A vulnerability that allowed hackers to bypass Coinbase’s multi-factor authentication SMS option has affected at least 6,000 of the exchange’s customers, according to a notification letter sent to affected customers that the company has filed with the California state attorney general offices.
- Between March and May 20, 2021, the hacker used a flaw in Coinbase’s account recovery process to receive the SMS two-factor authentication token to break into customers’ accounts and transfer funds out of them.
- The bad actor also had access to the email address, password and phone number associated with each Coinbase account. Coinbase believes that the hacker stole these credentials through a phishing scheme.
- “We took immediate action to mitigate the impact of the campaign by working with external partners to remove phishing sites as they were identified, as well as notifying the email providers impacted,” a Coinbase spokesperson said via email. “Unfortunately we believe, although cannot conclusively determine, that some Coinbase customers may have fallen victim to the phishing campaign and turned over their Coinbase credentials and the phone numbers verified in their accounts to attackers.”
- Coinbase said it is compensating customers for the stolen funds, but it’s unclear whether those payments are being made in fiat or crypto.
- The exchange recommended that users switch to a more secure version of multi-factor authentication such as a hardware security key or authentication app.
- This appears to be one of the largest breaches to have affected Coinbase. Other notable breaches included a password glitch in August 2019 that stored 3500 customer passwords in plain text on an internal server log, although outside parties did not take advantage of the vulnerability. In the same month, Coinbase revealed the details of a sophisticated attack that was blocked by Coinbase’s team but resembled what would normally happen in a nation state-sponsored attack.
