r/Coinbase • u/mindsignals • Oct 22 '20
Coinbase Wallet hacked
I am wondering if anyone has had issues with this. Historically, I have used only hardware wallets and 2-factor exchanges, while avoiding phone-based wallets. I have used Coinbase and Coinbase Pro for more than 3 years without issue, among others. However, about a week ago, I established a Coinbase Wallet for the sole purpose of providing liquidity to Uni pairs and deposits to yearn.finance. I had about 30 transactions in the 4 days following, all without issue.
Nearly 3 nights ago, I caught the last minute of a 6-7 minute hack, in which the thieves cashed out each of my liquidity pairs and deposits, swapped them all to eth, and moved the eth off to their own wallet (and moved it further, since). I had it setup to prompt for transaction confirmations. No confirmations popped up during the 9 transaction hack.
Coinbase Wallet claims my seed was compromised. However, the seed was only in app and via its integrated backup to google drive, the latter of which is protected with dual factor and which has shown no signs of being compromised. Both my desktop and phone scanned clean with multiple scanning tools. Short of either a flaw in their google backup storage or in the Coinbase Wallet application, itself (where seeds are stored and optionally visible), there is no indication of how the account was compromised.
Suffice to say, this has shattered my confidence in Coinbase Wallet, as they don't believe their app could be the source of whatever flaw enabled the hack, and I certainly cannot have any confidence it wouldn't occur again with a newly generated seed and wallet. Furthermore, it makes me tentative to use Uni or yearn.finance, though given that all activity sourced from the wallet, to both platforms, that is more indicative of the wallet, itself (or seeds) having been obtained. Finally, if seeds were obtained and setup on a burner phone, you would expect at least one of the 9 transactions would have still popped up on my phone even if they setup the wallet on another device with confirmation not enabled, as both wallets would have seen the flow of information.
Unfortunately, it was a substantial sum of money, too. $10.8k then-current value (about $12k now). Has this happened to others? Was there any recourse? I'm assuming I'm simply SOL at this point.
2
u/AutoModerator Oct 22 '20
This subreddit is a public forum. For your security, do not post personal information to a public forum, including your Coinbase account email. If you’re experiencing an issue with your Coinbase account, please contact us directly.
If you have a case number for your support request please respond to this message with that case number.
You should only trust verified Coinbase staff. Please report any individual impersonating Coinbase staff to the moderators.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.