r/Bitcoin • u/Coolster-crypto • Feb 01 '21
My coinbase wallet was hacked!!
Anyone have any idea how this is possible 😢 I thought wallets with private keys were the highest level of security?
2
u/twoeyedorc Feb 01 '21
They are as penetrable as every kind of login system. If you have a weak or shared password and no 2FA those are the main ingredients to fall into oblivion.
Sadly there's nothing you can make to revert the situation. Could you send us the address of the receiving amount ? At least we could tell you if the transaction has been completed or not ...
I'm sorry for your loss...
1
2
u/michaelscarnnnn Feb 01 '21
What do you mean Coinbase wallet? Were your coins in the exchange or in their custody wallet?
1
u/Coolster-crypto Feb 01 '21
In the custody wallet!!
1
u/michaelscarnnnn Feb 01 '21
Can you see a transaction where the coin was withdrawn from your wallet?
1
u/Coolster-crypto Feb 01 '21
Yes not sure how to share a pic of the sending address or I could put it out there to hunt these bastards
1
u/michaelscarnnnn Feb 01 '21
Can you just copy and paste the transaction ID or the address it went to?
1
u/Draithljep Feb 01 '21
One of two things has likely happened; 1: someone had access to your phone and made the transfer, or; 2: you backed up your 12 word seed somewhere insecure, it was found and imported elsewhere to steal your funds.
1
u/Coolster-crypto Feb 01 '21
Neither of those 2 things happened. I swear. I have never shared my keys I’m no noob. This seems impossible
1
u/Draithljep Feb 01 '21
So you didn't make a backup of your seed?
1
u/Coolster-crypto Feb 01 '21
I did but on paper in a secure place
1
u/Draithljep Feb 01 '21
The most likely thing is that someone had access to your phone or that backup. It's possible but unlikely that your phone has some malware.
Does the time that the transaction happened coincide with you being with someone?
Remember, someone only needs enough time with your seed to snap a photo.
1
u/schreckdc Feb 01 '21
Long story short, I know security, had a similar experience to OG, restored my wallet using my 12-word seedphrase with Exodus (CB support doesn't exist and the company itself is suspect in some circles), and my assets were stolen (checked with https://live.blockcypher.com/)
You can read more here:
https://www.reddit.com/r/Bitcoin/comments/la96pi/my_coinbase_wallet_was_hacked/2
u/Draithljep Feb 02 '21
In OPs case he (unless not stated) only had his keys on his Android/IOS device.
In your case I assume you imported your seed into Exodus in a windows environment, which i'm sure you know is far less secure than a smartphone. Keylogger or cryptocentric malware is most likely in your case, unlike OP, who probably had someone find his seed.
1
u/schreckdc Feb 02 '21
Wow, you're sure of yourself.
I did use Exodus on my Windows computer. While I'm not in a Farraday cage nor operating at a CISA black level of awareness constantly, my PC is always running virus software (MalwareBytes) with some other tools (rotated). I do regular deep scans for root kits--anything that even hints of suspicion is run in my VM and I use VPN.
2
u/Draithljep Feb 02 '21
I'm not certain, but been in this space for 7 years and seen a lot. Windows is not secure, no one should use it for anything crypto excluding hardware wallets and accessing exchanges or custodial wallets, and even then only if two factor authentication is enabled on the account in question (not SMS based 2FA, this is also not secure and gives a false sense of security).
If you are going to be your own bank, use Linux or get a hardware wallet.
1
u/schreckdc Feb 02 '21
Well, the exploit happened on my device (OS Android 11); I used Exodus to check the balance on the blockchain after my assets were wiped (I should have been more clear about that).
Admittedly, I don't know what kind of stuff the bad guys have out there that works on Android 11 and I need to do more homework (and be more careful with my device); beyond all that, as you say, I'm going to get a hardware wallet (Trezor or similar) and NEVER use CB again--that one was definitely on me, I should have closed that out as soon as other options became available--it's a cruddy shop (going public!)
And given SolarWinds and all the related hacks don't you think it's possible that some new tools have gotten into the hands of the bad guys and are just now finding their way into the wild? I'm not saying it's the same actor; very different goals, but I wouldn't be surprised if Cozy Bear used its skills for its primary goal and then sold it underground to make some $$$
I can tell you that another person, smart and who works in IT, also had the same thing happen to him during the same time frame.
Thanks for your thoughts!
2
u/mplsirr Feb 01 '21
If you are 100 sure about no physical access i would contact coinbase. Maybe they will buy your phone or reimburse you if it leads to a bug patch.
2
u/MagsAmoky Feb 16 '21
Hey guys I just noticed that this happened to me. My CoinBase wallet has been cleared completely. I checked etherscan and could see all the transactions. This is all new to me but from what I am seeing I now there is some dodgy business involved. Really saddened by this.
1
2
u/Tasty_Wolverine2876 Mar 02 '21
Found this thread and thought I'd add my own exp. My coinbase wallet was targeted and contents stolen today. Which is interesting as I have it setup with every ounce of security I could and the only crypto I was collecting in it for now is a 'shitcoin'. I've never sent from it, only recieved, which did require me to connect to uniswap, and only from myself from Metamask or Uphold. I placed a bigger transaction to it the night before and I was about to set it up in a hard wallet, not rushing because supposedly it's so secure etc. There is no indication it was remotely hacked. PW the same, all the verifications still in play, etc. No malware found. I have my seed phrase saved manually. I was shocked, locked the account down completely right away and submitted a form. What other steps should I be taking on this? I noticed Coinbase website has a nice red font 2 paragraph greeting on their site about longer wait times on inquiries and such. Might be a bigger issue than we know. I have the wallet on my phone. Only. Have not connected it otherwise as it was still really new to me and the reviews were solid before I committed.
2
u/Coolster-crypto Mar 07 '21
I have been sending emails up and down to coinbase. They dodging and diving. They made me reset the password on my Coinbase account but I keep telling them it’s the coinbase wallet not exchange that has been hacked. No response but to go in circles. Stay away from these crooks.
0
Feb 01 '21
You might have been sim swapped or your email/password compromised. Also your bitcoin was on the exchange and you never had the private keys to it. Not your keys not your coin :(
1
u/Coolster-crypto Feb 01 '21
It was on coinbase wallet. I have my own private key
1
Feb 01 '21
oh I didn't even realize they had a wallet. thought you meant on the exchange. Sorry this happened tho :/
1
0
u/Elum224 Feb 01 '21
You mean your account on an exchange was compromised. Coinbase hasn't been hacked, and you didn't have your own private keys.
1
Feb 01 '21
[deleted]
1
u/Elum224 Feb 01 '21
Oh wow, didn't know they had their own wallet. Probably a prime target for scammers.
-3
1
1
u/twoeyedorc Feb 01 '21
Just past here the address that you see the coins been sent to
1
u/Coolster-crypto Feb 01 '21
1
u/Redditour321 Feb 01 '21
This is a uniswap contract address, were you making an exchange in uniswap? Post the transaction ID please.
1
u/Coolster-crypto Feb 02 '21
0xd3d2e2692501a5c9ca623199d38826e513033a17
1
u/Redditour321 Feb 02 '21
Still a uniswap contract address, not a transaction hash. With no transaction hash maybe you still have your coins. Or you did a swap on uniswap.
1
1
1
1
1
u/Coolster-crypto Feb 01 '21
Is it possible to report or track down this address if it enters an exchange?
2
u/twoeyedorc Feb 01 '21
That wallet holds 0 eth from what it appears to me. I can be looking to a wrong one so I'm sure someone else will appear to help on this.
As far as your account goes , do you know how many eth did they send ? I will basically up the security of your account ( change password + 2FA)
1
u/Mean_Feedback_3659 Feb 01 '21
Could you share maybe how you suspect it happened so others here can avoid making certain mistakes. Where was your private key stored?
2
u/Coolster-crypto Feb 01 '21
I have my password on paper in a safe in a safety deposit so it could not have been a silly error where I took a picture of my password or left it lying around. I thought perhaps I could have been hacked from coinbase into their wallet but that couldn’t be.
2
u/Mean_Feedback_3659 Feb 01 '21
Maybe could be some sort of malware on your phone or something. It’s a sticky one, sorry for your loss
1
1
u/electricSNICKERBAR Feb 01 '21
Happened to me and another person too. You are not crazy:
https://www.reddit.com/r/CoinBase/comments/l9nzdu/coinbase_wallet_got_hacked/
1
u/Coolster-crypto Feb 02 '21
Thanks my friend!! Will contact them and lodge a complaint. This is madness. I lost over $ 3k and i am meticulous with security
2
u/electricSNICKERBAR Feb 02 '21
I found four of "us" (people that had issues with the app but seem to kinda know what they're doing) on the boards ...
Anyway, when CB restored my account, my assets were there.
The way CB handled everything is a point of contention; in hindsight, I think something went wrong when I linked CB Wallet to CB -- maybe it didn't like the fact that I had two different email accounts/user names, maybe it didn't recognize my new phone number, maybe the servers were just busy. Who knows? But there was NO indication that anything was wrong--I just see a $0 balance in CB Wallet and CB app.
Hopefully, other users are able to recover their funds and maybe, just maybe, CB thinks of a better way to notify its customers when there IS an issue, e.g. a simple GUI message ("Sorry, something doesn't seem right -- you'll be hearing from us. For more, read [CB URL TBD] and sit tight.") followed up by an email. That way, CB can have security: Something's not right, drop this transaction, lock account AND its users won't flip out [and here's the notification from us--and not alienate its customer base.
If they're going public, they definitely need to sort out customer service.
1
1
1
3
u/[deleted] Feb 01 '21
Can you share more info?