You should see this reflected in your account no later than today,” the company promised.Ĭoinbase is today’s second-largest cryptocurrency exchange in the world, according to CoinMarketCap, behind Binance.

“Some customers have already been reimbursed - we will ensure all customers affected receive the full value of what you lost. “We have not found any evidence that these third parties obtained this information from Coinbase itself,” the company said.Ĭoinbase said it would reimburse all users who lost funds in these intrusions. “While we are not able to determine conclusively how these third parties gained access to this information, this type of campaign typically involves phishing attacks or other social engineering techniques to trick a victim into unknowingly disclosing login credentials to a bad actor. “As soon as Coinbase learned of this issue, we updated our SMS Account Recovery protocols to prevent any further bypassing of that authentication process,” it added.Ĭoinbase said the attacks could exploit this bug only if they knew the victim’s username and password. “The third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account,” Coinbase said. The intrusions took place earlier this year, between March and May, the exchange said in a data breach notification letter it has filed with US state attorney general offices. More than 6,000 Coinbase users had funds stolen from their accounts after hackers used a vulnerability in Coinbase’s SMS-based two-factor authentication system to breach accounts. Coinbase said it would reimburse all affected users.More than 6,000 users had funds stolen from their Coinbase wallets between March and May 2021.Hackers used Coinbase bug to bypass SMS-based 2FA and gain access to user accounts.Hackers bypass Coinbase 2FA to steal customer funds

Coinbase app view transaction history