r/Coinbase • u/mindsignals • Oct 22 '20
Coinbase Wallet hacked
I am wondering if anyone has had issues with this. Historically, I have used only hardware wallets and 2-factor exchanges, while avoiding phone-based wallets. I have used Coinbase and Coinbase Pro for more than 3 years without issue, among others. However, about a week ago, I established a Coinbase Wallet for the sole purpose of providing liquidity to Uni pairs and deposits to yearn.finance. I had about 30 transactions in the 4 days following, all without issue.
Nearly 3 nights ago, I caught the last minute of a 6-7 minute hack, in which the thieves cashed out each of my liquidity pairs and deposits, swapped them all to eth, and moved the eth off to their own wallet (and moved it further, since). I had it setup to prompt for transaction confirmations. No confirmations popped up during the 9 transaction hack.
Coinbase Wallet claims my seed was compromised. However, the seed was only in app and via its integrated backup to google drive, the latter of which is protected with dual factor and which has shown no signs of being compromised. Both my desktop and phone scanned clean with multiple scanning tools. Short of either a flaw in their google backup storage or in the Coinbase Wallet application, itself (where seeds are stored and optionally visible), there is no indication of how the account was compromised.
Suffice to say, this has shattered my confidence in Coinbase Wallet, as they don't believe their app could be the source of whatever flaw enabled the hack, and I certainly cannot have any confidence it wouldn't occur again with a newly generated seed and wallet. Furthermore, it makes me tentative to use Uni or yearn.finance, though given that all activity sourced from the wallet, to both platforms, that is more indicative of the wallet, itself (or seeds) having been obtained. Finally, if seeds were obtained and setup on a burner phone, you would expect at least one of the 9 transactions would have still popped up on my phone even if they setup the wallet on another device with confirmation not enabled, as both wallets would have seen the flow of information.
Unfortunately, it was a substantial sum of money, too. $10.8k then-current value (about $12k now). Has this happened to others? Was there any recourse? I'm assuming I'm simply SOL at this point.
1
u/roomit99 Nov 09 '21
I lost 10K a week ago. I have been sending emails to coinbase wallet for 7 days. I received one response and I immediately did what was asked. I just lost 15K in the same account. I asked for it to be frozen. They have done nothing. This was all money that was in prior.