Hackers Invent a New Way of Stealing Crypto Funds From Exchanges
ExchangesBit News Today2 min read
Cryptocurrency exchanges have warned of a new hacking method that could allow thieves to empty user accounts. Several exchanges confirmed this week they are investigating the theft of crypto funds from user accounts. The attackers appear to be exploiting a security hole in the two-factor authentication systems that many exchanges use for account security.
The hackers first gain access to a user's email to intercept the verification messages sent by exchanges. They then request a withdrawal from the user's account to an address they control, which the exchange approves thinking it came from the verified address. The method is said to have been exploited at least a dozen times, including thefts from Yahoo and Gemini. ## How the exploit works
While a full explanation is pending, the method appears to involve exploits in how popular exchanges link two-factor authentication to a user's email address. With access to a user's email, the thieves can intercept and approve the transaction, which exchanges send to verify withdrawals. With no further verification, exchanges process the withdrawal as if it came from the verified account.
Most exchanges use some form of two-factor authentication (2FA) to protect user funds. Typically, this requires a user to input a code sent to their verified email or mobile device before a large withdrawal is approved. However, the success of this new hacking method is a concerning sign that some exchanges may not be using 2FA in a sufficiently secure manner. ## Exchanges have taken action
The attacks have resulted in a sharp drop in the number of users using third-party 2FA applications. Perhaps in an effort to regain user trust, a prominent exchange announced it will start reimbursing users for any losses due to this type of hack.
Some crypto investors are frustrated that exchanges did not already have measures in place to prevent this type of exploit. After all, it is not a new concept for hackers to exploit 2FA systems to breach accounts. But others argue that the onus is on the individual to secure their email and accounts, and that it is not the exchanges' job to cover that. ## Guard your email
In the wake of the thefts, Bitcoin investors are being reminded to guard their email accounts closely, as the stolen funds were moved by email penetration. Users are also being encouraged to make sure their email is well-secured by using a strong password, and not sharing it with anyone.
