United States listed cryptocurrency exchange Coinbase suffered a hacking attack that impacted (and stole digital currency from) at least 6,000 of its customers. The company announced the situation in a breach notification letter. The breach took place between March and May of this year when hackers exploited Coinbase's SMS account recovery process. There is yet to be an announcement as to the amount of funds stolen.
Once hackers had access to user accounts, funds were transferred to wallet addresses not associated with Coinbase. Hackers required information such as email addresses, passwords and phone numbers but Coinbase were unable to confirm how the hackers received this information in the letter:
While we are not able to determine conclusively how these third parties gained access to this information, this type of campaign typically involves phishing attacks or other social engineering techniques to trick a victim into unknowingly disclosing login credentials to a bad actor.
As we have highlighted before, there are a variety of precautions companies and individuals can take to limit the likelihood of a data breach, including:
Business planning for a data breach response; and
Requiring that customers use non-SMS two factor authorisation and strong passwords.
Digital Currency Exchanges are always improving their security systems but consistent updates and monitoring are required to mitigate the risk of breaches. Customers' personal information such as their name, email address, phone number, home address, IP address and date of birth were exposed in this breach, which could lead to further attacks or impersonation of those persons by bad actors.
In their letter, Coinbase noted that all affected customers have or will receive full compensation for any loss and additional support if needed:
We will be providing free credit monitoring to affected customers who are interested and if available in your country of residence.
All users of digital currency exchanges should ensure they have secure and complex passwords, non-SMS two-factor authentication and should always monitor their account balance as well as the privacy policy of the exchange you are using. Storing digital assets off exchange is even safer using a storage device such as a Trezor or Ledger.