5 ms·

Boy this whole thing just reeks. > No customers experienced a loss of funds. In the majority of cases we prevented the unauthorized withdrawal, and in all othe

Boy this whole thing just reeks. > No customers experienced a loss of funds. In the majority of cases we prevented the unauthorized withdrawal, and in all other cases customers were fully reimbursed. so which is it? no one lost funds or everyone that lost funds got paid back? where did that money come from? > transactions were being approved without the 2FA authentication control being inputted by the user. the withdrawal system allows for non-2fa when its enabled, but informs the risk system when it happens? what kind of feature is that? > While Crypto.com already performs internal and external penetration tests, Crypto.com has immediately engaged with third-party security firms to perform additional security checks ah yes. the "we already had 7 double checkers, better add an 8th" solution. sounds like maybe the problem is not with the testing and auditing suite. > releasing additional end-user security features as we move away from 2-Factor Authentication and to true Multi-Factor Authentication (MFA) 2fa isnt true MFA? did we evolve some new jargon im not aware of? > WAPP is designed to protect user funds in cases where a third party gains unauthorized access to their account and withdraws funds without the user’s permission. WAPP restores funds wait i thought they said they already did this? are they gonna start charging for it now because they lost money? > To qualify for the WAPP program, users must: Set up an anti-phishing code at least 21 days prior to the reported unauthorized transaction wtf is that? a PSK? a TOTP? > File a police report and provide a copy of it to Crypto.com; and hello, local police department? i need to file a report - my cryptocurrency wallet just had an unauthorized funds withdrawal. no, i dont have a suspect, or evidence, or any action for you to take. just come down here and write down that i said this happened please.

deleted 5y ago
[deleted]
vmception 5y ago
They got paid back from company treasury. CeFi (incorporated, custodial, web 2.0 financial services operating in the crypto space) makes alot of money, it isn’t that hard. Crypto.com is on par with FTX, Binance, Celsius, Coinbase and we have many varying examples of their valuations and supporting revenues and balance sheets. $30mm irrecoverably stolen with zero liability for the hacker? No problem for the user experience or health of the company these days.
GordonS 5y ago
The whole thing is really unclear, but it sounds like if they are hacked and you lose funds, they will only reimburse you if you file a police report... even though they would know if you lost funds, and only they would know the circumstances and have any evidence. I wouldn't touch crypto.com with a very long barge pole...
- swalsh 5y ago
  The police report is probably due to their insurance, but it is odd that they would need individual police reports for each account.
  - eli 5y ago
    It's probably at least partly to discourage you from making false loss claims. Lying on a police report is a crime.
matheusmoreira 5y ago
> the withdrawal system allows for non-2fa when its enabled, but informs the risk system when it happens? what kind of feature is that? I don't know about crypto.com but this is how binance does it. You can enable 2FA for everything or individually for specific actions such as logging in, withdrawals, etc. Lets everyone choose their security/inconvenience trade-off which I find reasonable. > wtf is that? a PSK? a TOTP? There is something similar on binance too. You set up some unique code on their website, every official email they send you will include that code as proof of authenticity. A weak form of signature I guess.
aeturnum 5y ago
> Set up an anti-phishing code I believe this is a system where you give a website something that you will recognize (I've seen small images used as well as text) that they agree to display to you in their layout. It is supposed to make building convincing phishing websites harder, as the attackers cannot know what content a given user has sent to the service.
- eli 5y ago
  What stops the attacker from fetching the image or text?
  - leevlad 5y ago
    In this case you set the anti-phishing code in your account settings (arbitrary string). Then they include it in all email comms (in the top right of the email body). So if you get an email from what looks like "Crypto.com", but with a different anti-phishing code - then you can be certain that it's phishing.
    - eli 5y ago
      Oh, it's just for email. That makes sense. Seems pretty weak since it relies on the user noticing the absence of a security feature. I'd probably prefer the emails have no links and train people to never click from an email. Make them log in the same way they usually do to take any actions.
      - dustymcp 5y ago
        Withdrawal from any crypto exchange requires you to confirm an email link :)
john2x 5y ago
I wouldn't be surprised if "reimbursing" is just updating a number on their database and hoping customers won't immediately withdraw.
- kayamon 5y ago
  Bear in mind many private exchanges aren't ever really exchanging crypto until you cash out -- the numbers you see can be just trades on an internal stockmarket, not necessarily backed by any external crypto asset until realized.
  - imtringued 5y ago
    I honestly don't want to know how the sausage is made. The gold standard has always been a lie. Cryptocurrencies traded on exchanges are basically paper gold at this point.

deleted 5y ago

[deleted]

vmception 5y ago

They got paid back from company treasury. CeFi (incorporated, custodial, web 2.0 financial services operating in the crypto space) makes alot of money, it isn’t that hard. Crypto.com is on par with FTX, Binance, Celsius, Coinbase and we have many varying examples of their valuations and supporting revenues and balance sheets. $30mm irrecoverably stolen with zero liability for the hacker? No problem for the user experience or health of the company these days.

GordonS 5y ago

The whole thing is really unclear, but it sounds like if they are hacked and you lose funds, they will only reimburse you if you file a police report... even though they would know if you lost funds, and only they would know the circumstances and have any evidence. I wouldn't touch crypto.com with a very long barge pole...

swalsh 5y ago
The police report is probably due to their insurance, but it is odd that they would need individual police reports for each account.
- eli 5y ago
  It's probably at least partly to discourage you from making false loss claims. Lying on a police report is a crime.

matheusmoreira 5y ago

> the withdrawal system allows for non-2fa when its enabled, but informs the risk system when it happens? what kind of feature is that? I don't know about crypto.com but this is how binance does it. You can enable 2FA for everything or individually for specific actions such as logging in, withdrawals, etc. Lets everyone choose their security/inconvenience trade-off which I find reasonable. > wtf is that? a PSK? a TOTP? There is something similar on binance too. You set up some unique code on their website, every official email they send you will include that code as proof of authenticity. A weak form of signature I guess.

aeturnum 5y ago

> Set up an anti-phishing code I believe this is a system where you give a website something that you will recognize (I've seen small images used as well as text) that they agree to display to you in their layout. It is supposed to make building convincing phishing websites harder, as the attackers cannot know what content a given user has sent to the service.

eli 5y ago
What stops the attacker from fetching the image or text?
- leevlad 5y ago
  In this case you set the anti-phishing code in your account settings (arbitrary string). Then they include it in all email comms (in the top right of the email body). So if you get an email from what looks like "Crypto.com", but with a different anti-phishing code - then you can be certain that it's phishing.
  - eli 5y ago
    Oh, it's just for email. That makes sense. Seems pretty weak since it relies on the user noticing the absence of a security feature. I'd probably prefer the emails have no links and train people to never click from an email. Make them log in the same way they usually do to take any actions.
    - dustymcp 5y ago
      Withdrawal from any crypto exchange requires you to confirm an email link :)

john2x 5y ago

I wouldn't be surprised if "reimbursing" is just updating a number on their database and hoping customers won't immediately withdraw.

kayamon 5y ago
Bear in mind many private exchanges aren't ever really exchanging crypto until you cash out -- the numbers you see can be just trades on an internal stockmarket, not necessarily backed by any external crypto asset until realized.
- imtringued 5y ago
  I honestly don't want to know how the sausage is made. The gold standard has always been a lie. Cryptocurrencies traded on exchanges are basically paper gold at this point.