5 ms·

> Unfortunately, between March and May 20, 2021, you were a victim of a third-party campaign to gain > unauthorized access to the accounts of Coinbase customers

> Unfortunately, between March and May 20, 2021, you were a victim of a third-party campaign to gain > unauthorized access to the accounts of Coinbase customers and move customer funds off the Coinbase > platform. At least 6,000 Coinbase customers had funds removed from their accounts, including you. I see 2 conflicting claims here: > While we are not able to determine conclusively how these third parties gained > access to this information "these" being username, pw, phone number etc. And then: > We have not found any evidence that these third parties obtained this information from Coinbase itself. You're technically correct but the first claim undermines the second one to me.

andiliu 5y ago
Not necessarily. You can collect information such as username, passwords, phone numbers from leaked databases and then attempt to login via Coinbase. Some might have 2FA, so they might even go as far as to sim swap them given that they know their phone number. So it doesn’t necessarily mean they got it from Coinbase.
devrand 5y ago
I don't see the conflict with those statement. They're saying "we don't know where the information came from and we haven't found any evidence that it came from Coinbase itself". It's difficult to prove a negative here until you find where the stolen credentials originated from. They're just saying that they have no evidence that it came from themselves thus far.
mdavis6890 5y ago
How? Those statements seem entirely consistent and reasonable to me. They have no evidence or reason to believe that the information was stolen from Coinbase, but beyond that they don't know how attackers got it. Your car was stolen. I haven't been able to determine conclusively who did steal it or how, but I know it wasn't me.
- addingnumbers 5y ago
  "I know it wasn't us" is exactly the non-sequitur conclusion they were trying to walk you toward by wording their statements as they did.
  - devrand 5y ago
    How else would you even word it? They accurately described the situation. If people are leaping to "I know it wasn't us" then that's their own misinterpretation.
    - addingnumbers 5y ago
      > If people are leaping to "I know it wasn't us" then that's their own misinterpretation. Is that not what we just watched a HN reader do with that analogy? It would be equally accurate to say "We have no evidence that it wasn't our fault," either statement is equally meaningless when they have no significant evidence. They chose to phrase their ignorance the only way that it could be misinterpreted as mitigating their liability, and we just watched that misinterpretation play out here. "We haven't found any evidence of who was at fault" would be more forthright than answering only the half of that question that sounds better for them.
eli 5y ago
Phishing or malware would be obvious avenues for someone to gain this information not from Coinbase itself. If people reused passwords, they also could potentially have cobbled together 6000 valid username/password/phone combinations from previous hacks of other services.
- saalweachter 5y ago
  As the Holy Writ says: https://xkcd.com/2176/ https://xkcd.com/2176/

andiliu 5y ago

Not necessarily. You can collect information such as username, passwords, phone numbers from leaked databases and then attempt to login via Coinbase. Some might have 2FA, so they might even go as far as to sim swap them given that they know their phone number. So it doesn’t necessarily mean they got it from Coinbase.

devrand 5y ago

I don't see the conflict with those statement. They're saying "we don't know where the information came from and we haven't found any evidence that it came from Coinbase itself". It's difficult to prove a negative here until you find where the stolen credentials originated from. They're just saying that they have no evidence that it came from themselves thus far.

mdavis6890 5y ago

How? Those statements seem entirely consistent and reasonable to me. They have no evidence or reason to believe that the information was stolen from Coinbase, but beyond that they don't know how attackers got it. Your car was stolen. I haven't been able to determine conclusively who did steal it or how, but I know it wasn't me.

addingnumbers 5y ago
"I know it wasn't us" is exactly the non-sequitur conclusion they were trying to walk you toward by wording their statements as they did.
- devrand 5y ago
  How else would you even word it? They accurately described the situation. If people are leaping to "I know it wasn't us" then that's their own misinterpretation.
  - addingnumbers 5y ago
    > If people are leaping to "I know it wasn't us" then that's their own misinterpretation. Is that not what we just watched a HN reader do with that analogy? It would be equally accurate to say "We have no evidence that it wasn't our fault," either statement is equally meaningless when they have no significant evidence. They chose to phrase their ignorance the only way that it could be misinterpreted as mitigating their liability, and we just watched that misinterpretation play out here. "We haven't found any evidence of who was at fault" would be more forthright than answering only the half of that question that sounds better for them.

eli 5y ago

Phishing or malware would be obvious avenues for someone to gain this information not from Coinbase itself. If people reused passwords, they also could potentially have cobbled together 6000 valid username/password/phone combinations from previous hacks of other services.

saalweachter 5y ago
As the Holy Writ says: https://xkcd.com/2176/ https://xkcd.com/2176/