6 ms·

I'm pissed. My email address is among those leaked. I got two transaction requests, the first for 732342.34425 BTC and the second for 999999.99999999 BTC. The s

I'm pissed. My email address is among those leaked. I got two transaction requests, the first for 732342.34425 BTC and the second for 999999.99999999 BTC. The second had registered a username of "⚠ URGENT: Сoinbase hacked. We" so that the email subject line read "⚠ URGENT: Сoinbase hacked. We sent you a payment request." I got my coin out of Inputs.io just a few days before they got hacked, and I've got a low balance in Coinbase. I'm going to make that a zero balance, because I've completely lost faith in any company's ability to manage Bitcoin.

deleted 13y ago
[deleted]
- deleted 13y ago
  [deleted]
nly 13y ago
You've just become a target. Everyone now knows everyone on that list has Bitcoin and use web wallets, so it's effectively a list of potentially profitable targets for email account compromise. Please ensure you're using random passwords on every site you use, select the best available security questions, use a password manager, and enable two factor authentication everywhere that allows it. Also move all your coins in to offline wallets. No online web wallets have a bank grade reputation.
- nwh 13y ago
  Hot/cold storage as coinbase is using is probably better than any encryption. Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Manual processing of this means there is some sanity checking on large withdrawals too. Encryption affords you none of that, I would be happier with coinbase than storing on any other online wallet for this very reason.
  - jellicle 13y ago
    > Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Were you born yesterday? The steal-all-your-money rate of bitcoin businesses is running right around 100%, and you're going to lecture people that "they can only ever lose a small portion of all stored user funds"? Really?
    - nwh 13y ago
      Coinbase isn't some random website made in a basement. It's a well funded, YC backed, known-founder company that complies with relevant banking law. There's absolutely nothing to suggest that they hold a partial reserve or have any ill intention whatsoever.
      - megatron7 13y ago
        There's one reason to believe they have ill intention: their habit of ignoring serious user problems (lost deposits, security problems) until they're widely public. Their actions make clear that they are enormously untrustworthy.
        nwh 13y ago
        That doesn't really suggest malice so much as ill attention. From their posts it sounds like they are stretched a little thin under the load, if they wanted to steal they would just be gone not occasionally unresponsive.
        waterlesscloud 13y ago
        It doesn't matter one bit if it's malice or inattention once your coins are gone.
      - sillysaurus3 13y ago
        You're right, there isn't anything suggesting that they hold a partial reserve. And there won't be even when they do. And when they close due to massive theft / loss of coin, and take all of their users' funds with them, that will be the first suggestion that any user hears of. It happened to me. It's not fearmongering, it's fact.
nvk 13y ago
You can only get so much for FREE, that's not Coinkite.com's model. We charge, but we answer email and fix issues.
- jff 13y ago
  But a quick read over your ToS defines bitcoins as having no value and not subject to law ("Bitcoins and Litecoins ("Coins") do not constitute a currency, an asset or a form of property at law or otherwise") and that you're not responsible if they mysteriously vanish ("Any purchase or sale of Coins, for money, virtual currency or other consideration, involves inherent risks and may lead to the complete loss of any value, virtual currency or other consideration, and you agree to wholly accept any and all such risk.")
  - rev_null 13y ago
    Yes, but they'll answer e-mails when you ask why all of your bitcoins disappeared.
rpicard 13y ago
To be clear, the attacker got your email from somewhere else and confirmed that it was on Coinbase. That's the "bug." It's like if you went to go make an account with a certain email on Facebook and found that it was taken. You would then know that the person with that email has an account on Facebook. Regarding user names, they are optional and meant to be public. I think the biggest problem here has been that Coinbase hasn't been responsive to messages sent to their whitehat@ address. That and the fact that users are being spammed by "researchers," which is a problem that falls back on them to mitigate. They haven't been "hacked" though, and the only thing that has been "leaked" is public account names and account existence. The latter is almost impossible to avoid if you require unique emails for accounts (if I'm wrong about that please correct me). That's just my naive two cents, so let me know where I'm missing the picture if that's the case! :)
- broolstoryco 13y ago
  Im sceptical of this. My email was not published anywhere with regards to bitcoin or coinbase, I receive relatively little spam, yet I received 4 of these messages.
  - rpicard 13y ago
    The original disclosure never claimed that emails were leaked. They were found somewhere else: http://blog.shubh.am/full-disclosure-coinbase-security/#poc http://blog.shubh.am/full-disclosure-coinbase-security/#poc Their official response confirms this: http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security http://blog.coinbase.com/post/81407694500/update-on-coinbase...

deleted 13y ago

[deleted]

deleted 13y ago
[deleted]

nly 13y ago

You've just become a target. Everyone now knows everyone on that list has Bitcoin and use web wallets, so it's effectively a list of potentially profitable targets for email account compromise. Please ensure you're using random passwords on every site you use, select the best available security questions, use a password manager, and enable two factor authentication everywhere that allows it. Also move all your coins in to offline wallets. No online web wallets have a bank grade reputation.

nwh 13y ago
Hot/cold storage as coinbase is using is probably better than any encryption. Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Manual processing of this means there is some sanity checking on large withdrawals too. Encryption affords you none of that, I would be happier with coinbase than storing on any other online wallet for this very reason.
- jellicle 13y ago
  > Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Were you born yesterday? The steal-all-your-money rate of bitcoin businesses is running right around 100%, and you're going to lecture people that "they can only ever lose a small portion of all stored user funds"? Really?
  - nwh 13y ago
    Coinbase isn't some random website made in a basement. It's a well funded, YC backed, known-founder company that complies with relevant banking law. There's absolutely nothing to suggest that they hold a partial reserve or have any ill intention whatsoever.
    - megatron7 13y ago
      There's one reason to believe they have ill intention: their habit of ignoring serious user problems (lost deposits, security problems) until they're widely public. Their actions make clear that they are enormously untrustworthy.
      - nwh 13y ago
        That doesn't really suggest malice so much as ill attention. From their posts it sounds like they are stretched a little thin under the load, if they wanted to steal they would just be gone not occasionally unresponsive.
        waterlesscloud 13y ago
        It doesn't matter one bit if it's malice or inattention once your coins are gone.
    - sillysaurus3 13y ago
      You're right, there isn't anything suggesting that they hold a partial reserve. And there won't be even when they do. And when they close due to massive theft / loss of coin, and take all of their users' funds with them, that will be the first suggestion that any user hears of. It happened to me. It's not fearmongering, it's fact.

nvk 13y ago

You can only get so much for FREE, that's not Coinkite.com's model. We charge, but we answer email and fix issues.

jff 13y ago
But a quick read over your ToS defines bitcoins as having no value and not subject to law ("Bitcoins and Litecoins ("Coins") do not constitute a currency, an asset or a form of property at law or otherwise") and that you're not responsible if they mysteriously vanish ("Any purchase or sale of Coins, for money, virtual currency or other consideration, involves inherent risks and may lead to the complete loss of any value, virtual currency or other consideration, and you agree to wholly accept any and all such risk.")
- rev_null 13y ago
  Yes, but they'll answer e-mails when you ask why all of your bitcoins disappeared.

rpicard 13y ago

To be clear, the attacker got your email from somewhere else and confirmed that it was on Coinbase. That's the "bug." It's like if you went to go make an account with a certain email on Facebook and found that it was taken. You would then know that the person with that email has an account on Facebook. Regarding user names, they are optional and meant to be public. I think the biggest problem here has been that Coinbase hasn't been responsive to messages sent to their whitehat@ address. That and the fact that users are being spammed by "researchers," which is a problem that falls back on them to mitigate. They haven't been "hacked" though, and the only thing that has been "leaked" is public account names and account existence. The latter is almost impossible to avoid if you require unique emails for accounts (if I'm wrong about that please correct me). That's just my naive two cents, so let me know where I'm missing the picture if that's the case! :)

broolstoryco 13y ago
Im sceptical of this. My email was not published anywhere with regards to bitcoin or coinbase, I receive relatively little spam, yet I received 4 of these messages.
- rpicard 13y ago
  The original disclosure never claimed that emails were leaked. They were found somewhere else: http://blog.shubh.am/full-disclosure-coinbase-security/#poc http://blog.shubh.am/full-disclosure-coinbase-security/#poc Their official response confirms this: http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security http://blog.coinbase.com/post/81407694500/update-on-coinbase...