery. They interviewed my friends and family from the previous several years to find out if I was secretly gay, cheated on my wife, gambled, drank too much, used illegal drugs, or had money problems for some other reason. It took about a year. I think it would be hard for a financial institution to be economically competitive doing that kind of thing with their call-center workers, because their customers can't tell if they're secure or not, just how much their services cost.
Vannia Chatt: https://6abc.com/post/former-citizens-bank-teller-accused-st...
Karen Farrell Tigler: https://www.irs.gov/compliance/criminal-investigation/former...
Stephanie Rose Kilbert: https://people.com/bank-teller-stole-money-while-pretending-...
Derek Aut: https://www.justice.gov/usao-ma/pr/former-bank-teller-arrest... https://www.usatoday.com/story/news/nation/2025/03/28/boston...
Mountee Brown: https://www.justice.gov/usao-md/pr/maryland-bank-teller-plea...
Being US citizens doesn't make people incorruptible. In fact, many other countries are less corrupt than the US. Someone in this very thread reports having witnessed bank tellers getting bribed in one of those countries: https://news.ycombinator.com/item?id=43996765
I've been through a background check designed to screen out people who were vulnerable to bribery. They interviewed my friends and family from the previous several years to find out if I was secretly gay, cheated on my wife, gambled, drank too much, used illegal drugs, or had money problems for some other reason. It took about a year. I think it would be hard for a financial institution to be economically competitive doing that kind of thing with their call-center workers, because their customers can't tell if they're secure or not, just how much their services cost.
Then shift liability and let the insurers take care of it.
With a lot of this online stuff, no matter who gets your password or access to your account it’s you who has to take care of it. Whereas if the bank teller steals from the till it’s not your problem.
With a lot of this online stuff, no matter who gets your password or access to your account it’s you who has to take care of it. Whereas if the bank teller steals from the till it’s not your problem.
I suggest following the links I provided, which clearly demonstrate that the comment you posted in reply to them is false.
Loss prevention is a big deal for employees, not just customers. People steal stuff from their employers ALL the time.
> you pay citizens a living wage to do the work instead of offshore
But what about the capital class? How will they afford more yachts? So sad. They're.. um... job creators or something. Anyway, that's what Fox News told me.
But what about the capital class? How will they afford more yachts? So sad. They're.. um... job creators or something. Anyway, that's what Fox News told me.
Let me add to your statement. It is hard to keep call center workers bribe-proof WHEN they are paid peanuts AND they are working for a company that is in an extremely high risk business of managing crypto.
correct, but what's the alternative? they're paid peanuts because it's not exactly the kind of job you ever pay out the wazoo for. the only thing that comes to mind if I'm Brian Armstrong is going all in on AI bots that can get to 90% of the way there (maybe 95%) and then have domestic based humans that are paid more with (presumably) a less probability of being bribed. but realistically, the only way to stop something like this is going 100% AI bots but then that comes at the expense of customer satisfaction, and also bots that are exploitable through prompt manipulation.
alternatively limit the roles and what the offshore people are able to do, but then any escalation means domestic people, which brings us back to "well at that point just use AI to automate easy tasks"
alternatively limit the roles and what the offshore people are able to do, but then any escalation means domestic people, which brings us back to "well at that point just use AI to automate easy tasks"
Normally payment should follow the amount of power/responsibility. If you pay someone peanuts but they have root access to prod, then you should pay more or restrict their credentials. Same applies to being able to access PII.
> what's the alternative?
Small set of privileged employees who work from the home office and are compensated to match. If an issue requires their attention, it takes time to resolve. But it's resolved securely. In essence, what Google does.
Alternative is the banking model. Low-cost customer service massively empowered and just eat the costs of breaches as they come.
Small set of privileged employees who work from the home office and are compensated to match. If an issue requires their attention, it takes time to resolve. But it's resolved securely. In essence, what Google does.
Alternative is the banking model. Low-cost customer service massively empowered and just eat the costs of breaches as they come.
What Google does is “don’t resolve shit”. When I was a Google Fi customer paying $60-80/mo, so more than the vast majority of Google users, their customer support was completely useless (but at least polite, I’ll give them that). They did take their sweet time, kept promising to call me back after each fruitless call I initiated but didn’t, so you’re right about “it takes time to resolve” I guess.
My multiple banks’ customer service is meh but they do resolve problems and as far as I can tell, haven’t leaked any of my stuff yet in decades. That you think “what Google does” is better than “the banking model” is amusing.
My multiple banks’ customer service is meh but they do resolve problems and as far as I can tell, haven’t leaked any of my stuff yet in decades. That you think “what Google does” is better than “the banking model” is amusing.
Oh totally. I’m just defining the poles of the spectrums. Someone has to eat the cost, whether it be in friction and inconvenience or reimbursing fraud.
Yes but you can not give them a SQL prompt. Rate limiting account queries per CSR is a common mitigation measure.
It’s not hard, it’s expensive.
It's hard to keep most people bribe proof.
Pretty sure all the Big Banks use call centers and manage to avoid this.
They haven't:
https://www.americanbanker.com/news/call-centers-and-bank-br... "Call centers and bank branches are major fraud liabilities"
https://www.bai.org/banking-strategies/beating-crooks-at-cal... "Aite Group’s findings that 61 percent of fraud can be traced back to the [call] center are equally concerning, as is its prediction that contact center fraud loss will double by 2020."
https://www.americanbanker.com/news/call-centers-and-bank-br... "Call centers and bank branches are major fraud liabilities"
https://www.bai.org/banking-strategies/beating-crooks-at-cal... "Aite Group’s findings that 61 percent of fraud can be traced back to the [call] center are equally concerning, as is its prediction that contact center fraud loss will double by 2020."
Question that needs to be answered if they were prosecuted. Losing your job but getting to keep the bribe just means it will still happen.
> Coinbase didn't adequately secure sensitive customer information, and it was leaked
Practically every company has someone with credentials who is in some combination of debt, a damningly-adulterous relationship, a damningly-illegal substance relationship and/or feels underappreciated or slighted compensationwise. The question is generally how much it costs.
Practically every company has someone with credentials who is in some combination of debt, a damningly-adulterous relationship, a damningly-illegal substance relationship and/or feels underappreciated or slighted compensationwise. The question is generally how much it costs.
The odds are already against their future viability after a breach like this and if they're fumbling the response this bad it really doesn't bode well for them.
They would have been better off not even bringing up their location if they weren't going to be transparent.
They would have been better off not even bringing up their location if they weren't going to be transparent.
Bribes are one thing, but threats could also happen. This is a big part of the reason why I absolutely hate entities that think residential addresses should be public record.
This is a precedent to Coinbase employees getting physical threats at their door just because e.g. some voter registration, utility company, bank, credit card, or court record decided to release their name and addresses on the internet. People could show up at some Coinbase software engineers' apartment doors with guns demanding they send BTC to arbitrary addresses.
This is a precedent to Coinbase employees getting physical threats at their door just because e.g. some voter registration, utility company, bank, credit card, or court record decided to release their name and addresses on the internet. People could show up at some Coinbase software engineers' apartment doors with guns demanding they send BTC to arbitrary addresses.
AFAICT it's impractical to keep residential addresses 100% private/secure - too many ways to get an address from any number of companies, organizations and governments that collect it for various reasons.
Plus numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit, etc.
Finally, shutting down paid data brokers seems virtually impossible in practice, which means anybody googling you can pay $20 and get everything.
Remember, the issue isn't lazy goodguys but even slightly motivated badguys, who then use third party scripts to do the data collection.
Plus numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit, etc.
Finally, shutting down paid data brokers seems virtually impossible in practice, which means anybody googling you can pay $20 and get everything.
Remember, the issue isn't lazy goodguys but even slightly motivated badguys, who then use third party scripts to do the data collection.
> shutting down paid data brokers seems virtually impossible in practice
Just jail them. Make it a felony to release someone's PII without their written consent, and make data brokers illegal to begin with.
> numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit
These are not the main vector of transmission of personal information. Yes, Meta could probably do some graph analysis and infer this, but it's a lot of work, and their data leaks are rare in comparison to all the other companies, financial institutions, and governmental organizations, that freely post residential addresses on the internet and to data brokers for the world to Google.
> companies, organizations and governments that collect it for various reasons
KYC requiring addresses should be banned. Companies should not collect a residential address.
Just jail them. Make it a felony to release someone's PII without their written consent, and make data brokers illegal to begin with.
> numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit
These are not the main vector of transmission of personal information. Yes, Meta could probably do some graph analysis and infer this, but it's a lot of work, and their data leaks are rare in comparison to all the other companies, financial institutions, and governmental organizations, that freely post residential addresses on the internet and to data brokers for the world to Google.
> companies, organizations and governments that collect it for various reasons
KYC requiring addresses should be banned. Companies should not collect a residential address.
Man, I hate how Wisconsin makes the data not only public, but free.
I bought a house here after a long time out of country and the first year all I got for mail was scam bullshit. Loads of it.
I bought a house here after a long time out of country and the first year all I got for mail was scam bullshit. Loads of it.
This is a feature of bitcoin not a bug.
If you sling code for cryptocurrency you and your loved ones are "in the game" now.
https://www.bbc.com/news/articles/c20qee5030do
If you sling code for cryptocurrency you and your loved ones are "in the game" now.
https://www.bbc.com/news/articles/c20qee5030do
How can customer support operate without knowing anything about the customer?
You know how your bank asks you to verify details when you call?
Without the right details the customer support people don’t get entry into the customers account details.
Banks have been doing this for 30+ years..
Without the right details the customer support people don’t get entry into the customers account details.
Banks have been doing this for 30+ years..
This also wouldn't be particularly difficult to implement.
Which is such a lame and flawed mechanism to avoid letting them access anyone's data. I mean what are you even trying to prove here? That banks care about customer's security when they can't even implement a secure 2FA which is not just an unencrypted text message
“Give a man a gun and he can rob a bank, but give a man a bank, and he can rob the world.”
“Give a man a gun and he can rob a bank, but give a man a bank, and he can rob the world.”
> I mean what are you even trying to prove here?
That there are more options than holding your hands up and arguing the company couldn't have done anything further in terms of implementing effective controls.
That there are more options than holding your hands up and arguing the company couldn't have done anything further in terms of implementing effective controls.
CS can validate without knowing the details, the same way you don't enter a password and then check to see if that matches the password in the system.
The fact that they keep blaming overseas customer support is pure blame shifting - you still hired someone and gave them access to all this data, Coinbase!
The fact that they keep blaming overseas customer support is pure blame shifting - you still hired someone and gave them access to all this data, Coinbase!
Isn't the whole point of crypto to keep PII out of it completely? If not, what is all this non-sense for exactly, other than the typical goals of pyramid schemes?
The main point of crypto IMO is to have a large-denomination bearer asset.
This is overlooked most places but if you examine around the time the FATF finally pretty much eliminated bearer bonds, bearer stocks, and large bank notes was exactly the time crypto really took off.
This is overlooked most places but if you examine around the time the FATF finally pretty much eliminated bearer bonds, bearer stocks, and large bank notes was exactly the time crypto really took off.
yes. IIRC ~2015 was when the last of bearer bonds/shares were pretty much all completely immobilized. I can't recall when the last ~1000 USD equivalent banknotes were printed but it was also close to that time.
Unfortunately government regulation does not make that possible for exchanges. It also is not the point of crypto.
[deleted]
Coinbase is a bridge between digital currencies and the traditional world.
The PII is required by governments, to convert crypto money into real money.
Not if you are dealing with a regulated exchange that facilitates fiat money transactions.
You can receive crypto privately to your own wallet without sharing PII, without any exchange.
You can receive crypto privately to your own wallet without sharing PII, without any exchange.
It's simple. They want to centralize crypto and dickheads like armstrong are happy to be in line to make that happen. Just look at tether, what's the point of it? It's nothing but a front for inflating the price of bitcoin. It has NEVER been audited and has been found to NOT have any USD backing at all
A shared or hashed secret would do it.
Plenty of exchanges don't know their customers, and in fact that is how they get their customers.
Plenty of exchanges don't know their customers, and in fact that is how they get their customers.
No. Coinbase deals with fiat money, therefore subject to AML and KYC regulations.
[deleted]
[deleted]
Oarch(1)
udev4096(1)
Saved dimes on customer support, lost $400m.
It's hard to not believe in Karma sometimes.
It's hard to not believe in Karma sometimes.
> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States
yea that is what they get. Hope this hurts them bad.
At my last job for a "casual dating" app, all new account verification stuff was sent to some shop in the Philippines. I got involved with troubleshooting some random DB locks that were causing down time. Ended up discovering that this firm tried to automate the verification process with some scripts or something that would sometimes go haywire and send over 100 requests per second to the new account admin portal which would bring down the entire site. Management just asked them nicely to be more careful which brought the peaks down to 80 requests per second which the back end seemed to be able to cope with (just barely). They couldn't careless that there were supposed to be humans looking at this data and they were clearly trying to automate that part out. Even worse, once I started looking at the data that was in the portal, it was credit card name and billing addresses, and DL license or passport scans. Before I could really further fix the performance issue, I was laid off. Then a few months later they did another lay off which cleaned out every american employee. This was an american company that had ~150 american employees and now there are none. Just two execs at the top that get to watch the money roll in while they farm out everything to overseas. Really pisses me off bad >:(
yea that is what they get. Hope this hurts them bad.
At my last job for a "casual dating" app, all new account verification stuff was sent to some shop in the Philippines. I got involved with troubleshooting some random DB locks that were causing down time. Ended up discovering that this firm tried to automate the verification process with some scripts or something that would sometimes go haywire and send over 100 requests per second to the new account admin portal which would bring down the entire site. Management just asked them nicely to be more careful which brought the peaks down to 80 requests per second which the back end seemed to be able to cope with (just barely). They couldn't careless that there were supposed to be humans looking at this data and they were clearly trying to automate that part out. Even worse, once I started looking at the data that was in the portal, it was credit card name and billing addresses, and DL license or passport scans. Before I could really further fix the performance issue, I was laid off. Then a few months later they did another lay off which cleaned out every american employee. This was an american company that had ~150 american employees and now there are none. Just two execs at the top that get to watch the money roll in while they farm out everything to overseas. Really pisses me off bad >:(
It will happen (at least attempted) with on-shore support staff too, My next door neighbour used to work for a UK high street bank and even there support staff were approached, with some of them first befriended, and eventually bribed in to passing along PII. No doubt it happens in the US too. Just costs the bad guys more.
Keeping things onshore means the offenders could face jail time. Anything offshore just goes into a blackhole.
[deleted]
A few weeks ago I got this email:
Update to the Coinbase User Agreement
We are emailing you about an important upcoming update to the Coinbase User Agreement. This update will revise our Arbitration Agreement with you. We made these updates to streamline the process for resolving disputes.
You can read the entire agreement here. The revised terms are in sections 9.9, 9.10 and Appendix 6.
These terms apply only to disputes that you or we initiate after May 15, 2025. The current terms will continue to apply until May 15.
---
What date did this news come out? I see it just happens to be the same date as mentioned in this email, May 15. Coinbase sneakily is trying to prevent their customers from exercising their legal rights. If you work for Coinbase, you ought to be ashamed and quit. If you use Coinbase, remove all your assets immediately.
I'm open to hearing reasons why this is just a coincidence or I'm misinterpreting the situation. Please, go ahead.
Update to the Coinbase User Agreement
We are emailing you about an important upcoming update to the Coinbase User Agreement. This update will revise our Arbitration Agreement with you. We made these updates to streamline the process for resolving disputes.
You can read the entire agreement here. The revised terms are in sections 9.9, 9.10 and Appendix 6.
These terms apply only to disputes that you or we initiate after May 15, 2025. The current terms will continue to apply until May 15.
---
What date did this news come out? I see it just happens to be the same date as mentioned in this email, May 15. Coinbase sneakily is trying to prevent their customers from exercising their legal rights. If you work for Coinbase, you ought to be ashamed and quit. If you use Coinbase, remove all your assets immediately.
I'm open to hearing reasons why this is just a coincidence or I'm misinterpreting the situation. Please, go ahead.
[deleted]
Oops, I was wrong:
From https://techcrunch.com/2025/05/15/coinbase-says-customers-pe...
> The company said the hacker stole customer names, postal and email addresses, phone numbers, and the last four-digits of users’ Social Security numbers. The hacker also took masked bank account numbers and some banking identifiers, as well as customers’ government-issued identity documents, such as driver’s licenses and passports. The stolen data also includes account balance data and transaction histories.
From https://techcrunch.com/2025/05/15/coinbase-says-customers-pe...
> The company said the hacker stole customer names, postal and email addresses, phone numbers, and the last four-digits of users’ Social Security numbers. The hacker also took masked bank account numbers and some banking identifiers, as well as customers’ government-issued identity documents, such as driver’s licenses and passports. The stolen data also includes account balance data and transaction histories.
[deleted]
paxys(2)
[deleted](1)
wait, coinbase has staff?
I mean... wasn't coinbase sort of scammy to begin with? Several years ago I gave them some USD, turned it into BTC, saw the value of the BTC go up, but when I tried to cash out was told that wasn't a thing that was supported by their platform. Later I was told I could apply for a $399/year credit card and could partially pay off the balance with BTC sale proceeds. I'm sure this was all disclosed somewhere in the terms of service I clicked through, and I only lost $1000 to their scheme.
But I've always wondered why people think this is how investment vehicles work. I monkeyed around with stock market bets and even Robin Hood allows you to cash out of your positions.
But I've always wondered why people think this is how investment vehicles work. I monkeyed around with stock market bets and even Robin Hood allows you to cash out of your positions.
Coinbase most certainly permits cashing out.
Are you sure you didn't fall for a scam version?
Are you sure you didn't fall for a scam version?
I dunno why you had problems, but I've been using Coinbase with no problems at all for years. It's linked to my bank account, so if I want to pay for something with bitcoin, I can easily buy and send bitcoin with just a few clicks. I don't invest or speculate in bitcoin, so I only maintain a small account balance. And selling bitcoin and transferring the proceeds to my bank account has been just as easy and trouble-free.
It's more likely you didn't "lose" $1k, but that you had "missed profits". And if you missed the profits because you didn't verify yourself earlier for withdrawal, then that's on you.
Coinbase supported direct bank withdrawals well before they launched their crypto debit cards.
Coinbase supported direct bank withdrawals well before they launched their crypto debit cards.
Your profits are your profits. Coinbase can hold them until you verify yourself for withdrawals, but they can't just take them.
Employees at Signal must be getting bribes as well, or even threats of violence since they can get nation state Secret communications these days.
Got to make it so employees can’t do anything nefarious. This helps protect them.
Got to make it so employees can’t do anything nefarious. This helps protect them.
How would employees of Signal access the encrypted messages?
Roll out an update that defeats the end to end encryption in some subtle way that wouldn't go noticed for a few days. They'd be told when to do it for maximum effect, and if the window is small enough it might even go unnoticed for far longer when another uncompromised update overwrites it. They have no duty to report such things to relevant authorities even if it was discovered internally, so you could be looking at some corporate coverup that while not in on it, seeks to minimize liability/embarrassment.
Really, can you possibly tell if your Signal messages were compromised? Now that iPhones aren't really jailbreakable, you can't even see inside your own device.
Really, can you possibly tell if your Signal messages were compromised? Now that iPhones aren't really jailbreakable, you can't even see inside your own device.
They don’t need to.
Under specific conditions, the client can communicate with malware already on device, save data locally for other software to pick up, or downright stream the decrypted software to a third party.
Most likely is to introduce a flaw in the client that can be used by other walware on the client.
Clearly no red team members on HN these days.
Under specific conditions, the client can communicate with malware already on device, save data locally for other software to pick up, or downright stream the decrypted software to a third party.
Most likely is to introduce a flaw in the client that can be used by other walware on the client.
Clearly no red team members on HN these days.
Indeed, it is what TeleMessage does.
https://www.sec.gov/ix?doc=/Archives/edgar/data/0001679788/0...