3 ms·

I'm skeptical of their breach notification for the following reasons... If they were certain this was PURELY a phishing campaign against their users, then they

by q1w2 5y ago

I'm skeptical of their breach notification for the following reasons... If they were certain this was PURELY a phishing campaign against their users, then they had no need to disclose to the government. Their wording in their disclosure is very very carefully crafted to not deny a breach of their data - pending "conclusive" evidence. They made a choice to disclose so that the gov't could never claim that they failed to disclose should Coinbase data appear on a darknet website. And While they make an allusion to social media data collection - I was a target in June, and I absolutely had ZERO social media talking about using coinbase. There is NO WAY hackers could have deduced on social media that I was Coinbase user, nor gotten my cell phone number. I am 90% confident that Coinbase WAS breached directly, allowing hackers to gain access to email and phone number for my account. This disclosure is 100% CYA.

Thorrez 5y ago
This disclosure says that everyone who was hacked had their email inbox hacked. So you're saying that someone hacked Coinbase to find your email address, then once they found your address, hacked your email inbox some other way, then used that to hack Coinbase? That sounds very roundabout, although I guess not impossible. I guess it's possible Coinbase could have some info leak somewhere that would leak your email address. Did you ever use any other cryptocurrency website? If so, one of those could have been hacked in order for the hackers to get a list of users to target.
- q1w2 5y ago
  There is a big difference between hacking a Coinbase client contact database, and hacking THE Coinbase account database. The thing that might have been hacked could have easily been a CRM or email marketing system - possibly even via some 3rd party supplier. Obviously there was no hack of the Coinbase accounting system - for the reasons you mentioned.

by q1w2 5y ago

Thorrez 5y ago

This disclosure says that everyone who was hacked had their email inbox hacked. So you're saying that someone hacked Coinbase to find your email address, then once they found your address, hacked your email inbox some other way, then used that to hack Coinbase? That sounds very roundabout, although I guess not impossible. I guess it's possible Coinbase could have some info leak somewhere that would leak your email address. Did you ever use any other cryptocurrency website? If so, one of those could have been hacked in order for the hackers to get a list of users to target.

q1w2 5y ago
There is a big difference between hacking a Coinbase client contact database, and hacking THE Coinbase account database. The thing that might have been hacked could have easily been a CRM or email marketing system - possibly even via some 3rd party supplier. Obviously there was no hack of the Coinbase accounting system - for the reasons you mentioned.