Coinbase, one of the largest global cryptocurrency exchanges, is said to have suffered yet another security breach. Hackers discovered a weakness that they exploited to circumvent the company’s SMS multi-factor authentication (MFA) security mechanism. As a result, Coinbase revealed that the hackers stole from 6,000 clients.
Coinbase specifies that a flaw exists in their SMS account recovery procedure. As a result, the hackers were able to obtain the SMS two-factor authentication token required to access a secured account. According to Coinbase, the attackers needed the customer’s email address and password to carry out the assault. Furthermore, the victim’s phone number is linked to their Coinbase account, and they have access to the victim’s email account.
According to Coinbase reports, it is as follows:
However, in this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account.
However, it is unclear how the threat actors obtained this information. Coinbase thinks it was done through phishing operations targeting Coinbase clients in order to obtain account passwords, which has grown widespread. Banking trojans, which are often used to hijack online bank accounts, have also been found to steal Coinbase accounts.
Coinbase has expanded significantly since its inception. It has around 68 million users from more than 100 countries. Complaints, on the other hand, have persisted. Since 2016, Coinbase users have submitted over 11,000 complaints with the Federal Trade Commission and Consumer Financial Protection Bureau, the majority of which have been over customer service.
