Bad actors were able to infiltrate and steal about 6,000 cryptocurrency accounts Coinbase Customers exploit a multi-factor authentication error Sleeping computer. The cryptocurrency exchange told the publication that its security team had targeted a large-scale phishing campaign targeting its users from April to early 2021. Some users may have been victims of malicious emails, allowing hackers to access their usernames and passwords. Worse, even those who had multi-factor authentication turned on were compromised due to errors in the exchange system.
In Notification [PDF] Sending it to affected customers, Coinbase said the bad actors took advantage of a vulnerability in its SMS account recovery process. This allows hackers to receive two-factor tokens that were supposed to be sent via text to the account owner’s phone number.
Coinbase recommends using a two-factor with a security key Website, Then an authentication app. It lists SMS authentication as a last resort, advising users to lock mobile accounts to protect themselves SIM swap scam Or phone port fraud. Back in August, Coinbase also Informed 125,000 users that their two-factor settings have changed, but the exchange then said the notification was sent incorrectly and was not the result of a hack.
In his letter to customers, Coinbase said it had created its SMS account recovery protocols as soon as it learned of the problem. It is also returning everyone who lost cryptocurrency from the event. Those affected by the hack may want to make sure that all their other accounts are protected, even though it did reveal their names, addresses and other sensitive information when their account was compromised.
All products offered by Engadget are selected by our editorial team, independent of our parent company. Some of our stories have affiliate links. If you buy something through one of these links, we can earn an affiliate commission.