Coinbase phishing hack signals more crypto attacks to come, says security firm
Recent phishing attacks on Coinbase and its customers revealed how these campaigns are not only becoming more sophisticated and multi-faceted, but how threats to cryptocurrency sites are on the rapid rise, according to research and analysis from security firm PIXM.
“Since its rise to prominence, [Coinbase] has been increasingly targeted by scammers, fraudsters, and cyber criminals, due in part to the fact that its user-base is so large and mainstream,” said the PIXM blog posted earlier Aug. 4, “it is assumed to cover an audience of casual, generally non-technical, crypto investors.” Coinbase is “arguably the most mainstream cryptocurrency exchange used globally,” having added more than 89 million users to its platform since it began business a decade ago in 2012.
In their “multi-layered” phishing attacks on Coinbase, cybercriminals sent out spoofed emails purporting to come from the cryptocurrency company in order to steal financial and personal data to resell and log into users’ legitimate accounts to steal their funds in real-time. The attacks combined email and brand impersonations to steal from Coinbase wallet-holders, despite their use of multi-factor authentication (MFA), according to PIXM’s analysis.
According to Chris Cleveland, founder and CEO of PIXM, this complex and sophisticated campaign involved “surprising tactics to steal much more than just passwords.”
“After stealing a user’s Coinbase password, the phishing sites used a built in two-factor relay system to enter the user’s password into the real Coinbase site and then further solicit the actual two-factor authentication code from the user, [which] allowed the hacker to bypass two-factor authentication and access a user’s Coinbase wallet.”
Bad actors typically sent Coinbase customers a notification that their account “needed attention due to an urgent matter,” such as being “locked” or requiring a transaction confirmation. “Users were prompted to enter login credentials and a two-factor authentication code into the fake website,” according to…
