3 ms·

> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to c

> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities Based on the information present in the breach, I think it's likely that the source was their customer support in the Philippines. Monthly salary is usually < 1000$/month (entry-level probably even less than 500$) and a 5000$ bribe could be more than a year worth of money, tax-free. Considering the money you can make with that dataset now, this is just a small investment. > •Name, address, phone, and email; •Masked Social Security (last 4 digits only); •Masked bank-account numbers and some bank account identifiers; •Government‑ID images (e.g., driver’s license, passport); •Account data (balance snapshots and transaction history); and •Limited corporate data (including documents, training material, and communications available to support agents). This is every threat actor's dream. Even if you only had email addresses and account balances, this is a nightmare. Instead of blackmailing the company, you can now blackmail each individual user. "Send me 50% of your BTC and I won't publish all of your information on the internet". My guess is that we will have a similar situation like we had with the Vastaamo data breach... https://en.wikipedia.org/wiki/Vastaamo_data_breach https://en.wikipedia.org/wiki/Vastaamo_data_breach

lm28469 1y ago
> •Name, address, phone, and email;\ > blackmail each individual user Blackmail would be the least of my worries, in France we had at least five kidnappings/attempted kidnappings related to crypto investors since the beginning of the year.
- bambax 1y ago
  Yes that's true but it's weird they only focus on crypto investors' families? There are many rich people in France, what's the deal with cryptobros?
  - paranoidrobot 1y ago
    Because it's easier to move crypto than physical cash.
  - rglullis 1y ago
    It's easier and faster to send the money without having to go to the bank.
  - mafriese 1y ago
    You can easily establish the connection from a bank account to a person. A connection from a crypto wallet to a person is extremely difficult. Money laundering with crypto is also much easier (and cheaper usually).
    - smeej 1y ago
      In the vast majority of cases, it's actually extremely easy. It took less than an afternoon for me to learn how to trace 90%+ of transactions on either BTC or any of the networks built on Ethereum or an Ethereum-like protocol. There are large companies that specialize in exactly this, which make tools that allow government agents who have no particular crypto expertise to trace the majority of transactions. It is possible to make your transactions extremely difficult to trace, but you really, really, REALLY have to know what you're doing. Law enforcement loves that people think it's easy and cheap to launder money with crypto, though. It's made it vastly easier for them to catch those people!
      - mafriese 1y ago
        I never doubted that it's possible but it's way harder than identifying bank accounts. There is a massive business behind crypto tracking, that's why companies like MasterCard have acquired CipherTrace. Some years ago there was a really good article / case study from them. I think it was related to a ransomware gang and they were able to identify the threat actor's wallets through crypto tumblers and chain hopping. It's just a matter of how much money and time are you willing to invest into finding out and not a matter of possibility.
      - 1y ago
- iamacyborg 1y ago
  And more than one finger sent in the post.
- stringsandchars 1y ago
  This may seem callous, but isn't a large point of crypto that you are 'free' from the shackles imposed by the State? And I guess that includes protection from criminals by the oppressive forces of the State (aka the police). In which case being kidnapped and having your fingers sent to your family is an integral part of your 'freedom'.
  - lm28469 1y ago
    The state takes a flat 30% tax on capital gains regardless of the source, I'd say they paid their fair share
    - maeln 1y ago
      Depends on if they cashed out and how they did it. There was a big trend for a while to go live in Portugal for a while, enough to be considered a tax resident there, and then cash out there because (at the time, idk if it's still true), they had no (or little) tax on crypto cash out.
      - orwin 1y ago
        Yeah, I know two French people who did it (one of them avoided UK taxes as he was paid in crypto while working in the UK, the other it's muddier). I know three people in the space, and only those two were on the financial side, so to me, while Blockchain is still a legit tech, anybody using cryptocurrency I peg as a tax evader.
        csomar 1y ago
        Good thing we have courts, lawyers and judges for that. It’s funny everyone here hates on Trump but as soon as something align with their view, they want a defacto no due process application.
        orwin 1y ago
        Sorry if i implied anything, i must have missed part of the conversation, i was just confirming that did happen (taking the portugese residency to avoid crypto tax) a few years ago. In my opinion, police should protect even violent criminals from violence when possible, so of course i'm not advocating for anything to happen on tax "avoiders", and they should be protected. I was just stating that i know people in the crypto space, and if you are, i immediately peg you as a small-time sociopath from my past experience. Also i don't care about them getting judged for tax evasion, i know they won't be and honestly, good for them. I also don't care for nonviolent thieves and think the same thing about them. Profiteering was not how i was raised, but i understand different people have different standards (and parents, luckily mine are great, it's not the case for everybody). People do what they need to do, i found some comportment sociopathic, but as long as it is nonviolent, i'm not mad.
wslh 1y ago
Beyond the Philippines low wage, the point is that there is a price for "everybody" if it were in the US it will be a much higher price, and most probably paying for higher attack benefits.
avrionov 1y ago
It way worse. The US companies, pay $3-$6 per hour to outsource their support to the Philippines. The companies which provide the service have very high turnover rate. For some companies the employees stay on average about 6 months. There is absolutely no reason to be loyal.
brandensilva 1y ago
We are getting zero government regulations on AI, no punishment data breaches, and no human protections against wide scale abuse. The opposite is happening. I suspect to see America in chaos from these disruptions in the very near future.

lm28469 1y ago

> •Name, address, phone, and email;\ > blackmail each individual user Blackmail would be the least of my worries, in France we had at least five kidnappings/attempted kidnappings related to crypto investors since the beginning of the year.

bambax 1y ago
Yes that's true but it's weird they only focus on crypto investors' families? There are many rich people in France, what's the deal with cryptobros?
- paranoidrobot 1y ago
  Because it's easier to move crypto than physical cash.
- rglullis 1y ago
  It's easier and faster to send the money without having to go to the bank.
- mafriese 1y ago
  You can easily establish the connection from a bank account to a person. A connection from a crypto wallet to a person is extremely difficult. Money laundering with crypto is also much easier (and cheaper usually).
  - smeej 1y ago
    In the vast majority of cases, it's actually extremely easy. It took less than an afternoon for me to learn how to trace 90%+ of transactions on either BTC or any of the networks built on Ethereum or an Ethereum-like protocol. There are large companies that specialize in exactly this, which make tools that allow government agents who have no particular crypto expertise to trace the majority of transactions. It is possible to make your transactions extremely difficult to trace, but you really, really, REALLY have to know what you're doing. Law enforcement loves that people think it's easy and cheap to launder money with crypto, though. It's made it vastly easier for them to catch those people!
    - mafriese 1y ago
      I never doubted that it's possible but it's way harder than identifying bank accounts. There is a massive business behind crypto tracking, that's why companies like MasterCard have acquired CipherTrace. Some years ago there was a really good article / case study from them. I think it was related to a ransomware gang and they were able to identify the threat actor's wallets through crypto tumblers and chain hopping. It's just a matter of how much money and time are you willing to invest into finding out and not a matter of possibility.
    - 1y ago
iamacyborg 1y ago
And more than one finger sent in the post.
stringsandchars 1y ago
This may seem callous, but isn't a large point of crypto that you are 'free' from the shackles imposed by the State? And I guess that includes protection from criminals by the oppressive forces of the State (aka the police). In which case being kidnapped and having your fingers sent to your family is an integral part of your 'freedom'.
- lm28469 1y ago
  The state takes a flat 30% tax on capital gains regardless of the source, I'd say they paid their fair share
  - maeln 1y ago
    Depends on if they cashed out and how they did it. There was a big trend for a while to go live in Portugal for a while, enough to be considered a tax resident there, and then cash out there because (at the time, idk if it's still true), they had no (or little) tax on crypto cash out.
    - orwin 1y ago
      Yeah, I know two French people who did it (one of them avoided UK taxes as he was paid in crypto while working in the UK, the other it's muddier). I know three people in the space, and only those two were on the financial side, so to me, while Blockchain is still a legit tech, anybody using cryptocurrency I peg as a tax evader.
      - csomar 1y ago
        Good thing we have courts, lawyers and judges for that. It’s funny everyone here hates on Trump but as soon as something align with their view, they want a defacto no due process application.
        orwin 1y ago
        Sorry if i implied anything, i must have missed part of the conversation, i was just confirming that did happen (taking the portugese residency to avoid crypto tax) a few years ago. In my opinion, police should protect even violent criminals from violence when possible, so of course i'm not advocating for anything to happen on tax "avoiders", and they should be protected. I was just stating that i know people in the crypto space, and if you are, i immediately peg you as a small-time sociopath from my past experience. Also i don't care about them getting judged for tax evasion, i know they won't be and honestly, good for them. I also don't care for nonviolent thieves and think the same thing about them. Profiteering was not how i was raised, but i understand different people have different standards (and parents, luckily mine are great, it's not the case for everybody). People do what they need to do, i found some comportment sociopathic, but as long as it is nonviolent, i'm not mad.

wslh 1y ago

Beyond the Philippines low wage, the point is that there is a price for "everybody" if it were in the US it will be a much higher price, and most probably paying for higher attack benefits.

avrionov 1y ago

It way worse. The US companies, pay $3-$6 per hour to outsource their support to the Philippines. The companies which provide the service have very high turnover rate. For some companies the employees stay on average about 6 months. There is absolutely no reason to be loyal.

brandensilva 1y ago

We are getting zero government regulations on AI, no punishment data breaches, and no human protections against wide scale abuse. The opposite is happening. I suspect to see America in chaos from these disruptions in the very near future.