Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves.

[1] https://www.youtube.com/watch?v=HNziOoXDBeg

I was looking through some phishing e-mails the other day out of curiosity and found a weird unicode character mistranslated. Immediately knew it was an artifact of bad translation. So they're not perfect, but they're damn good.

Same with my Microsoft account actually

I usually just ignore it but I assume someone is testing if my email can be used to login.

Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification.

People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnapped for ransom.

"Significant" in this case can be $10k or less.

Until now, your best defense secrecy. Never talk about crypto in public in any way that could be traced to your real-world identity.

Thanks to Coinbase that defense is now gone.

The bad guys can see who has ever had a significant balance on Coinbase (even if they don't right now), whether that balance was sold for cash and how much, or if you've ever transferred tokens off the exchange to a self-custody wallet.

Now the bad guys know who's worth kidnapping for ransom and where you live. For most people, a Google search of your name and home address turns up the names of family members who would would also be lucrative targets for kidnapping and threats of violence.

Coinbase will never be forced to reimburse all the damage they've done because the true cost would bankrupt the company.

The calls they flag as potential spam and telemarketers has been 100% accurate in my experience so i wish I could just silence those

I wonder why, select a person completely at random and by median you'll get just as much from what they have sitting in their checking account. Select a nicer area for an order of magnitude more. That's not encouragement to go assault people in their homes or kidnap families... just confusion.

Crypto? It's wild, and people think it's wild.

https://www.yahoo.com/news/florida-teens-kidnap-las-vegas-20...

.. and are former employees of Coinbase .. oh! just imagining!!

This story keeps repeating. Maybe we should try it and see if it works as a deterrent.

Google's call screening feature picks up the phone before it rings and asks the caller why they're calling. If they actually give a good reason, then it shows you the reason as text and you can decide whether to hang up on them or answer. https://support.google.com/phoneapp/answer/9118387

Because people who read the message and think it's professionally written despite the spelling errors have a large overlap with people who will fall for the scam, at least far enough that money is transferred.

It’s sad because this seems like such a low hanging fruit for a big improvement. At some point in the relatively recent past, they added the indicator of the caller being a spammer or telemarketer. Seems like that would have been a good time to also enhance this filter but it seems nobody ever connected the dots on that one. Or if I’m being even more cynical, some engineer actually decided he’d rather everyone see his work on every incoming spam call instead of his work quietly improving everyone’s experience

The distinguishing parts are things you don't want: easily corrupted, grifted, cheated and otherwise duped.

That's true, finding someone with 10k is not as easy as picking a person at random, but it is as easy as driving to the right parking lot and picking a person at random.

Sounds like an appendix.

This is due to US Government KYC laws that forced Coinbase to associate government identification with all accounts. No crypto company required ID until they were forced to.

Coinbase is the entity that set up this dangerous system.

Coinbase did it because it was cheap for them, not because they were being trustworthy custodians of information that put their customers at risk.

Sure, yes, obviously every company's employees and contractors are vulnerable to bribes and blackmail. That's why a trustworthy, competent custodian would establish systems and controls to prevent bribed and blackmailed insiders from mass-exfiltrating information that could get their customers killed.

The fact that other companies manage to be trustworthy, competent custodians while Coinbase doesn't is not the fault of KYC.

And how long has this been at an increased level? Because i'm not buying the coinbase narrative that they thought this was a systemic issue until they were contacted by the 'cybercriminals'.

Also, people do point guns in people’s faces and force them to pay them via Venmo or Cashapp. Google ‘Venmo robbery’ or ‘cashapp robbery’ for plenty of examples. Pointing a gun in someone’s face for $4M in crypto is a lot more lucrative.

The calls are coming from new numbers, across multiple area codes. A few months ago I would have advised using Begone (https://apps.apple.com/us/app/begone-spam-call-blocker/id159...) to block but that only worked since these calls were isolated to blocks of area codes that were pretty safe to block like 888-XXX-XXXX, but now ZERO of these calls are using a fixed area code that would be relative safe to block.

Essentially you cannot trust Coinbase IMO, might move the few hundred dollars of BTC out of there :-)

It’s much better to just silence every spam call manually instead of having to go into voicemail, listen , decide if I need to respond, hope that I’m acting quickly enough that the other person answers when I ring them back, etc. i imagine this works for a lot of people. But if you get enough calls, or get urgent calls for any reason, it’s not ideal.

For those that can’t imagine the use cases. Consider you are primary contact for your elderly parent. If they fall in the middle of the night you might be getting a call from any random number. Do not disturb isn’t an option and sometimes the EMS guys will call you from their personal cell phone. Even some services like home security will call from random numbers. If ask a plumber to come over, some random technician will call from their device to talk. If a potential client gets my number somehow, I’d prefer to answer versus them get my voicemail.

You have to also factor in that a lot of people don’t even like leaving voicemail so they don’t leave one and I’m left guessing if it mattered that

Someone, someone at that company should be going to prison for negligence

Therefore, an unknown number that can be blocked/ignored by your phone or the app is one that doesn't support Caller ID's name or number functions. It doesn't have anything to do with who's in your Contacts app, because of course those consist of known names and known numbers.

With crypto, no bank or other middleman involved, it's like stealing physical cash/gold/diamonds from someone, if you know they have it in their possession, so violence can be a lot more successful at coercing a change of possession.

This is the crypto industry, who make the discrepancy between Theranos' claims and practice look conservative.

Wealth status is often very well known for public figures and entrepreneurs. People are driving around in $200k cars.

Is it due to the liquidity of cryptocurrencies that $5 wrench attacks work better?

... and save the data in US cloud where everybody can access it.

It is really funny how FAANG can get away with data colkection in spite of GDPR.

That's not how capitalism works. /s

If call is spam and ignore spam option enabled, send call to voicemail.

That’s it, a simple line of code. Just make the option selectable and it’s done.

Also, a decent proportion of crypto-millionaires came by their riches in... not entirely above-board ways (in particular, securities fraud; all those pump and dump scamcoins are paying off for _someone_), and may be reluctant to involve the authorities. And the crypto industry as a whole is unusually comfortable with extortion; hacked crypto companies paying a kind of bounty to hackers to get the rest of the funds back is a common thing.

That is simply not going to happen.

This is actually more difficult than it sounds. Most banks and crypto exchanges won't allow a person to make meaningfully large crypto transactions without some account history.

https://support.apple.com/guide/iphone/block-or-avoid-unwant...

Neither the dollar or crypto are anything but social illusions, neither have an inherent right to exist.

It’s just people manipulating people. Such an intellectually dishonest forum to sit here and discuss meaningless layers of obfuscation.

The most important thing to any individual is enough other humans around their own life isn’t so hard. Specific humans, like those on this forum, are not essential.

You all can bleat on as hard as you want about the existence of crypto but it’s not an evenly distributed belief. And your individual value is non existent to the majority on the planet. No reason to prop up your hallucinations

No sane person would flaunt Apple secrecy in such a fashion whilst employed there.

>instead of his work quietly improving everyone’s experiBence

Laughable that you feel that Apple engineers have the capacity for this kind of desire in 2025. If they did, Xcode would be way better to use. They cant even quietly improve their own experience.

You'd be lucky to complete this in less than a week.

> Coinbase employs a range of technical and organizational measures to defeat efforts to intercept, surveil, or otherwise access without authorization data in transit. For instance, Coinbase encrypts all confidential data transfers to prevent interception or tampering of that data by unauthorized third parties.

Coinbase does business in the EU and thus, already has to comply with the GDPR. Moreover, the US also requires safeguards for sensitive customer information by financial services companies.

Someone else made a great mention though: Coinbase didn't just serve the US. For the vast majority of countries these amounts are more than the yearly disposable income of a typical household. From that angle the numbers in the stories make a bit more sense.