Most active commenters
  • zamadatix(3)

←back to thread

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

(www.cnbc.com)
410 points gpi | 13 comments | 15 May 25 15:52 UTC | HN request time: 0.416s | source | bottom
Show context
modeless ◴[15 May 25 19:12 UTC] No.43998293[source]▶
I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening feature takes good care of the rest. Wish I could forward them to Kitboga[1].

I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves.

[1] https://www.youtube.com/watch?v=HNziOoXDBeg

replies(10): >>43998497 #>>43998546 #>>43998550 #>>43998551 #>>43998639 #>>43999013 #>>43999303 #>>43999425 #>>43999455 #>>44000073 #
panarky ◴[15 May 25 19:42 UTC] No.43998551[source]▶
If you had any significant assets on Coinbase at any time prior to this breach, spear phishing is the least of your worries.

Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification.

People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnapped for ransom.

"Significant" in this case can be $10k or less.

Until now, your best defense secrecy. Never talk about crypto in public in any way that could be traced to your real-world identity.

Thanks to Coinbase that defense is now gone.

The bad guys can see who has ever had a significant balance on Coinbase (even if they don't right now), whether that balance was sold for cash and how much, or if you've ever transferred tokens off the exchange to a self-custody wallet.

Now the bad guys know who's worth kidnapping for ransom and where you live. For most people, a Google search of your name and home address turns up the names of family members who would would also be lucrative targets for kidnapping and threats of violence.

Coinbase will never be forced to reimburse all the damage they've done because the true cost would bankrupt the company.

replies(12): >>43998696 #>>43998820 #>>43999011 #>>43999267 #>>43999315 #>>43999840 #>>44000135 #>>44000613 #>>44001088 #>>44001777 #>>44002734 #>>44004453 #
1. zamadatix ◴[15 May 25 20:09 UTC] No.43998820[source]▶
> People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnapped for ransom. "Significant" in this case can be $10k or less.

I wonder why, select a person completely at random and by median you'll get just as much from what they have sitting in their checking account. Select a nicer area for an order of magnitude more. That's not encouragement to go assault people in their homes or kidnap families... just confusion.

replies(4): >>43998860 #>>43998883 #>>44000012 #>>44000093 #
2. Balgair ◴[15 May 25 20:14 UTC] No.43998860[source]▶
Yeah, but banks and the normie monetary system has a lot more safeguards in it when it comes to account transfers. Or at least, they appear to have them.

Crypto? It's wild, and people think it's wild.

replies(2): >>43999682 #>>44000071 #
3. suzzer99 ◴[15 May 25 20:17 UTC] No.43998883[source]▶
The median person does not have $10k sitting in a checking account that they can easily withdraw. My gut feeling is that the threat of kidnapping is a lot more serious in some countries. The US maybe not so much.
replies(3): >>43998971 #>>43998977 #>>43999705 #
4. ◴[15 May 25 20:26 UTC] No.43998971[source]▶
5. zamadatix ◴[15 May 25 20:27 UTC] No.43998977[source]▶
Good point, perhaps the lower $ examples are about other countries where that may be a lot more than median transactional account holdings and maybe that concern is part of why folks were using crypto holdings.
6. cyanydeez ◴[15 May 25 21:50 UTC] No.43999682[source]▶
of course, you need to point out that Crypto has ended up being indistinguishable from the banking system in all the important parts.

The distinguishing parts are things you don't want: easily corrupted, grifted, cheated and otherwise duped.

7. zardo ◴[15 May 25 21:52 UTC] No.43999705[source]▶
> The median person does not have $10k sitting in a checking account that they can easily withdraw.

That's true, finding someone with 10k is not as easy as picking a person at random, but it is as easy as driving to the right parking lot and picking a person at random.

replies(1): >>44001383 #
8. outworlder ◴[15 May 25 22:28 UTC] No.44000012[source]▶
The average American can't deal with a $1000 emergency.
replies(1): >>44011193 #
9. koakuma-chan ◴[15 May 25 22:37 UTC] No.44000071[source]▶
I tried to use Coinbase a few months ago to pay for something, and I couldn't even make a transaction because it was deemed suspicious, and my account got locked or something.
replies(1): >>44003853 #
10. quickthrowman ◴[15 May 25 22:42 UTC] No.44000093[source]▶
Bank transactions are reversible, crypto transactions are not.

Also, people do point guns in people’s faces and force them to pay them via Venmo or Cashapp. Google ‘Venmo robbery’ or ‘cashapp robbery’ for plenty of examples. Pointing a gun in someone’s face for $4M in crypto is a lot more lucrative.

11. devman0 ◴[16 May 25 02:44 UTC] No.44001383{3}[source]▶
Pulling $10k out of the global banking system by physical coercion in a way that isn't reversible and won't get you caught is hard problem, you might as well attempt to rob the bank instead. That's why most of the "successful" criminals in that space use social engineering and scamming where the victim is a unwitting participant rather than kidnapping someone.

With crypto, no bank or other middleman involved, it's like stealing physical cash/gold/diamonds from someone, if you know they have it in their possession, so violence can be a lot more successful at coercing a change of possession.

12. rsynnott ◴[16 May 25 10:57 UTC] No.44003853{3}[source]▶
Someone with a lot of cryptocurrency in Coinbase is also quite likely (at least relative to the average person) to have lots of on-chain cryptocurrency, too, though.
13. zamadatix ◴[17 May 25 00:56 UTC] No.44011193[source]▶
Maybe they wouldn't be able to cover other planned expenses with said loss or something but the median (I intentionally avoid referring to "average" for reasons also mentioned in this article) amount American have access to in their transactional bank accounts is $8,000 according to the Federal Reserve: https://www.fool.com/money/research/average-savings-account-...

Someone else made a great mention though: Coinbase didn't just serve the US. For the vast majority of countries these amounts are more than the yearly disposable income of a typical household. From that angle the numbers in the stories make a bit more sense.