4 ms·
The article keeps saying overseas employees or contractors, but isn't more specific on who Coinbase entrusted with this sensitive customer PII. The bottom line
by neilv 1y ago
The article keeps saying overseas employees or contractors, but isn't more specific on who Coinbase entrusted with this sensitive customer PII.
The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked.
Not, "Gosh, 'overseas' people, what can ya do?"
- owlninja 1y ago[flagged]
- adrr 1y agoQuestion that needs to be answered if they were prosecuted. Losing your job but getting to keep the bribe just means it will still happen.
- kragen 1y agoIt's probably hard to keep call-center workers bribe-proof.
- orionsbelt 1y agoYes, but I do think an organization like Coinbase or a cell phone carrier - which are extreme targets of fraud - have an obligation to recognize that their employees are targets and implement greater security measures than most organizations. Maybe Coinbase should even pay higher wages and use onshore customer service agents.
- kragen 1y agoWell, it sounds like they do implement greater security measures than most organizations.
- CryptoBanker 1y agoDoesn't matter when Coinbase still got exploited
- kragen 1y agoIn a broad sense I agree, but it does matter to orionsbelt's comment.
- bombcar 1y agoCall center workers who have access PII and financial abilities should probably be vetted a little bit better.
- kragen 1y agoHow are you going to vet people to find out if they're vulnerable to bribery? Offer them a bribe during their probationary period, during which they only have access to fake customer data?
- bombcar 1y agoYou can do a background check, but the reality of the matter is that you pay citizens a living wage to do the work instead of offshore it into a country that pays pennies. Bank tellers can take thousands out of the vault at any time and yet it seems it’s not a very big issue.
- kragen 1y agoBank tellers are constantly surveilled by cameras, security guards, and several-times-daily cash counting, and it's still easy to find accounts of them having stolen significant amounts of money before getting caught. These are all from within the last year: Vannia Chatt: https://6abc.com/post/former-citizens-bank-teller-accused-stealing-81k-delaware-customers/15674210/ https://6abc.com/post/former-citizens-bank-teller-accused-st... Karen Farrell Tigler: https://www.irs.gov/compliance/criminal-investigation/former-bank-teller-pleads-guilty-to-federal-fraud-charges https://www.irs.gov/compliance/criminal-investigation/former... Stephanie Rose Kilbert: https://people.com/bank-teller-stole-money-while-pretending-to-help-elderly-customer-police-say-11708979 https://people.com/bank-teller-stole-money-while-pretending-... Derek Aut: https://www.justice.gov/usao-ma/pr/former-bank-teller-arrested-stealing-more-180000-customer-accounts https://www.justice.gov/usao-ma/pr/former-bank-teller-arrest... https://www.usatoday.com/story/news/nation/2025/03/28/boston-bank-teller-inside-job/82701440007/ https://www.usatoday.com/story/news/nation/2025/03/28/boston... Mountee Brown: https://www.justice.gov/usao-md/pr/maryland-bank-teller-pleads-guilty-stealing-more-250000-clients https://www.justice.gov/usao-md/pr/maryland-bank-teller-plea... Being US citizens doesn't make people incorruptible. In fact, many other countries are less corrupt than the US. Someone in this very thread reports having witnessed bank tellers getting bribed in one of those countries: https://news.ycombinator.com/item?id=43996765 https://news.ycombinator.com/item?id=43996765 I've been through a background check designed to screen out people who were vulnerable to bribery. They interviewed my friends and family from the previous several years to find out if I was secretly gay, cheated on my wife, gambled, drank too much, used illegal drugs, or had money problems for some other reason. It took about a year. I think it would be hard for a financial institution to be economically competitive doing that kind of thing with their call-center workers, because their customers can't tell if they're secure or not, just how much their services cost.
- lotsofpulp 1y agoIt’s not hard, it’s expensive.
- pm90 1y agoPretty sure all the Big Banks use call centers and manage to avoid this.
- kragen 1y agoThey haven't: https://www.americanbanker.com/news/call-centers-and-bank-branches-are-major-fraud-liabilities https://www.americanbanker.com/news/call-centers-and-bank-br... "Call centers and bank branches are major fraud liabilities" https://www.bai.org/banking-strategies/beating-crooks-at-call-center-fraud/ https://www.bai.org/banking-strategies/beating-crooks-at-cal... "Aite Group’s findings that 61 percent of fraud can be traced back to the [call] center are equally concerning, as is its prediction that contact center fraud loss will double by 2020."
- thepasswordis 1y ago[flagged]
- kragen 1y agoYou are writing this as if you know what countries Coinbase's call centers are located in and the role of organized crime in their economies, but you don't actually know either of those things.
- apercu 1y agoLol, that's because while Coinbase emphasizes its commitment to security and compliance specific details about the geographic distribution of its offshore personnel are not disclosed in its public filings.
- kragen 1y agoMy perspective was more "That's because you post contentious statements in public fora with no reason to believe that they are true, hoping to get a big reaction by offending people."
- AustinDev 1y agoThe fact that offshore support is allowed to access KYC information for US-based customers should be against some sort of regulation.
- ivewonyoung 1y agoYou mean like in the USA? > ...bribed AT&T employees at a call center in Bothell, Washington, to "use their network credentials and exceed their authorized access to AT&T's computers to submit large numbers of fraudulent and unauthorized unlock requests on behalf of the conspiracy and to install malware and unauthorized hardware on AT&T's systems," according to the indictment. https://abcnews.go.com/Politics/att-employees-bribed-1m-unlock-phones-install-malware/story?id=64802367 https://abcnews.go.com/Politics/att-employees-bribed-1m-unlo...
- codegeek 1y agoLet me add to your statement. It is hard to keep call center workers bribe-proof WHEN they are paid peanuts AND they are working for a company that is in an extremely high risk business of managing crypto.
- volkk 1y agocorrect, but what's the alternative? they're paid peanuts because it's not exactly the kind of job you ever pay out the wazoo for. the only thing that comes to mind if I'm Brian Armstrong is going all in on AI bots that can get to 90% of the way there (maybe 95%) and then have domestic based humans that are paid more with (presumably) a less probability of being bribed. but realistically, the only way to stop something like this is going 100% AI bots but then that comes at the expense of customer satisfaction, and also bots that are exploitable through prompt manipulation. alternatively limit the roles and what the offshore people are able to do, but then any escalation means domestic people, which brings us back to "well at that point just use AI to automate easy tasks"
- egeozcan 1y agoNormally payment should follow the amount of power/responsibility. If you pay someone peanuts but they have root access to prod, then you should pay more or restrict their credentials. Same applies to being able to access PII.
- JumpCrisscross 1y ago> what's the alternative? Small set of privileged employees who work from the home office and are compensated to match. If an issue requires their attention, it takes time to resolve. But it's resolved securely. In essence, what Google does. Alternative is the banking model. Low-cost customer service massively empowered and just eat the costs of breaches as they come.
- oefrha 1y agoWhat Google does is “don’t resolve shit”. When I was a Google Fi customer paying $60-80/mo, so more than the vast majority of Google users, their customer support was completely useless (but at least polite, I’ll give them that). They did take their sweet time, kept promising to call me back after each fruitless call I initiated but didn’t, so you’re right about “it takes time to resolve” I guess. My multiple banks’ customer service is meh but they do resolve problems and as far as I can tell, haven’t leaked any of my stuff yet in decades. That you think “what Google does” is better than “the banking model” is amusing.
- dboreham 1y agoYes but you can not give them a SQL prompt. Rate limiting account queries per CSR is a common mitigation measure.
- toast0 1y agoYou can take the Google approach of basically not empowering the agents at all. It's not worth trying to social engineer Google CS, because they can't do anything anyway.
- miohtama 1y agoCoinbase has the same approach. It's a miracle that ransomware operators got in touch with Coinbase support at all.
- robotnikman 1y agoIt would be pretty simple actually >Go on LinkedIn >Look up profiles of people who work at Coinbase >Contact and bribe them with a burner account
- harvey9 1y agoIt's hard to keep most people bribe proof.
- voidspark 1y agoHow can customer support operate without knowing anything about the customer?
- ty6853 1y agoA shared or hashed secret would do it. Plenty of exchanges don't know their customers, and in fact that is how they get their customers.
- voidspark 1y agoNo. Coinbase deals with fiat money, therefore subject to AML and KYC regulations.
- kgwxd 1y agoIsn't the whole point of crypto to keep PII out of it completely? If not, what is all this non-sense for exactly, other than the typical goals of pyramid schemes?
- charcircuit 1y agoUnfortunately government regulation does not make that possible for exchanges. It also is not the point of crypto.
- Oarch 1y ago[flagged]
- deleted 1y ago[deleted]
- dheera 1y agoBribes are one thing, but threats could also happen. This is a big part of the reason why I absolutely hate entities that think residential addresses should be public record. This is a precedent to Coinbase employees getting physical threats at their door just because e.g. some voter registration, utility company, bank, credit card, or court record decided to release their name and addresses on the internet. People could show up at some Coinbase software engineers' apartment doors with guns demanding they send BTC to arbitrary addresses.
- asah 1y agoAFAICT it's impractical to keep residential addresses 100% private/secure - too many ways to get an address from any number of companies, organizations and governments that collect it for various reasons. Plus numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit, etc. Finally, shutting down paid data brokers seems virtually impossible in practice, which means anybody googling you can pay $20 and get everything. Remember, the issue isn't lazy goodguys but even slightly motivated badguys, who then use third party scripts to do the data collection.
- dheera 1y ago> shutting down paid data brokers seems virtually impossible in practice Just jail them. Make it a felony to release someone's PII without their written consent, and make data brokers illegal to begin with. > numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit These are not the main vector of transmission of personal information. Yes, Meta could probably do some graph analysis and infer this, but it's a lot of work, and their data leaks are rare in comparison to all the other companies, financial institutions, and governmental organizations, that freely post residential addresses on the internet and to data brokers for the world to Google. > companies, organizations and governments that collect it for various reasons KYC requiring addresses should be banned. Companies should not collect a residential address.
- apercu 1y agoMan, I hate how Wisconsin makes the data not only public, but free. I bought a house here after a long time out of country and the first year all I got for mail was scam bullshit. Loads of it.
- LtWorf 1y agoThey are probably used as scapegoats and didn't even leak the stuff. Crypto companies tend to do that.
- mlrtime 1y agoYou're probably wrong if you read more into this scenario.
- udev4096 1y ago[flagged]
- udev4096 1y ago[flagged]
- JumpCrisscross 1y ago> Coinbase didn't adequately secure sensitive customer information, and it was leaked Practically every company has someone with credentials who is in some combination of debt, a damningly-adulterous relationship, a damningly-illegal substance relationship and/or feels underappreciated or slighted compensationwise. The question is generally how much it costs.
- overfeed 1y agoWhich is exactly why insider threats should be explored as a threat-model and mitigated to make the blast radius as small as possible via rate PII sanitization, access controls, access monitoring, rate limiting, etc.
- mlrtime 1y agoWhich is what happened here, they didn't get 100% of data, only 1%.
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- J0nL 1y agoThe odds are already against their future viability after a breach like this and if they're fumbling the response this bad it really doesn't bode well for them. They would have been better off not even bringing up their location if they weren't going to be transparent.