Hacker News Reader

Comment by Yhippa | Hacker News Reader

Is Coinbase safe?

A buddy of mine had his phone SIM-hacked and his coinbase account drained. He was on the phone with coinbase trying to stop it while it was happening, and said they were beyond useless.

Criminals have lists of everyone with crypto on coinbase. They're cross-referencing this list with people with T-Mobile (usually), then pulling off SIM-hacks by buying off a store manager, or just grabbing the manager's laptop and running out of the store with it. At that point they have 10-15 minutes to take over as many SIMs as they can.

https://darknetdiaries.com/transcript/118/

That sounds like fud to me. Coinbase decided my account was left for dead, and contacted my state. It tooks several weeks of back and forth with coinbase, including multiple phone calls with support and sending pics of my id, etc before they let me access my account. I had my password etc, same phone. They wouldn't let me get my money out.

It's not FUD. They used 2FA to reset his coinbase password, then accessed it as him and drained the account.

On top of that they drained his bank account (also using 2FA) into the coinbase account, then drained that too. Coinbase has (or had at the time) elevated levels of trust that they just gave him, which allowed the hacker to immediately buy crypto with transferred funds. Then the hacker just transferred the crypto to another wallet.

so they used sms based 2fa. I had 2fa based on google authenticator (not sms), because of that attack vector. I only had a few thou dollars. But they decided google auth is not accepted anymore and I failed to login and reset it and so the result was locking my account for a year - until recently when I spent multiple days getting it reset. Thus my skepticism.

No one should allow/use text message based 2fa of course.

Correct, text-based 2FA is insecure. But coinbase allows it, and most banks offer it as the only option.

The link I posted basically describes exactly what happened to my buddy and how they pulled it off. T-Mobile + text-2FA + coinbase is a chain of weak links.

Coinbase is a publicly listed company, with all its assets & liabilities shared in quarterly investor updates. They store all customers assets 1:1 (ie does not re-hypothecate any of customer assets)

Enron was also public, so was Lehman Brothers. The idea that public companies can't game their numbers or commit fraud is provably false. Why anyone would have large sums of crypto (5 or 6 figures+) on an exchange is beyond me.

Did Lehman commit fraud?

My understanding is no.

It is not safe, if you have crypto in coinbase they can steal it the exact same way FTX stole their users crypto. You do not own crypto stored on an exchange

No, it should be perfectly clear by now that none of them are safe, no matter what they say. The best time to get your coins out of any exchanges was when the FTX fall began. The second best time is right now.

There's no such thing as "safe" or "unsafe" in an unregulated space (hence people saying "no") but if you're asking about relative safety then Coinbase is probably the safest of the centralised exchanges. The alternative to a custodian (like an exchange), self-custody, is "safe" in that it removes counterparty risk but it's "unsafe" in that you are now entirely responsible for keeping your coins in your control which means dealing with the risks of loss and theft.

A better question to ask is: what are you trying to protect yourself against, and what risks are you willing to take? Without insurance (whether that's government provided through a regulatory scheme (which does not exist in crypto), or personally through an insurance provider) you're exposed to a bunch of risks that can be minimised but not removed.

I don't own any cryptocurrency but if I did, I'd either use a specialist custody service or an exchange I trusted. If I was going to self-custody, it would involve multiple hardware wallets across multiple safe deposit boxes.

No and it doesn't matter if you're right if you're also last. Nearly 50,000 Bitcoin were withdrawn from Coinbase daily between Nov. 23 and Nov. 27 — equating to roughly $3 billion. Move your funds off today just to be safe.

No centralized exchange is safe, including coinbase. Some are doing proof of reserves and audits but these can easily be gamed.

No it is not. No exchange or centralized crypto service is. Not your keys, not your coins and also not your NFTs.

No CEX can be safe. Get yourself a cold wallet.

"not my keys, not my money."

Reply on news.ycombinator.com