> The company said the hacker stole customer names, postal and email addresses, phone numbers, and the last four-digits of users’ Social Security numbers. The hacker also took masked bank account numbers and some banking identifiers, as well as customers’ government-issued identity documents, such as driver’s licenses and passports. The stolen data also includes account balance data and transaction histories.
I wonder what percentage of Coinbase's (but also any other company storing PII data) support is done by AI at this point, and whether they could focus on and invest much more heavily to make that as close as possible to 100%.
I mean... wasn't coinbase sort of scammy to begin with? Several years ago I gave them some USD, turned it into BTC, saw the value of the BTC go up, but when I tried to cash out was told that wasn't a thing that was supported by their platform. Later I was told I could apply for a $399/year credit card and could partially pay off the balance with BTC sale proceeds. I'm sure this was all disclosed somewhere in the terms of service I clicked through, and I only lost $1000 to their scheme.
But I've always wondered why people think this is how investment vehicles work. I monkeyed around with stock market bets and even Robin Hood allows you to cash out of your positions.
It's more likely you didn't "lose" $1k, but that you had "missed profits". And if you missed the profits because you didn't verify yourself earlier for withdrawal, then that's on you.
Coinbase supported direct bank withdrawals well before they launched their crypto debit cards.
I dunno why you had problems, but I've been using Coinbase with no problems at all for years. It's linked to my bank account, so if I want to pay for something with bitcoin, I can easily buy and send bitcoin with just a few clicks. I don't invest or speculate in bitcoin, so I only maintain a small account balance. And selling bitcoin and transferring the proceeds to my bank account has been just as easy and trouble-free.
So obviously he's not the bad guy here, since his hood is down. :)
Yet he's a bit urban edgy here, and the staging is like it's an impromptu social media reaction to some online slight. (though reading a script)
You don't want to go full South Park "We're sorry", but I'd feel better about a response in a business dress shirt, out of respect for wronged customers.
With a bit more humbled posture.
IMHO, you're answering to customers you've wronged, and you don't wear a hoodie to church nor court (nor do you play video games during a live TV interview), nor do you assert superiority over the people you let down.
You can convey respect and humility, while also conveying being capable of responsibly resolving the problem.
(Just one person's reaction. I see some things the video did right, IMHO, but some other things jump out as wondering why they did that.)
The article says they sent an email, but I usually ignore emails from Coinbase. I hope there's going to be a better way to find out if your data was breached. I was locked out of my account before, and had to upload an ID. I thought they didn't store it... :o
Whatever you think of Coinbase, this is a pretty good response IMO:
> and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible
I’d say the better thing for customers would be to pay the ransom demand and get the PII back. If they want to fund a reward scheme too, well great, but if it were my data, I’d care more about Coinbase limiting the breach of the data, not playing around with retaliatory rewards.
There is no guarantee that an anonymous criminal is going to hold up their end of the agreement. Coinbase has no idea who they're negotiating with or where that data has been shared.
That, and they're reimbursing customers who were tricked.
In addition, paying the ransom would be an open invitation for everybody else to try the same attack, with the net result that all customers are less secure in the long run.
I love it. This also would have been a great opportunity to break out of corporate speak for a moment for a good “Up yours hacker assholes!” Even us folks in the Bible Belt appreciate a well timed swear word here and there.
No it isn’t! The headline they used is “Protecting Our Customers - Standing Up to Extortionists.” My issue with it is that they word their announcement in a way that leads people to congratulate them instead of saying we’re sorry for leaking your private information. I’m so angry at them over this.
Additionally the email they sent me had the subject “important notice” and that my personal account was affected as the third sentence in a rather wordy paragraph. None of this is ok and this is not a company taking this seriously.
Yes, but I do think an organization like Coinbase or a cell phone carrier - which are extreme targets of fraud - have an obligation to recognize that their employees are targets and implement greater security measures than most organizations. Maybe Coinbase should even pay higher wages and use onshore customer service agents.
How are you going to vet people to find out if they're vulnerable to bribery? Offer them a bribe during their probationary period, during which they only have access to fake customer data?
You can do a background check, but the reality of the matter is that you pay citizens a living wage to do the work instead of offshore it into a country that pays pennies.
Bank tellers can take thousands out of the vault at any time and yet it seems it’s not a very big issue.
Bank tellers are constantly surveilled by cameras, security guards, and several-times-daily cash counting, and it's still easy to find accounts of them having stolen significant amounts of money before getting caught. These are all from within the last year:
Being US citizens doesn't make people incorruptible. In fact, many other countries are less corrupt than the US. Someone in this very thread reports having witnessed bank tellers getting bribed in one of those countries: https://news.ycombinator.com/item?id=43996765
I've been through a background check designed to screen out people who were vulnerable to bribery. They interviewed my friends and family from the previous several years to find out if I was secretly gay, cheated on my wife, gambled, drank too much, used illegal drugs, or had money problems for some other reason. It took about a year. I think it would be hard for a financial institution to be economically competitive doing that kind of thing with their call-center workers, because their customers can't tell if they're secure or not, just how much their services cost.
Then shift liability and let the insurers take care of it.
With a lot of this online stuff, no matter who gets your password or access to your account it’s you who has to take care of it. Whereas if the bank teller steals from the till it’s not your problem.
> you pay citizens a living wage to do the work instead of offshore
But what about the capital class? How will they afford more yachts? So sad. They're.. um... job creators or something. Anyway, that's what Fox News told me.
Bank tellers do steal money from the banks they work for though and banks invest a significant amount of resources and have a lot of policies to prevent it.
For example at many banks the teller might need to get manager approval for some cash withdrawals, even for seemingly smaller amounts of money. Despite what it may seem, it's not because of some distrust towards the client but a safeguard against internal fraud.
You are writing this as if you know what countries Coinbase's call centers are located in and the role of organized crime in their economies, but you don't actually know either of those things.
Lol, that's because while Coinbase emphasizes its commitment to security and compliance specific details about the geographic distribution of its offshore personnel are not disclosed in its public filings.
My perspective was more "That's because you post contentious statements in public fora with no reason to believe that they are true, hoping to get a big reaction by offending people."
> ...bribed AT&T employees at a call center in Bothell, Washington, to "use their network credentials and exceed their authorized access to AT&T's computers to submit large numbers of fraudulent and unauthorized unlock requests on behalf of the conspiracy and to install malware and unauthorized hardware on AT&T's systems," according to the indictment.
> ..install malware and unauthorized hardware on AT&T's systems
That's not as harmless as unlocking phones early. A major carrier that has access to texts, geolocations, and call logs being hacked like that is extremely concerning.
Let me add to your statement. It is hard to keep call center workers bribe-proof WHEN they are paid peanuts AND they are working for a company that is in an extremely high risk business of managing crypto.
correct, but what's the alternative? they're paid peanuts because it's not exactly the kind of job you ever pay out the wazoo for. the only thing that comes to mind if I'm Brian Armstrong is going all in on AI bots that can get to 90% of the way there (maybe 95%) and then have domestic based humans that are paid more with (presumably) a less probability of being bribed. but realistically, the only way to stop something like this is going 100% AI bots but then that comes at the expense of customer satisfaction, and also bots that are exploitable through prompt manipulation.
alternatively limit the roles and what the offshore people are able to do, but then any escalation means domestic people, which brings us back to "well at that point just use AI to automate easy tasks"
Normally payment should follow the amount of power/responsibility. If you pay someone peanuts but they have root access to prod, then you should pay more or restrict their credentials. Same applies to being able to access PII.
Small set of privileged employees who work from the home office and are compensated to match. If an issue requires their attention, it takes time to resolve. But it's resolved securely. In essence, what Google does.
Alternative is the banking model. Low-cost customer service massively empowered and just eat the costs of breaches as they come.
What Google does is “don’t resolve shit”. When I was a Google Fi customer paying $60-80/mo, so more than the vast majority of Google users, their customer support was completely useless (but at least polite, I’ll give them that). They did take their sweet time, kept promising to call me back after each fruitless call I initiated but didn’t, so you’re right about “it takes time to resolve” I guess.
My multiple banks’ customer service is meh but they do resolve problems and as far as I can tell, haven’t leaked any of my stuff yet in decades. That you think “what Google does” is better than “the banking model” is amusing.
Oh totally. I’m just defining the poles of the spectrums. Someone has to eat the cost, whether it be in friction and inconvenience or reimbursing fraud.
You can take the Google approach of basically not empowering the agents at all. It's not worth trying to social engineer Google CS, because they can't do anything anyway.
The question was about customer support. AML and KYC regulations do not require that customer support persons know your PII. That can be kept firewalled from them.
Isn't the whole point of crypto to keep PII out of it completely? If not, what is all this non-sense for exactly, other than the typical goals of pyramid schemes?
The main point of crypto IMO is to have a large-denomination bearer asset.
This is overlooked most places but if you examine around the time the FATF finally pretty much eliminated bearer bonds, bearer stocks, and large bank notes was exactly the time crypto really took off.
yes. IIRC ~2015 was when the last of bearer bonds/shares were pretty much all completely immobilized. I can't recall when the last ~1000 USD equivalent banknotes were printed but it was also close to that time.
It's simple. They want to centralize crypto and dickheads like armstrong are happy to be in line to make that happen. Just look at tether, what's the point of it? It's nothing but a front for inflating the price of bitcoin. It has NEVER been audited and has been found to NOT have any USD backing at all
Which is such a lame and flawed mechanism to avoid letting them access anyone's data. I mean what are you even trying to prove here? That banks care about customer's security when they can't even implement a secure 2FA which is not just an unencrypted text message
“Give a man a gun and he can rob a bank, but give a man a bank, and he can rob the world.”
That there are more options than holding your hands up and arguing the company couldn't have done anything further in terms of implementing effective controls.
CS can validate without knowing the details, the same way you don't enter a password and then check to see if that matches the password in the system.
The fact that they keep blaming overseas customer support is pure blame shifting - you still hired someone and gave them access to all this data, Coinbase!
Bribes are one thing, but threats could also happen. This is a big part of the reason why I absolutely hate entities that think residential addresses should be public record.
This is a precedent to Coinbase employees getting physical threats at their door just because e.g. some voter registration, utility company, bank, credit card, or court record decided to release their name and addresses on the internet. People could show up at some Coinbase software engineers' apartment doors with guns demanding they send BTC to arbitrary addresses.
AFAICT it's impractical to keep residential addresses 100% private/secure - too many ways to get an address from any number of companies, organizations and governments that collect it for various reasons.
Plus numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit, etc.
Finally, shutting down paid data brokers seems virtually impossible in practice, which means anybody googling you can pay $20 and get everything.
Remember, the issue isn't lazy goodguys but even slightly motivated badguys, who then use third party scripts to do the data collection.
> shutting down paid data brokers seems virtually impossible in practice
Just jail them. Make it a felony to release someone's PII without their written consent, and make data brokers illegal to begin with.
> numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit
These are not the main vector of transmission of personal information. Yes, Meta could probably do some graph analysis and infer this, but it's a lot of work, and their data leaks are rare in comparison to all the other companies, financial institutions, and governmental organizations, that freely post residential addresses on the internet and to data brokers for the world to Google.
> companies, organizations and governments that collect it for various reasons
KYC requiring addresses should be banned. Companies should not collect a residential address.
> Coinbase didn't adequately secure sensitive customer information, and it was leaked
Practically every company has someone with credentials who is in some combination of debt, a damningly-adulterous relationship, a damningly-illegal substance relationship and/or feels underappreciated or slighted compensationwise. The question is generally how much it costs.
Which is exactly why insider threats should be explored as a threat-model and mitigated to make the blast radius as small as possible via rate PII sanitization, access controls, access monitoring, rate limiting, etc.
The odds are already against their future viability after a breach like this and if they're fumbling the response this bad it really doesn't bode well for them.
They would have been better off not even bringing up their location if they weren't going to be transparent.
There should be an ISO standard with respect to how much power and information that front line customer support agents have. The more information you need, like changing passwords or accessing personal information, should get forwarded to higher level customer support agents with better training and more monitoring. This way you can design customer support experience with as little exposure to security issues as possible.
They main defense against internal attacks is bookkeeping. Banks have been dealing with this for thousands of years. I recommend the corresponding chapter in Security Engineering by Ross Anderson: https://www.cl.cam.ac.uk/archive/rja14/Papers/SEv3-ch12.pdf
The CS reps are based in a LCOL country so the opportunity for theft is simply incredibly lucrative.
What is really needed, is customer-in-the-loop for access to their data. The problem is, not all accesses would make sense. Doing analytics over the data of the top 1% of customers, for example, requires some level of access, but would freak out those customers if they had to approve it.
What about, for example, a higher-tier support person performing QA over someone else’s work? What about DFIR teams doing research on potential abuse? Etc etc.
It will happen (at least attempted) with on-shore support staff too, My next door neighbour used to work for a UK high street bank and even there support staff were approached, with some of them first befriended, and eventually bribed in to passing along PII. No doubt it happens in the US too. Just costs the bad guys more.
> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States
yea that is what they get. Hope this hurts them bad.
At my last job for a "casual dating" app, all new account verification stuff was sent to some shop in the Philippines. I got involved with troubleshooting some random DB locks that were causing down time. Ended up discovering that this firm tried to automate the verification process with some scripts or something that would sometimes go haywire and send over 100 requests per second to the new account admin portal which would bring down the entire site. Management just asked them nicely to be more careful which brought the peaks down to 80 requests per second which the back end seemed to be able to cope with (just barely). They couldn't careless that there were supposed to be humans looking at this data and they were clearly trying to automate that part out. Even worse, once I started looking at the data that was in the portal, it was credit card name and billing addresses, and DL license or passport scans. Before I could really further fix the performance issue, I was laid off. Then a few months later they did another lay off which cleaned out every american employee. This was an american company that had ~150 american employees and now there are none. Just two execs at the top that get to watch the money roll in while they farm out everything to overseas. Really pisses me off bad >:(
>On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection.
Also, "Coinbase had detected the breach independently in previous months", aren't they required to disclose this? In the EU they are: Every EU institution must do this within 72 hours of becoming aware of the breach, where feasible
The problem is that it seems like the data that leaked is also the data that would be used to do account recovery.
And what that means is that
1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore.
2) Hackers can try to “recover” accounts now using this leaked info.
This is a huge problem. What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)
The only solution here is: hardware 2 factor like yubikeys.
> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)
Cryptocurrency firms exist in a quantum superposition of bank and not-a-bank until you interact with them, at which point they collapse into whichever state costs them less money.
lol they even do fractional reserve things like banks, except they're more shady and don't acknowledge it, now I'm either connecting dots that shouldn't be connected or some withdrawal locks that happened through some big arbitrage opportunities were very suspicious.
I mean this isn't the criteria you're looking for but I can trade assets within coinbase's website. It looks like a stock trading platform. I don't for the record.
I don't think commodity, forex or stock trading is built into any bank interface but I don't have enough money to know for sure.
Watching crypto enthusiasts run into every problem that society already tackled with in the past when developing currency and its controls, and then coming up with solutions that look exactly the same as what dirty fiat currency uses, has been a source of much entertainment the past few years
Yes, I think I’m familiar with the crypto enthusiasts defenses that all boil down to looking at a single aspect of their system in a vacuum and not realizing that if anyone wants to functionally use crypto as a currency and not as a speculative asset or tool in crime, then all these aspects actually have to work and work together
I don't really care about crypto personally (volatile shitcoins) but I think that's a straw man argument. They all know it gets troublesome when it comes to dealing with fiat transactions. The hardcore crypto enthusiasts want to avoid fiat entirely.
If only hardcore crypto enthusiasts who didn't want any fiat had cryptocurrency bitcoin would be worth a couple dollars a piece and 99% of other cryptocurrencies wouldn't exist. The vast vast majority of people who have crypto are doing it because they think they can get rich from it and that's why anytime it's talked about it's talked about in terms of fiat values
But they need exchanges to get real money to flow in and out of cryptocurrency easily. Without it, cryptocurrency by itself would likely be worth far less than it is today.
Yes that's true, but no need to hold your crypto there as a permanent storage. Once your fiat is exchanged to crypto, immediately transfer the crypto to your private wallet.
As opposed to the bank's ...? Or your other account's ..., what exactly, passwords? Phising is everywhere. How many times have you heard the elderly have their money stolen, both online and in real life? It happened to my grandma. The mailman is bringing her own pension as cash, and guess what, he has scammed my grandma for years! The food delivery guy who has been delivering lunch for my grandma, guess what he did? He scammed my grandma out of her money! We are talking about cash, right now, and no phising involved, just good old "lying".
Hence why cryptocurrency would never replace regular banks for regular people. The situation with scams and thefts has only gotten worse. Not your keys, not your coin.
Cryptocurrencies are not classified as securities. Bitcoin and Ethereum, the largest cryptocurrencies, were both declared as non securities by the SEC.
As I understand, the root of the problem is that Coinbase kept lot of sensitive information, including photos of IDs. If Coinbase was fully anonymous, and didn't require any KYC, the impact of the leak would be insignificant because it would be difficult to link user number 12345 with some real-world person.
So if we want to constrain impact of such attacks, we must make companies keep less data and delete them faster. For example, instead of storing a photo of ID, store just a checkbox that the person showed their ID and it was valid.
This applies not only to cryptocurrency, but to any company like Google, Uber, Amazon etc - if they didn't keep extra data, there would be little value in the leaks.
So the blame is not at cryptocurrency, but on companies not wishing to delete the data and governments demanding them to collect the data not necessary for operation. It's the government and capitalists who create problems out of nowhere.
> store just a checkbox that the person showed their ID and it was valid.
Doesn't work at scale. You get bribes, rogue employees, socially engineered employees. In the US, look up the articles about phone/SIM unlocks and SIM card copies. Russia has a problem with e-signatures, that most people have no idea about. It's possible to sell somebody's real estate with one of these. Loans granted just based on passport data. Neither politics nor media highlight these issues. Overall in this case your suggestion tries to handle the symptoms of the KYC requirement.
Here's a more extreme treatment: let people change their full legal name at will. Gender's already kinda possible.
In Russia one can change their name, although it is a lot of pain as you need to change it in all agreements (like bank agreement) and documents. So a better idea is simply not store customer names.
> every problem that society already tackled with in the past
More KYC creates more problems while solving some others. Why didn't the same society despite KYC/AML tackle the problem pointed at in a previous comment? "Florida teens kidnap Las Vegas man, drive him to Arizona desert, steal $4M in cryptocurrency"[1] Why is there this crime?
Without mandatory KYC laws, this particular attack would be near pointless. No name tied to account, bookkeeping doesn't archive wire transaction details for the past 10 years.
Let businesses easily accept cryptocurrency (like... regular cash?), without a blade to their throat held by the government, and the need for such centralization points will greatly diminish. People get in trouble by p2p-exchanging money with unknown peers; in some instances this "trouble" has the unit of "years".
It's in nobodies' interest to protect cryptocurrency payments as the alternative, other than the activists, and the big groups jumping in on it for the speculation purposes - something they had refined decades ago. There's CBDC is on the horizon.
Yea see the problem is that you are arguing under some implicit idea that you’ll just accept the results of the system.
Every single crypto property I’ve talked to has ended up at a point where they believes that someone cheated them outside the bounds of the system and then look to authority figures to rectify the situation, like the government.
If you are someone who actually believes that crypto transactions should be unmodifiable by any third party then what you said makes sense. I just don’t think that anyone telling me they believe that isn’t lying to themselves at best, and lying to everyone else at worst
> unmodifiable by any third party then what you said makes sense.
You are right, I do. The same reason I don't think the cryptocurrency is for everyone. And the reason I accept this, is because "traditional institutions" still can be "easily" gamed: enough cases of social engineering around to be considered a norm. Where law enforcement won't try enough or can't do enough to return the money transferred to a hostile account. Following this, if someone smart enough to avoid the banking scams, they are probably smart enough to manage their own wallet safely.
> Without mandatory KYC laws, this particular attack would be near pointless. No name tied to account, bookkeeping doesn't archive wire transaction details for the past 10 years.
But this attack is already fully pointless with traditional finance. You can't steal someone's bank account at gun point.
Conversely, even without KYC, blockchain based currencies paint a huge target on anyone who uses a small number of wallets to store a large amount of money. Dedicated criminals and even state actors can figure out who owns the wallets by tracking transaction patterns, getting information from vendors, etc. As long as you're actually using your crypto wallets (unlike, say, Satoshi), you can quite easily be tracked. Anyone who you order a pizza from in BTC knows the address of whoever has that wallet. Sure, you can take a lot of steps to protect yourself from it, but it's hard, and one slip-up is all it takes. Opsec is not for the careless.
Also, crypto's reliance on secrets instead of legal personhood to ascertain ownership fundamentally makes it prone to stealing money in this way. Since the money doesn't belong to a legal person, but to whoever knows some secret key, that key can be stolen from whoever has it through simple violence. Even if you're extremely careful not to leak details of your accounts, use XMR for untraceable payments, etc - someone who is physically close to you could see that you're rich and decide to attack just on the chance that you may have crypto, without knowing anything specific.
Good points overall, thank you. This one could be managed by wallet software that'd do its own account tracing in order to separate your histories by generating new addresses for incoming transfers.
> physically close to you could see that you're rich and decide to attack just on the chance
The wearers of premium watches or smartphones don't seem to be concerned for their safety. For an increased payout they could be followed to their home. I think https://xkcd.com/538/ strucks either way.
... I think this is a good counterargument: what's the difference between a wallet and a banking account when everyone today can issue a wire transfer from the comfort of their home. Instant payments and all that. It just adds an extra step of waiting a couple more minutes for the transaction to come through. I assume the money laundering step is figured out by the criminals doing this to you.
Zelle is ultimately a bank transfer. Yes they say to consider them like sending cash, but a bank transaction is at least tracable to a real account owner, who could then be pursued in the case of fraud, and it well might be reversible if push came to shove or if there is documented fraud.
I know it's the massive exception but I was reimbursed when the exchange that tried to rugpull its users felt legal pressure. Things have changed slightly over the years - don't get me wrong, scams are still rampant.
It's been ages since I was in college and had an overdraft or some other bs bank related fee, but the bank manages to 'scam' you legally too. I'm just playing devils advocate and sharing an anecdote, I'm minimally involved in crypto anymore.
When I was "hacked" two years ago, their final hurrah before I finally got everything offline for a time, they sent zelles as much as they could and was able to recover it without any loss on my end.
If YOU are the one sending the money of course it is not a hack etc becuase YOU are sending it. If Zelle is hacked and someone steals your money through that hack you will not be left with the loss.
Coinbase is identical to a bank because it holds customer funds. Your comment isn't quite the dunk you think it is. Blockchains allow money to be held anonymously without any banks involved. Centralized exchanges are just profiting on speculation and probably should be banned.
My money in the bank in case of fraud is protected unless I voluntarily gave the fraudster my money. If a bank goes bankrupt, my money is protected by the government
First one might be kind true in the US. Second one is only true up to $250k and how much Yellen likes you. But they are not true around the world and probably for most of it.
By law yes it’s only $250K. But when the banks collapsed last year, the government made sure that no one lost money. In fact, no one has ever lost money because of an FDIC insured bank failure.
No they don’t. “Cryptocurrency” isn’t money at all. Just because you can trade it in for money, doesn’t make it so. I can also trade in my hat to the Buffalo Exchange for money. But my hat is not money.
Except for, you know, being able to spend it where you buy things? And deposit it into an actual bank? Those seem sort of intrinsic to how we use money today.
> Except for, you know, being able to spend it where you buy things? [...]
The extent to which you can use it to buy things is a good metric, but I think that comes in varying degrees rather than being a sharp line or binary true/false. There are at least some things you can buy with cryptocurrency, and arguably there are some forms of "regular" (fiat, national, government-issued) money that aren't very widely accepted.
what's more important to me is how quickly can you trade your hat, how quickly can you determine the marketable value of your hat for selling, how close in value can you buy that hat for the same price you sold it, how many hats can you buy or sell at that price?
and that's where hats fail in all metrics to cryptocurrency and how cryptocurrency satisfies my criteria for money
Yeah, it would be more accurate to say that Coinbase is de facto a brokerage but does not have the same level of regulation as traditional brokerages. The result is the same though.
One that I'm using does, but I find it extremely annoying when they have me go to a branch to unblock my account that they locked due to a poorly calibrated risk system (that they need due to not supporting actually secure 2FA methods).
> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted
> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted
People getting locked out of their account (which can happen due to no fault of the user, e.g. by an overly nervous risk system) will be really happy to have to potentially travel to a different city to regain account access...
Fine, make it optional. I actually would love a version of cold storage that is: never release this money unless I personally travel to an office if NYC and authorize it.
If you ever sent money to or from a wallet you control, I'd think a reliable recovery factor would be to use that key to sign a message that Coinbase can verify with the address in their records. Cryptocurrency after all is just another PKI.
And dumb-dumb me just realized how trivial that would be to break. Social engineer someone into sending/receiving money to/from your wallet then pretend to be them requesting an account recovery.
Coinbase would have to make you sign a challenge ahead of time that would mark the wallet as the authorized public key for your account.
Roll out an update that defeats the end to end encryption in some subtle way that wouldn't go noticed for a few days. They'd be told when to do it for maximum effect, and if the window is small enough it might even go unnoticed for far longer when another uncompromised update overwrites it. They have no duty to report such things to relevant authorities even if it was discovered internally, so you could be looking at some corporate coverup that while not in on it, seeks to minimize liability/embarrassment.
Really, can you possibly tell if your Signal messages were compromised? Now that iPhones aren't really jailbreakable, you can't even see inside your own device.
Under specific conditions, the client can communicate with malware already on device, save data locally for other software to pick up, or downright stream the decrypted software to a third party.
Most likely is to introduce a flaw in the client that can be used by other walware on the client.
It's really unfortunate that KYC regulations required Coinbase to have this information in the first place. We should be establishing strong social norms against sharing PII without a legitimate reason; this is not just an individual theft risk but a national security risk. Coinbase doesn't pay into your Social Security account, so they shouldn't have your Social Security number. They don't visit your house, so they shouldn't have your address. Etc.
Historically, although KYC regulations were widespread in Communist countries, they were unthinkable in most democratic countries until 9/11, which provided spy agencies with their golden chance to write their wishlist into law. But unfortunately that helps foreign spy agencies just as much as, maybe more than, it helps domestic ones.
You seem to believe that AML/KYC regulation exists to benefit customers or to prevent or recover from account compromises. It does not, and I have no idea why you would think it does. Something like a Yubikey or iris-scanning stations could help to prevent Coinbase account compromises, but AML/KYC regulations do not require or even encourage them, though perhaps someday they will.
It has real drawbacks, but I wasn't talking about what would be a good idea; I was talking about what would be a useful measure for preventing or recovering from account compromises. Iris scanning would be; KYC isn't.
What they got
- Name, address, phone, and email
- Masked Social Security (last 4 digits only)
- Masked bank‑account numbers and some bank account identifiers
- Government‑ID images (e.g., driver’s license, passport)
- Account data (balance snapshots and transaction history)
Wow. Why does customer support staff have access to images of the user's passports?
I also like 'last 4 digits only' as if that's not the most important parts and the part so many places use to validate your identity, the first 5 are just area and group so they're not exactly random.
Everyone's social security number is available. If you go download the leak referring to in this HN post [1], your SSN is certainly in it. Mine was, everyone in my family's was, almost all of my friends' were.
The world needs to stop pretending that SSNs are secret. They aren't.
Does it require the skills of using powershell to open and search? I'm very curious but am not a coder, I do audio and graphic design. That being said I've copy pasted pieces of python, tailored it to my use and made it work.*
I'm just very curious to check for myself and my family.
Who else would verify the user passports if not the customer support staff? Who verifies (and photocopies! in Asia and Europe) your passport at a hotel or car rental office?
All KYC processes require copying in Europe. There's nothing that's blanket illegal under GDPR. If you have consent you can collect and store whatever you want.
It's not that easy. The consent has to be freely given. And data collection has to be kept at a minimum.
If hotel staff says "Ok, last step we need to do to check you in is to copy your passport" that would probably neither count as freely given consent nor as keeping data collection to a minimum.
And KYC also does not mean you have to copy the passport of a person.
The attackers bribed customer service agents to hand over data and documents, they were not breached directly. It's possible this stuff may have been handed over before being destroyed.
Maybe it’s a naive question, but in many breach reports I see things like 'No passwords, private keys, or funds were exposed.' How come companies can usually protect that kind of data, but not emails, names, and other personal info?
Companies want the ability to use things like emails, names, and other data for user experiences (go to settings, see name and change it), advertising (target this address book for X ad), etc. So these are typically plaintext (oversimplified) and accessible by different systems while passwords or private keys have one use case only and can have a higher bar of protection.
A properly implemented login system will never store a password in the first place. Properly hashed passwords can still be cracked in some cases, but if your password is strong and the hash is good, it’s safe.
Such data is typically encrypted and purely write-only, only read by the system itself. Thus it is only exposed if the database itself is exposed. If the leak was compromise of the systems that access the data (which appears to be the case here--insiders copied data they could access) the write-only info is not exposed.
549 comments
[ 4.7 ms ] story [ 317 ms ] threadFrom https://techcrunch.com/2025/05/15/coinbase-says-customers-pe...
> The company said the hacker stole customer names, postal and email addresses, phone numbers, and the last four-digits of users’ Social Security numbers. The hacker also took masked bank account numbers and some banking identifiers, as well as customers’ government-issued identity documents, such as driver’s licenses and passports. The stolen data also includes account balance data and transaction histories.
But I've always wondered why people think this is how investment vehicles work. I monkeyed around with stock market bets and even Robin Hood allows you to cash out of your positions.
Coinbase supported direct bank withdrawals well before they launched their crypto debit cards.
Are you sure you didn't fall for a scam version?
Yet he's a bit urban edgy here, and the staging is like it's an impromptu social media reaction to some online slight. (though reading a script)
You don't want to go full South Park "We're sorry", but I'd feel better about a response in a business dress shirt, out of respect for wronged customers.
With a bit more humbled posture.
IMHO, you're answering to customers you've wronged, and you don't wear a hoodie to church nor court (nor do you play video games during a live TV interview), nor do you assert superiority over the people you let down.
You can convey respect and humility, while also conveying being capable of responsibly resolving the problem.
(Just one person's reaction. I see some things the video did right, IMHO, but some other things jump out as wondering why they did that.)
> and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible
That, and they're reimbursing customers who were tricked.
Additionally the email they sent me had the subject “important notice” and that my personal account was affected as the third sentence in a rather wordy paragraph. None of this is ok and this is not a company taking this seriously.
The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked.
Not, "Gosh, 'overseas' people, what can ya do?"
Bank tellers can take thousands out of the vault at any time and yet it seems it’s not a very big issue.
Vannia Chatt: https://6abc.com/post/former-citizens-bank-teller-accused-st...
Karen Farrell Tigler: https://www.irs.gov/compliance/criminal-investigation/former...
Stephanie Rose Kilbert: https://people.com/bank-teller-stole-money-while-pretending-...
Derek Aut: https://www.justice.gov/usao-ma/pr/former-bank-teller-arrest... https://www.usatoday.com/story/news/nation/2025/03/28/boston...
Mountee Brown: https://www.justice.gov/usao-md/pr/maryland-bank-teller-plea...
Being US citizens doesn't make people incorruptible. In fact, many other countries are less corrupt than the US. Someone in this very thread reports having witnessed bank tellers getting bribed in one of those countries: https://news.ycombinator.com/item?id=43996765
I've been through a background check designed to screen out people who were vulnerable to bribery. They interviewed my friends and family from the previous several years to find out if I was secretly gay, cheated on my wife, gambled, drank too much, used illegal drugs, or had money problems for some other reason. It took about a year. I think it would be hard for a financial institution to be economically competitive doing that kind of thing with their call-center workers, because their customers can't tell if they're secure or not, just how much their services cost.
With a lot of this online stuff, no matter who gets your password or access to your account it’s you who has to take care of it. Whereas if the bank teller steals from the till it’s not your problem.
But what about the capital class? How will they afford more yachts? So sad. They're.. um... job creators or something. Anyway, that's what Fox News told me.
For example at many banks the teller might need to get manager approval for some cash withdrawals, even for seemingly smaller amounts of money. Despite what it may seem, it's not because of some distrust towards the client but a safeguard against internal fraud.
https://www.americanbanker.com/news/call-centers-and-bank-br... "Call centers and bank branches are major fraud liabilities"
https://www.bai.org/banking-strategies/beating-crooks-at-cal... "Aite Group’s findings that 61 percent of fraud can be traced back to the [call] center are equally concerning, as is its prediction that contact center fraud loss will double by 2020."
> ...bribed AT&T employees at a call center in Bothell, Washington, to "use their network credentials and exceed their authorized access to AT&T's computers to submit large numbers of fraudulent and unauthorized unlock requests on behalf of the conspiracy and to install malware and unauthorized hardware on AT&T's systems," according to the indictment.
https://abcnews.go.com/Politics/att-employees-bribed-1m-unlo...
> ..install malware and unauthorized hardware on AT&T's systems
That's not as harmless as unlocking phones early. A major carrier that has access to texts, geolocations, and call logs being hacked like that is extremely concerning.
alternatively limit the roles and what the offshore people are able to do, but then any escalation means domestic people, which brings us back to "well at that point just use AI to automate easy tasks"
Small set of privileged employees who work from the home office and are compensated to match. If an issue requires their attention, it takes time to resolve. But it's resolved securely. In essence, what Google does.
Alternative is the banking model. Low-cost customer service massively empowered and just eat the costs of breaches as they come.
My multiple banks’ customer service is meh but they do resolve problems and as far as I can tell, haven’t leaked any of my stuff yet in decades. That you think “what Google does” is better than “the banking model” is amusing.
>Go on LinkedIn
>Look up profiles of people who work at Coinbase
>Contact and bribe them with a burner account
Plenty of exchanges don't know their customers, and in fact that is how they get their customers.
This is overlooked most places but if you examine around the time the FATF finally pretty much eliminated bearer bonds, bearer stocks, and large bank notes was exactly the time crypto really took off.
You can receive crypto privately to your own wallet without sharing PII, without any exchange.
Without the right details the customer support people don’t get entry into the customers account details.
Banks have been doing this for 30+ years..
“Give a man a gun and he can rob a bank, but give a man a bank, and he can rob the world.”
That there are more options than holding your hands up and arguing the company couldn't have done anything further in terms of implementing effective controls.
The fact that they keep blaming overseas customer support is pure blame shifting - you still hired someone and gave them access to all this data, Coinbase!
If they didn't say this, there would be pitchforks out about not giving enough information.
This is a precedent to Coinbase employees getting physical threats at their door just because e.g. some voter registration, utility company, bank, credit card, or court record decided to release their name and addresses on the internet. People could show up at some Coinbase software engineers' apartment doors with guns demanding they send BTC to arbitrary addresses.
Plus numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit, etc.
Finally, shutting down paid data brokers seems virtually impossible in practice, which means anybody googling you can pay $20 and get everything.
Remember, the issue isn't lazy goodguys but even slightly motivated badguys, who then use third party scripts to do the data collection.
Just jail them. Make it a felony to release someone's PII without their written consent, and make data brokers illegal to begin with.
> numerous ways to infer your address from other data sources, including apps that grab GPS on friends' cellphones when they visit
These are not the main vector of transmission of personal information. Yes, Meta could probably do some graph analysis and infer this, but it's a lot of work, and their data leaks are rare in comparison to all the other companies, financial institutions, and governmental organizations, that freely post residential addresses on the internet and to data brokers for the world to Google.
> companies, organizations and governments that collect it for various reasons
KYC requiring addresses should be banned. Companies should not collect a residential address.
I bought a house here after a long time out of country and the first year all I got for mail was scam bullshit. Loads of it.
If you sling code for cryptocurrency you and your loved ones are "in the game" now.
https://www.bbc.com/news/articles/c20qee5030do
Practically every company has someone with credentials who is in some combination of debt, a damningly-adulterous relationship, a damningly-illegal substance relationship and/or feels underappreciated or slighted compensationwise. The question is generally how much it costs.
They would have been better off not even bringing up their location if they weren't going to be transparent.
That’s very load-bearing. It won’t help.
The CS reps are based in a LCOL country so the opportunity for theft is simply incredibly lucrative.
What is really needed, is customer-in-the-loop for access to their data. The problem is, not all accesses would make sense. Doing analytics over the data of the top 1% of customers, for example, requires some level of access, but would freak out those customers if they had to approve it.
What about, for example, a higher-tier support person performing QA over someone else’s work? What about DFIR teams doing research on potential abuse? Etc etc.
It's hard to not believe in Karma sometimes.
yea that is what they get. Hope this hurts them bad.
At my last job for a "casual dating" app, all new account verification stuff was sent to some shop in the Philippines. I got involved with troubleshooting some random DB locks that were causing down time. Ended up discovering that this firm tried to automate the verification process with some scripts or something that would sometimes go haywire and send over 100 requests per second to the new account admin portal which would bring down the entire site. Management just asked them nicely to be more careful which brought the peaks down to 80 requests per second which the back end seemed to be able to cope with (just barely). They couldn't careless that there were supposed to be humans looking at this data and they were clearly trying to automate that part out. Even worse, once I started looking at the data that was in the portal, it was credit card name and billing addresses, and DL license or passport scans. Before I could really further fix the performance issue, I was laid off. Then a few months later they did another lay off which cleaned out every american employee. This was an american company that had ~150 american employees and now there are none. Just two execs at the top that get to watch the money roll in while they farm out everything to overseas. Really pisses me off bad >:(
>On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection.
https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647...
Also, "Coinbase had detected the breach independently in previous months", aren't they required to disclose this? In the EU they are: Every EU institution must do this within 72 hours of becoming aware of the breach, where feasible
And what that means is that
1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore.
2) Hackers can try to “recover” accounts now using this leaked info.
This is a huge problem. What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this)
The only solution here is: hardware 2 factor like yubikeys.
That's just a bank.
I don't think commodity, forex or stock trading is built into any bank interface but I don't have enough money to know for sure.
So it's different in that way I guess.
It may not be a crypto-as-a-theoretically/ideologically-pure-construct problem, but it absolutely is a crypto-as-a-real-world-asset problem.
I don't think anyone claimed that crypto was un-losable or un-stealable. It's not magic.
https://cryptosteel.com
Come on, if you’re going to copy someone else’s snark, pick a good one.
Gets you the equivalent of mugged by people on the other side of the planet?
At least with cash, it's a one-on-one involuntary transaction.
Cryptocurrencies are classified, for now, as securities.
Currency is currency and cryptocurrency is not. So please do not attempt to compare apples to oranges here.
https://en.wikipedia.org/wiki/Security_(finance)
If you wish to compare cryptosecurities to other securities, then do that, but don't try to act like it is some sort of future utopian currency.
So if we want to constrain impact of such attacks, we must make companies keep less data and delete them faster. For example, instead of storing a photo of ID, store just a checkbox that the person showed their ID and it was valid.
This applies not only to cryptocurrency, but to any company like Google, Uber, Amazon etc - if they didn't keep extra data, there would be little value in the leaks.
So the blame is not at cryptocurrency, but on companies not wishing to delete the data and governments demanding them to collect the data not necessary for operation. It's the government and capitalists who create problems out of nowhere.
Doesn't work at scale. You get bribes, rogue employees, socially engineered employees. In the US, look up the articles about phone/SIM unlocks and SIM card copies. Russia has a problem with e-signatures, that most people have no idea about. It's possible to sell somebody's real estate with one of these. Loans granted just based on passport data. Neither politics nor media highlight these issues. Overall in this case your suggestion tries to handle the symptoms of the KYC requirement.
Here's a more extreme treatment: let people change their full legal name at will. Gender's already kinda possible.
More KYC creates more problems while solving some others. Why didn't the same society despite KYC/AML tackle the problem pointed at in a previous comment? "Florida teens kidnap Las Vegas man, drive him to Arizona desert, steal $4M in cryptocurrency"[1] Why is there this crime?
Without mandatory KYC laws, this particular attack would be near pointless. No name tied to account, bookkeeping doesn't archive wire transaction details for the past 10 years.
Let businesses easily accept cryptocurrency (like... regular cash?), without a blade to their throat held by the government, and the need for such centralization points will greatly diminish. People get in trouble by p2p-exchanging money with unknown peers; in some instances this "trouble" has the unit of "years".
It's in nobodies' interest to protect cryptocurrency payments as the alternative, other than the activists, and the big groups jumping in on it for the speculation purposes - something they had refined decades ago. There's CBDC is on the horizon.
[1]: https://news.ycombinator.com/item?id=43999011
Every single crypto property I’ve talked to has ended up at a point where they believes that someone cheated them outside the bounds of the system and then look to authority figures to rectify the situation, like the government.
If you are someone who actually believes that crypto transactions should be unmodifiable by any third party then what you said makes sense. I just don’t think that anyone telling me they believe that isn’t lying to themselves at best, and lying to everyone else at worst
You are right, I do. The same reason I don't think the cryptocurrency is for everyone. And the reason I accept this, is because "traditional institutions" still can be "easily" gamed: enough cases of social engineering around to be considered a norm. Where law enforcement won't try enough or can't do enough to return the money transferred to a hostile account. Following this, if someone smart enough to avoid the banking scams, they are probably smart enough to manage their own wallet safely.
But this attack is already fully pointless with traditional finance. You can't steal someone's bank account at gun point.
Conversely, even without KYC, blockchain based currencies paint a huge target on anyone who uses a small number of wallets to store a large amount of money. Dedicated criminals and even state actors can figure out who owns the wallets by tracking transaction patterns, getting information from vendors, etc. As long as you're actually using your crypto wallets (unlike, say, Satoshi), you can quite easily be tracked. Anyone who you order a pizza from in BTC knows the address of whoever has that wallet. Sure, you can take a lot of steps to protect yourself from it, but it's hard, and one slip-up is all it takes. Opsec is not for the careless.
Also, crypto's reliance on secrets instead of legal personhood to ascertain ownership fundamentally makes it prone to stealing money in this way. Since the money doesn't belong to a legal person, but to whoever knows some secret key, that key can be stolen from whoever has it through simple violence. Even if you're extremely careful not to leak details of your accounts, use XMR for untraceable payments, etc - someone who is physically close to you could see that you're rich and decide to attack just on the chance that you may have crypto, without knowing anything specific.
Good points overall, thank you. This one could be managed by wallet software that'd do its own account tracing in order to separate your histories by generating new addresses for incoming transfers.
> physically close to you could see that you're rich and decide to attack just on the chance
The wearers of premium watches or smartphones don't seem to be concerned for their safety. For an increased payout they could be followed to their home. I think https://xkcd.com/538/ strucks either way.
... I think this is a good counterargument: what's the difference between a wallet and a banking account when everyone today can issue a wire transfer from the comfort of their home. Instant payments and all that. It just adds an extra step of waiting a couple more minutes for the transaction to come through. I assume the money laundering step is figured out by the criminals doing this to you.
What you've described is the same thing that many Crypto enthusiasts call a "Bank"
I guess I can walk downtown to CB HQ, but something tells me I won't get past the front desk.
It's been ages since I was in college and had an overdraft or some other bs bank related fee, but the bank manages to 'scam' you legally too. I'm just playing devils advocate and sharing an anecdote, I'm minimally involved in crypto anymore.
https://www.nytimes.com/2022/03/06/business/payments-fraud-z...
https://en.wikipedia.org/wiki/Legal_tender
> Except for, you know, being able to spend it where you buy things? [...]
The extent to which you can use it to buy things is a good metric, but I think that comes in varying degrees rather than being a sharp line or binary true/false. There are at least some things you can buy with cryptocurrency, and arguably there are some forms of "regular" (fiat, national, government-issued) money that aren't very widely accepted.
and that's where hats fail in all metrics to cryptocurrency and how cryptocurrency satisfies my criteria for money
but it could be, especially if it was tokenized
One that I'm using does, but I find it extremely annoying when they have me go to a branch to unblock my account that they locked due to a poorly calibrated risk system (that they need due to not supporting actually secure 2FA methods).
Is this satire?
And when that’s lost, what do you do? Aren’t you back to account recovery step?
People getting locked out of their account (which can happen due to no fault of the user, e.g. by an overly nervous risk system) will be really happy to have to potentially travel to a different city to regain account access...
Fine, make it optional. I actually would love a version of cold storage that is: never release this money unless I personally travel to an office if NYC and authorize it.
Coinbase would have to make you sign a challenge ahead of time that would mark the wallet as the authorized public key for your account.
Got to make it so employees can’t do anything nefarious. This helps protect them.
But they can look the other way about flaws in their Electron client.
Really, can you possibly tell if your Signal messages were compromised? Now that iPhones aren't really jailbreakable, you can't even see inside your own device.
Under specific conditions, the client can communicate with malware already on device, save data locally for other software to pick up, or downright stream the decrypted software to a third party.
Most likely is to introduce a flaw in the client that can be used by other walware on the client.
Clearly no red team members on HN these days.
Historically, although KYC regulations were widespread in Communist countries, they were unthinkable in most democratic countries until 9/11, which provided spy agencies with their golden chance to write their wishlist into law. But unfortunately that helps foreign spy agencies just as much as, maybe more than, it helps domestic ones.
In https://en.wikipedia.org/wiki/Know_your_customer#Laws_by_cou... you can see when they were introduced in different countries.
Yeah I know eventually these will be linked by some data broker and will meld into the same thing.
But I compare it to using a fingerprint to unlock a password manager on your phone. That ain't KYC.
It's been a bad day.
Nobody has sole control of their cryptocurrency by definition. It's a consensus protocol. (On a practical level, there are always layers of trust.)
https://www.coinbase.com/en-de/blog/protecting-our-customers...
Wow. Why does customer support staff have access to images of the user's passports?The world needs to stop pretending that SSNs are secret. They aren't.
[1] https://news.ycombinator.com/item?id=41248104
I'm just very curious to check for myself and my family.
*hah, here's me making it work https://www.youtube.com/watch?v=PMeRFnkHgBc&t=97s
I don't think that this is still legal under the GDPR.
If hotel staff says "Ok, last step we need to do to check you in is to copy your passport" that would probably neither count as freely given consent nor as keeping data collection to a minimum.
And KYC also does not mean you have to copy the passport of a person.