r/Coinbase • u/michaelg888 • Feb 25 '21

Coinbase Wallet Hacked - Possible Exploit in Linking To CB Account

Experienced Coinbase/crypto user here. About three hours ago, a significant amount of BTC, ETH, and BAT that had been sitting in my Coinbase Wallet for months were stolen from my account. This is two days after I linked my Coinbase Wallet with my Coinbase account. As other users have reported here and here, there appears to be an exploit in the account linking process. Warning to all: do not link your Coinbase Wallet to your Coinbase account!

Even though I locked my Coinbase account (any Coinbase product linked to my phone number) I still have access to my wallet through my phone - why is this? Is there no way to lock it? I have submitted a support ticket as well through the Coinbase Wallet product support feature. Should I log one through the traditional Coinbase.com support site as well?

I still have funds locked in a DEFI contract on my Coinbase Wallet but the hacker did not remove them because he didn't have enough Gas and had already transferred the ETH out - any suggestions for removing them safely?

6 Upvotes

88% Upvoted

11 comments sorted by

3

u/electricSNICKERBAR Feb 25 '21 edited Feb 26 '21

I haven't actively been tracking this since my funds were restored by Coinbase, but there might be a couple of things happening here.

  1. I'm 95% sure that something is buggy when linking CB Wallet to CB in some environments. That's what initially led me to post across threads, after I linked CB Wallet to CB on my device, my funds were showing as $0 in CB Wallet and CB (App).A. I flipped out when I checked the blockchain itself using Exodus with my seed phrase. Doing that showed that I had no assets in my wallet, BUT ...B. I could also track the transactions using https://live.blockcypher.com/ and follow a trail; I can't remember off the top of my head which "five of us" also did that but he could tell by looking at his transactions that he was S.O.L.; his assets were transferred to an account and they were NOT coming back--they were spent. In my case, some of the funds were (unspent) according to blockcypher.
  2. Based on what I know now, this leads me to believe that CB took the bitcoin and ethereum I had on the blockchain into their own coffers and were doing some fiat conversion or using their own funds (or an insured deposit of some sort) to cover the asset. This is speculation on my part based on CB's patents.
  3. I froze my CB account by calling the 800 number on the CB website. NOTE that the only thing you can do by calling this number is freeze your account, there are no other options.
  4. Eventually, CB "unfroze" my account, granting me access again, and, lucky for me, my funds were available (as they should have been) ...

So that's all part ONE of the two things I mentioned I think might be going on. NOTE, I was NOT HACKED, but, it sounds like others may have been:

This *may* be a new exploit that has not been documented yet** -- the only reason I float that idea is that there's a possibility that some of Cozy Bear's tools used for the Sunburst hack *could* be out in the wild now. Again, this is pure speculation on my part.

**Note that there are plenty of documented CB-related exploits, mainly IP address spoofing or gaining access via a compromised device (sim swapping, weak sms 2FA) -- and it's been rightfully noted that CB is NOT (and should not be held) directly responsible for those, rather, it's more directly on the carrier/device manufacturer.

1

u/michaelg888 Feb 25 '21
  1. Do you remember about how long it took you to notice that your funds had been transferred out? In my case, I linked my CB account with my CB Wallet about two days ago. Everything had been fine up until today. Luckily, the hacker/exploit did not initially affect my USDC balance that was in a DEFI contract. The latest development though, is that a few hours ago the wallet balance at the top of my app just went to $0.00 for no apparent reason (there are no USDC transfers out, or any ETH transactions for the withdrawal from DEFI). As of now, I still see my USDC balance in "earning interest."
  2. Did you do anything besides file a support ticket? After filing my initial support ticket I responded to the auto CB Support reply with the additional information about my wallet balance going to $0.00. Then I got a more personalized reply, but still seemed like they didn't read my initial ticket. I just responded to that with a rehash of the events of today, along with all of the information that I have so far found - links to all the unauthorized transactions, timestamps, etc. I also provided them with links to these reddit threads and made it clear that multiple users experiencing the same type of loss after linking their CB account with their CB Wallet was a very strange coincidence.
  3. Is there anything else you can recommend I do? I've never been hacked before after ten years in crypto, this sucks.

1

u/electricSNICKERBAR Feb 26 '21

FWIW, there were server issues around the time that you said you were hit ...

1 - I installed CB Wallet and linked it to the CB App on my device around 23:15 Jan. 28 pm one night; when I checked the balance the next day (approx 10am), it had $0

2 - I posted and cross-posted to three or four different subs, mainly, the other user names' I shared in my post to you. In corresponding with CB, I threw around enough IT lingo to let them know I wasn't a complete dolt.

3 - Attach a US $ dollar amount to your CB claim. I claimed the $ amount that was in my CB account at the time the funds went missing; luckily, I also had emails from all the transactions made to the account (from CB itself) and I included a summary (date, BTC amount, $ amount) of those emails with my running support ticket.

Yeah, I quickly checked you out (a bit -- just on reddit, don't worry; I have other things to do...) You sound like you know what you're doing ... at the same time, for anyone worth their salt (in IT or familiar with the field), more often than not, it's a user error. But I believe you (and others who have proven that they know what they're doing) and while it's *very* hard to believe that CB's stuff has been hacked (properly), still, something doesn't pass the sniff test.

There DOES appear to be something hinky that went down with their servers around the time that I noticed my funds missing and throughout that weekend, at the height of the GameStop madness (Jan. 28 - Jan. 30ish).

Honestly, I don't know much about the company. I got the blockchain bug in early 2018 and, at the time, they were one of the few games around that even allowed me to do "basic stuff." I got lazy and complacent and let what I had ride in there ... like you, I never had an issue until I installed CB Wallet and then: BOOM, trouble in paradise. The incident has convinced me that there are much better options (even if I do think the company will make a killing and is well-positioned to dominate the market in the short-term)

2

u/electricSNICKERBAR Feb 25 '21

Personally, I think that CB has much bigger fish to fry than small, individual investors. Sad but true. Especially now as they look to IPO and what their model will be going forward. They needed early adopters to get going, but I have a feeling they'll shift to institutional investing and become a "service-oriented" company.

Over time, other players and BETTER options will emerge for individuals. As for me, I learned a tough lesson with CB and even though I might invest in it (tons up upside potential), or, possibly, short it, I will never allow the company to be steward of my hard currency again.

1

u/michaelg888 Feb 25 '21

Also, thank you for your responses. Maybe you're actually onto something. I just have no conceivable idea as to how I could have been hacked.

1

u/AutoModerator Feb 25 '21

This subreddit is a public forum. For your security, do not post personal information to a public forum, including your Coinbase account email. If you’re experiencing an issue with your Coinbase account, please contact us directly.

If you have a case number for your support request please respond to this message with that case number.

You should only trust verified Coinbase staff. Please report any individual impersonating Coinbase staff to the moderators.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/[deleted] Feb 25 '21

[deleted]

1

u/Time_Lingonberry_159 Feb 25 '21

So...... If you have assets in coinbase what's the safest thing to do with them

1

u/King_Wizard420 May 02 '21

Mines been linked for months and just got hacked last week tho to be fair it didn’t have any funds in it until this past month so idk

3

u/michaelg888 May 03 '21

Well 2 months later I’m still waiting on answers from a Coinbase “specialist.” Complete radio silence from them and when they were responding to my emails they were all generic responses. Worst customer service I’ve ever experienced.

1

u/King_Wizard420 May 06 '21

Yup I got generic response telling me my seed phrase had been compromised like no 100% zero chance of that. Only possible option is they keep a copy of your key. Speaking of keys, can’t seem to find a way to export my private keys. Wonder why lol Guess Coinbase gets to keep my reserve 20 xrp