Crypto exchange Coinbase says bad players have stolen crypto assets from at least 6,000 traders this year.

In a letter posted to the California Attorney General’s website, Coinbase claims that hackers took advantage of a loophole in the exchange’s SMS account recovery process to receive an SMS two-factor authentication token and access to funds, which they then transferred to wallets not associated with the exchange.

The hackers had previously secured the email addresses, passwords and phone numbers associated with the affected accounts, according to the letter from Coinbase.

Coinbase claims that no evidence has been found to suggest personal information was mined from the exchange itself.

“While we are unable to conclusively determine how these third parties gained access to this information, this type of campaign typically involves phishing attacks or other social engineering techniques to trick a victim into disclosing without know his login credentials to a bad actor. “

The attacks reportedly took place between March and May 20, 2021.

Coinbase says they have updated their SMS account recovery protocols “to prevent any further bypassing of this authentication process.” The exchange also says it plans to reimburse customers in full.

The company adds that it is conducting an internal investigation and is working with law enforcement to determine who was behind the attack.

Don’t Miss a Beat – Subscribe to receive crypto email alerts straight to your inbox

follow us on Twitter, Facebook and Telegram

Surf the daily Hodl Mix

Featured Image: Shutterstock / unicro