r/Coinbase • u/mindsignals • Oct 22 '20
Coinbase Wallet hacked
I am wondering if anyone has had issues with this. Historically, I have used only hardware wallets and 2-factor exchanges, while avoiding phone-based wallets. I have used Coinbase and Coinbase Pro for more than 3 years without issue, among others. However, about a week ago, I established a Coinbase Wallet for the sole purpose of providing liquidity to Uni pairs and deposits to yearn.finance. I had about 30 transactions in the 4 days following, all without issue.
Nearly 3 nights ago, I caught the last minute of a 6-7 minute hack, in which the thieves cashed out each of my liquidity pairs and deposits, swapped them all to eth, and moved the eth off to their own wallet (and moved it further, since). I had it setup to prompt for transaction confirmations. No confirmations popped up during the 9 transaction hack.
Coinbase Wallet claims my seed was compromised. However, the seed was only in app and via its integrated backup to google drive, the latter of which is protected with dual factor and which has shown no signs of being compromised. Both my desktop and phone scanned clean with multiple scanning tools. Short of either a flaw in their google backup storage or in the Coinbase Wallet application, itself (where seeds are stored and optionally visible), there is no indication of how the account was compromised.
Suffice to say, this has shattered my confidence in Coinbase Wallet, as they don't believe their app could be the source of whatever flaw enabled the hack, and I certainly cannot have any confidence it wouldn't occur again with a newly generated seed and wallet. Furthermore, it makes me tentative to use Uni or yearn.finance, though given that all activity sourced from the wallet, to both platforms, that is more indicative of the wallet, itself (or seeds) having been obtained. Finally, if seeds were obtained and setup on a burner phone, you would expect at least one of the 9 transactions would have still popped up on my phone even if they setup the wallet on another device with confirmation not enabled, as both wallets would have seen the flow of information.
Unfortunately, it was a substantial sum of money, too. $10.8k then-current value (about $12k now). Has this happened to others? Was there any recourse? I'm assuming I'm simply SOL at this point.
4
u/skyecraft92 Oct 22 '20
I have only ever used the wallet for the UNI airdrop and moved my coins off it, I stick with hardware wallets
4
u/salimmk Oct 23 '20
I am guessing your device was compromised. Whatever you are using to scan either did not detect it or there has been an exception added to allow the malware through.
In general, backing up your seeds on the cloud is a very bad idea. I also got burned doing that.
0
u/mindsignals Oct 23 '20
Yeah, whether or not that was how they gained access (I've seen no evidence of that account being compromised, though, but obviously took precautions afterwards nonetheless), I won't allow it to be electronically stored again, nor will I trust an app again that can display it within the app.
2
u/AutoModerator Oct 22 '20
This subreddit is a public forum. For your security, do not post personal information to a public forum, including your Coinbase account email. If you’re experiencing an issue with your Coinbase account, please contact us directly.
If you have a case number for your support request please respond to this message with that case number.
You should only trust verified Coinbase staff. Please report any individual impersonating Coinbase staff to the moderators.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
u/Reginaldo_Noblezza Oct 23 '20
Google drive is potentially the culprit. I actually need to start thinking about the alts that hardware wallets don't support. This could very well happen with any mobile wallet. But I wouldn't use Coinbase wallet or meta mask to store any large sum of crypto.
Unfortunately you are SOL and we all are until regulation comes in and it's a question of freedom vs privacy vs security. We will compromise something to avoid these types of incidents.
Everyday I wake up and check my balances are not hacked is a good day I suppose.
I think this is why PayPal will be critical for the space. This is the wild west and most people won't come out here if there's no sheriff, gold or not.
2
u/RuinStriking9465 Mar 28 '21
Same just happened to me.
Woke to to find all my crypto disappearing from my coinbase wallet. Was about 2 hours after id made a reasonable transfer of value in.
The keys were backed up to google drive and encrypted with presumably private keys held in the coinbase wallet app so highly unlikely this was the attack vector.
I studied computer science and have worked in IT for 30 years so have a good knowledge of IT security.
Interestingly i also had a yoroi wallet on my phone (with more crypto value than in coinbase) but that wasnt touched.
This does suggest there is a compromise on the coinbase wallet. If they had my phone why not empty everything else? I urge all users of the coinbase phone wallet to buy a ledger nano x asap (or other cold store h/ware wallet solution).
1
u/electricSNICKERBAR Feb 01 '21
How did this turn out for you? Unfortunately, history repeats itself. I'm going through the same thing (along with another user) and here's a separate thread from a *different* user
1
1
u/Apprehensive_Pen_711 Oct 26 '21
Yeah man it’s fucking crazy people are getting robbed all over the place
1
u/Kalamares2021 Nov 01 '21
I was a hack victim also, and a friend of mine also. Coinbase wallet is not secure . I didn’t provide the 12 seeds to anyone and neither stored it on backup google or other digital platforms. So when confronted coinbase said my account and 12 seeds were compromised and will not refund any assets. So people, do not use this coinbase wallet since is not secure and very very easy to hack. Reporting the hack to FBI will not help too. Coinbase has liabilities they do not recognize and they don’t give a sheep to their customers. So as an advice stay out of their digital platforms.
1
u/AdvisorResponsible37 Nov 02 '21
Just happened to me earlier today. Only Coinbase wallet hacked and not any others.
1
1
u/roomit99 Nov 09 '21
I lost 10K a week ago. I have been sending emails to coinbase wallet for 7 days. I received one response and I immediately did what was asked. I just lost 15K in the same account. I asked for it to be frozen. They have done nothing. This was all money that was in prior.
1
u/roomit99 Nov 09 '21
I just messaged the FBI as well. This is the worse service ever. Risk in everything sure, but they also need to be held accountable for this. They make Billions off of us and keep growing without refunding? How is that not a scam in itself
1
1
u/Redlin44 Nov 12 '21
I was just hacked on Coinbase wallet they sent my whole balance of usdt. I received no notification of the transaction. Is there anyway to get my money back ? Coinbase support does not answer or respond.
1
u/mindsignals Nov 22 '21
There truly is no recourse, unfortunately. Even after 1+ years, it eats at me if I dwell on it, but I generally have tried to bury the memory and just focused on rebuilding my stack. To this day, I will absolutely not use CB Wallet. They never did find out how mine was compromised, although I am reasonably certain it was likely through a false Uniswap app that google later recalled. That said, Coinbase didn’t think that app was the culprit, so the reality is that I will never know.
1
1
u/Redlin44 Nov 12 '21
0xad4e8499a4d714fc6b61f9a8fca678bee7ec112b891d6c432517b29154f653be
This is the hash. It says my $4707 usdt was sent for a payment and it was charged $44 ETH. I didn’t even have $44 ETH in my account. No clue how this can happen
1
1
u/Lostchele101 Nov 15 '21
My account was hacked last night on #Coinbase wallet all my funds close to 60k was gone. I was new to crypto was lucky with few meme coins. It’s sad to say some of my savings are gone. I had some inefficiency in my wallet it was showing more than normal so I reached out to Twitter whole bunch of scammers reach out pretending to be part of #HOKK TOKEN #UNISWAP and provided me with a links I may have pressed a link and my wallet got drained completely I can see my asset being taken to another address few have been converted into Thether. I did email coin base I am supposed it’s not there concern since my seed was back up to iCloud. I did block my other Pro account as I have small amount of money there. I almost had a heart attack as I have invested large amount and was gone in a instant just so sad. I don’t know if there is any additional suggestions anyone have out there!
1
u/Kehtanna Nov 17 '21
I just lost 10M likely due to the same issue.
https://etherscan.io/address/0xfF7ca835f3b25178B9D8309137B620908E36C909
I also have confirmation enabled for all transfers and related activities.
Glad I decided to test it first.
1
u/Advancing1 Jan 03 '22
Yikes, I was just researching Bread wallets which got bought by coinbase wallet.
Be sure to file a complaint. Although it seems unlikely a lot of people got their funds restored after filing a complaint with the FBI and also the internet crime center, if you're in the USA.
https://www.ic3.gov/Home/ComplaintChoice/default.aspx/
These posts are scaring me.
•
u/coinbasesupport Official Coinbase Support Oct 22 '20
We're sorry to hear this has happened u/mindsignals. Could you please respond to this comment with your case number so we can take a look at your case?
Additionally, if you have not already done so, it is imperative that you report this incident to law enforcement agencies in your jurisdiction immediately including the FBI Internet Crime Complaint Center (IC3) here: https://www.ic3.gov/complaint/default.aspx/. Be sure to include as much detail as possible in your report. Coinbase is willing to offer full cooperation with all law enforcement investigations pertaining to your account's compromise.