Coinbase May Be Responsible for Stolen Coins on Wallet
2023.03.08 04:31
Coinbase May Be Responsible for Stolen Coins on Wallet
By Ray Johnson
Budrigannews.com – Following the news that a Coinbase customer is suing the cryptocurrency exchange for $96,000, the crypto community is debating whether SMS two-factor authentication (2FA) should ever be used for account security.
Jared Ferguson filed a lawsuit against Coinbase in the United States District Court for the Northern District of California on March 6, claiming that he had lost “90% of his life savings” when identity thieves took money from his account and refused to pay him back.
Ferguson is said to have been a victim of a form of identity theft known as “SIM swapping,” which entails tricking a telecom provider into linking a phone number to one’s own SIM card.
This allegedly enables them to confirm the withdrawal of $96,000 from Ferguson’s Coinbase account and allows them to bypass any SMS 2FA on an account.
After receiving a new sim card and resuming service in accordance with T-Mobile’s instructions, Ferguson claimed he lost service on May 9 and discovered the funds had been taken from his Coinbase account.
In February 2021, a victim of SIM swapping filed a lawsuit against T-Mobile following the theft of approximately $450,000 in Bitcoin (BTC).
In an email to Ferguson, Coinbase stated that it is “responsible for the security of your email, your passwords, your 2FA codes, and your devices.” Coinbase denied any responsibility for the hack of Ferguson’s account.
Because Coinbase promotes the use of authenticator apps rather than SMS for two-factor authentication (also known as 2FA) and describes SMS as the “least secure” form of authentication, members of the crypto community generally expressed doubt that Ferguson’s lawsuit would be successful.
My best guess is that his password was hacked because it was used on multiple websites, one of which was compromised. Additionally, Coinbase promotes the Authenticator app for two-factor authentication by labeling it “secure” and SMS as “moderately secure.”
In a post titled “Never Use SMS 2FA,” some Reddit users discussed the lawsuit and even suggested that SMS 2FA should be banned. However, one user noted that SMS 2FA was the only authentication option available for many services:
Sadly, many of the services I use do not yet offer Authenticator 2FA. However, I am absolutely of the opinion that the SMS method is risky and ought to be banned.
In September, the security firm CertiK for the blockchain issued a warning about the risks associated with SMS 2FA. CertiK’s security expert Jesse Leclere told Cointelegraph that “SMS 2FA is better than nothing, but it is the most vulnerable form of 2FA currently in use.”
According to Leclere, dedicated authenticator apps like Google Authenticator or Duo provide nearly all of the convenience of SMS 2FA without the risk of SIM swapping.
Users on Reddit offered advice that was similar, but they advised against using authenticator apps on phones because they make that device a single point of failure and instead suggested using distinct hardware authentication devices.
