Lools like the victims in the article were discovered via email hacks. So an exchange like Coinbase or Gemini was sending some kind of indication of balance via

Lools like the victims in the article were discovered via email hacks. So an exchange like Coinbase or Gemini was sending some kind of indication of balance via email. So it comes down to general OPSEC and weakest-link.