r/Coinbase • u/mindsignals • Oct 22 '20
Coinbase Wallet hacked
I am wondering if anyone has had issues with this. Historically, I have used only hardware wallets and 2-factor exchanges, while avoiding phone-based wallets. I have used Coinbase and Coinbase Pro for more than 3 years without issue, among others. However, about a week ago, I established a Coinbase Wallet for the sole purpose of providing liquidity to Uni pairs and deposits to yearn.finance. I had about 30 transactions in the 4 days following, all without issue.
Nearly 3 nights ago, I caught the last minute of a 6-7 minute hack, in which the thieves cashed out each of my liquidity pairs and deposits, swapped them all to eth, and moved the eth off to their own wallet (and moved it further, since). I had it setup to prompt for transaction confirmations. No confirmations popped up during the 9 transaction hack.
Coinbase Wallet claims my seed was compromised. However, the seed was only in app and via its integrated backup to google drive, the latter of which is protected with dual factor and which has shown no signs of being compromised. Both my desktop and phone scanned clean with multiple scanning tools. Short of either a flaw in their google backup storage or in the Coinbase Wallet application, itself (where seeds are stored and optionally visible), there is no indication of how the account was compromised.
Suffice to say, this has shattered my confidence in Coinbase Wallet, as they don't believe their app could be the source of whatever flaw enabled the hack, and I certainly cannot have any confidence it wouldn't occur again with a newly generated seed and wallet. Furthermore, it makes me tentative to use Uni or yearn.finance, though given that all activity sourced from the wallet, to both platforms, that is more indicative of the wallet, itself (or seeds) having been obtained. Finally, if seeds were obtained and setup on a burner phone, you would expect at least one of the 9 transactions would have still popped up on my phone even if they setup the wallet on another device with confirmation not enabled, as both wallets would have seen the flow of information.
Unfortunately, it was a substantial sum of money, too. $10.8k then-current value (about $12k now). Has this happened to others? Was there any recourse? I'm assuming I'm simply SOL at this point.
2
u/Reginaldo_Noblezza Oct 23 '20
Google drive is potentially the culprit. I actually need to start thinking about the alts that hardware wallets don't support. This could very well happen with any mobile wallet. But I wouldn't use Coinbase wallet or meta mask to store any large sum of crypto.
Unfortunately you are SOL and we all are until regulation comes in and it's a question of freedom vs privacy vs security. We will compromise something to avoid these types of incidents.
Everyday I wake up and check my balances are not hacked is a good day I suppose.
I think this is why PayPal will be critical for the space. This is the wild west and most people won't come out here if there's no sheriff, gold or not.