Coinbase user lost $11.6M in 10 minutes, falling for a fake-notification | Hacker News Reader

Coinbase user lost $11.6M in 10 minutes, falling for a fake-notification

businessinsider.com

53 pointsTekMol20 comments

So in a different thread I asked about the risks of moving large amounts of crypto through the exchanges, like if you wanted to cash out and get back to fiat. Would you be vulnerable or discoverable?

The response came back that I had no idea how the mechanics of crypto worked. I wonder how you explain something like this.

Then again, it's Coinbase, so <<internet shrug emoji>>

What is there to explain? User fell for phishing attack and granted attacker access to their Coinbase acount.

Your question was whether you could liquidate thousands of bitcoin without being noticed. The answer to that depends on who you're worried about noticing you. If you want to cash out hundreds of millions without the US government noticing you, then that's going to be difficult. It's also difficult to not be noticed by the exchange you'll be trading on, because the legit ones require KYC because, again, governments are interested in how money moves. If you just want privacy from randos, sell on Coinbase and nobody will know unless Coinbase screws up really bad.

> If you just want privacy from randos, sell on Coinbase and nobody will know

Isn't that what appeared to have happened here though?

From article: It is unclear how the alleged fraudster knew about the Coinbase transaction

The article is not heavy on details, but it sounds like they spoofed a Coinbase notification while the victim was on the legit Coinbase website, so the most likely possibility is that the machine was compromised.

So....just a lucky phishing event, malware on the machine waiting for a Coinbase login to appear, or something else?

In previous eras there were time delays for such large transactions to give both parties time to cancel in case different issues arose. I wonder when that will be relearned.

Sometimes those delays are helpful, and sometimes not. I don't sell my high-value items privately because there's no way to collect payment in a "final" way.

Should of used a trezor to store the coins.

Should have used a Renault Trezor to store the trezor to store Trent Reznor's cryptocurrency.

https://medium.com/@edzitron/cryptocurrency-news-1-26-2018-e...

Should have?

The user should probably get a hardware wallet if the user has a huge amount of cryptocurrencies worth millions. It's no surprise that scammers and phishers are doing their best to do their absolute best to get hands-on some cryptos. Also, ramp up the 2FA, so there's an extra layer of security and notify you if there's something wrong.

A hardware wallet doesn’t exactly protect from stupid actions. Transferring funds from a hardware wallet isn’t that many steps removed from allowing full remote access to your exchange account. Both require massive unawareness of the consequences.

This would have certainly occurred on a computer, probably enabled by a malicious browser extension.

Use a hardware wallet.

This is not news, user got phished.

Is it not news?! If crypto is really the future, then surely would not the majority of the non-technical population prefer to keep their assets with a trusted third party like Coinbase?

If everyone keeps their savings at home on a device offline, then surely that would lead to a rise in break-ins and burglaries?!

If you give someone access to your bank or brokerage account, you can lose money that way too. That's all that happened here.

Stealing a hardware wallet wouldn't help a burglar. They'd get three PIN attempts and then the device wipes itself. It's important to keep the seed words too but those can go in a safe deposit box.

Yes I agree which is why online safety is important.

Surely would the need to place items in safe deposit boxes not lead to an increase in break-ins? Hostage situations? Which I why I think online banking will remaing in place. Ability to revert transatctions and safety

People have been keeping valuables in safe deposit boxes since long before crypto was invented.

As for ability to reverse transactions, wire fraud is actually a huge problem. People buying houses get an email with wire instructions, don't verify it, send the money, and it's gone. Fraudsters call up businesses, convince them to send a wire, and the money's gone. It happens a lot, and unless you discover the fraud immediately, there's usually no way to get your money back, it gets forwarded to fake accounts around the world and withdrawn.

https://money.com/real-estate-wire-fraud-scam-covid-tips/

https://www.bankofthepacific.com/customer-support/quick-tips...

https://www.atg.wa.gov/wire-transfer-scams

If their system was hacked, it would be interesting to know what OS the user had.

The user fell for a simple phishing attack and manually gave the attacker access to the account.

Reply on news.ycombinator.com