Phishers Swim Around 2FA in Coinbase Account Heists

Threat actors are making their way around two-factor authentication 2FA and using other clever evasion tactics in a recently observed phishing campaign aimed at taking over Coinbase accounts to defraud users of their crypto balances. Attackers are using emails that spoofed the popular...

Report Claims Coinbase Selling User Geolocation Data to ICE

By Deeba Ahmed Tech Inquiry’s Jack Paulson has shared startling details about a 3-year contract between the US Department of Homeland… This is a post from HackRead.com Read the original post: Report Claims Coinbase Selling User Geolocation Data to ICE...

MAL-2022-1978 Malicious code in coinbase-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40d06fc6dd8f366b3d336a2125d1854dbb29615412983ae62ed242a3321dc450 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in coinbase-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40d06fc6dd8f366b3d336a2125d1854dbb29615412983ae62ed242a3321dc450 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2812 Malicious code in eslint-plugin-coinbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a89797beb5d0ffafe5428539929cb1d521694dd2098a29c0c61a627f3c4e6423 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Commerce Coinbase For WooCommerce plugin <= 1.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Commerce Coinbase For WooCommerce plugin versions = 1.4. Solution Update the WordPress Commerce Coinbase For WooCommerce plugin to the latest available version at least 1.4.1...

WordPress Commerce Coinbase For WooCommerce plugin <= 1.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Commerce Coinbase For WooCommerce plugin versions = 1.4. Solution Update the WordPress Commerce Coinbase For WooCommerce plugin to the latest available version at least 1.4.1...

How Coinbase Phishers Steal One-Time Passwords

A recent phishing campaign targeting Coinbase users shows thieves are getting smarter about phishing one-time passwords OTPs needed to complete the login process. It also shows that phishers are attempting to sign up for new Coinbase accounts by the millions as part of an effort to identify email...

Hackers exploit 2FA flaw to steal crypto from 6,000 Coinbase users

By Waqas working to reimburse the customers for the funds they have lost and help them regain control of their accounts. Here's what happened. This is a post from HackRead.com Read the original post: Hackers exploit 2FA flaw to steal crypto from 6,000 Coinbase users...

MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed

The accounts of at least 6,000 Coinbase customers were robbed of funds after attackers bypassed the cryptocurrency exchange’s multi-factor authentication MFA. According to a notification letter PDF – seen and posted by BleepingComputer, which first reported the story – that Coinbase sent to...

HackerOne: HackerOne making payments in USDC (Coinbase stable coin)

Summary: Hello Everyone, My name is Ariel and I’m a manager in HackerOne’s community team. As a part of a Hack Week project, HackerOne is now supporting payments via USDC, Coinbase’s stable coin. This has been a feature requested by many hackers, that we are now glad to announce as supported. Mor...

Payments paradigm shift

Crypto assets have been around for over a decade, and with the recent Coinbase IPO, we believe we are well past the point of calling this a "passing fad." In fact, we believe that crypto assets -- particularly bitcoin -- have now passed the tipping point from being considered an unconventional...

Office 365 OAuth Attack Targets Coinbase Users

Office 365 users are receiving emails purporting to come from cryptocurrency platform Coinbase, which ask them to download updated Terms of Service via an OAuth consent app. But when they agree to do so, users are unknowingly giving attackers full access to their email. OAuth is an open standard...

Mozilla Fixes Second Actively-Exploited Firefox Flaw

UPDATE Mozilla has fixed a high-severity vulnerability in its Firefox browser being actively exploited in the wild. The vulnerability CVE-2019-11708 is separate from a critical flaw under active attack that was patched earlier this week CVE-2019-11707. However, both vulnerabilities were discovere...

New Mac Malware Targets Cookies to Steal From Cryptocurrency Wallets

Mac users need to beware of a newly discovered piece of malware that steals their web browser cookies and credentials in an attempt to withdraw funds from their cryptocurrency exchange accounts. Dubbed CookieMiner due to its capability of stealing cookies-related to cryptocurrency exchanges, the...

Mac "CookieMiner" Malware Aims to Gobble Crypto Funds

A newly-discovered malware is targeting Mac users’ web cookies and credentials in hopes of withdrawing funds on their cryptocurrency exchange accounts. The malware, discovered this month and aptly named “CookieMiner,” collects cryptocurrency-related cookies – in addition to compromised credential...

Ethereum Classic (ETC) Hit by Double-Spend Attack Worth $1.1 Million

Popular cryptocurrency exchange Coinbase has suspended all transactions of Ethereum Classic ETC—the original unforked version of the Ethereum network—on their trading platforms, other products and services after detecting a potential attack on the cryptocurrency network that let someone spend the...

Ethereum Classic (ETC) Hit by Double-Spend Attack Worth $1.1 Million

Popular cryptocurrency exchange Coinbase has suspended all transactions of Ethereum Classic ETC—the original unforked version of the Ethereum network—on their trading platforms, other products and services after detecting a potential attack on the cryptocurrency network that let someone spend the...

Coinbase - Buy Bitcoin & more. Secure Wallet. - WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Coinbase - Buy Bitcoin & more. Secure Wallet. published at the 'play' market has multiple vulnerabilities...

Coinbase: ETH contract handling errors

A business logic error in the ETH contract handling code allowed for a nested revert call in contract execution to improperly credit a user account though funds had not been transferred. In addition, the code did not appropriately handle delegatecall within a contract. Sample contract for the fir...