黑客賄賂支持人員在隱形攻擊中竊取Coinbase用戶數據

加密交易所Coinbase（NASDAQ：COIN）在5月15日披露，一群賄賂海外支持代理商幫助網絡犯罪分子竊取了用戶數據

A group of overseas support agents, who were bribed by hackers, provided the final access to sensitive user data at crypto exchange Coinbase (Nasdaq:COIN) after a group of hackers gained internal customer support access and attempted a coordinated extortion plot.

一群被黑客賄賂的海外支持代理商在一群黑客獲得了內部客戶支持訪問權限並嘗試協調的勒索圖之後，在Crypto Exchange Coinbase（NASDAQ：COIN）上最終訪問了對敏感用戶數據的最終訪問。

As revealed by the crypto exchange on Monday, the attackers targeted internal customer support systems and gained access to personal information belonging to fewer than 1% of monthly transacting users.

正如加密貨幣交易所在周一揭示的那樣，攻擊者針對內部客戶支持系統，並獲得了屬於每月交易用戶不到1％的個人信息。

Coinbase confirmed that login credentials, private keys, and customer funds were not compromised. “Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks,” the company stated, further noting that no passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched.

Coinbase證實，登錄憑據，私鑰和客戶資金沒有受到損害。該公司表示：“網絡罪犯賄賂並招募了一群流氓海外支持代理商，以竊取Coinbase客戶數據，以促進社會工程攻擊。”

“We will reimburse customers who were tricked into sending funds to the attacker.”

“我們將償還被欺騙向攻擊者匯款的客戶。”

The compromised data includes names, addresses, phone numbers, and email addresses. In addition, the hackers obtained masked social security numbers (limited to the last four digits), partially redacted bank account information, government-issued ID images such as driver’s licenses and passports, and account-specific data including transaction history and balance snapshots.

折衷的數據包括姓名，地址，電話號碼和電子郵件地址。此外，黑客獲得了蒙面的社會保險號（僅限於最近四位數），部分刪除的銀行帳戶信息，政府發行的ID圖像，例如駕駛執照和護照，以及特定於帳戶的數據，包括交易歷史記錄和平衡快照。

A limited amount of internal corporate information—like training materials, documents, and communications visible to support agents—was also accessed. However, hackers did not obtain login credentials, two-factor authentication codes, or access to any hot or cold wallets, including Coinbase Prime accounts.

還可以訪問有限量的內部公司信息，例如培訓材料，文件和通信以提供支持代理商。但是，黑客沒有獲得登錄憑據，兩因素身份驗證代碼，也沒有訪問包括Coinbase Prime帳戶在內的任何熱錢包。

After the incident, the exchange said the hackers attempted to extort the company for $20 million to suppress information about the incident.

事件發生後，交易所表示，黑客試圖勒索公司的2000萬美元，以壓制有關此事件的信息。

“They then tried to extort Coinbase for $20 million to cover this up. We said no,” the exchange disclosed.

該交易所透露：“然後，他們試圖以2000萬美元的價格勒索Coinbase。我們說不。”

“Instead of paying the $20 million ransom, we’re establishing a $20 million reward fund for information leading to the arrest and conviction of the attackers.”

“我們沒有支付2000萬美元的贖金，而是為導致襲擊者被捕和定罪的信息建立了2000萬美元的獎勵基金。”

In parallel, Coinbase is reimbursing affected users and implementing stronger protective measures. These include new ID checks on large withdrawals, a U.S.-based support center, upgraded security controls, insider-threat monitoring, and simulation testing for internal threats.

同時，Coinbase正在償還受影響的用戶並實施更強大的保護措施。其中包括有關大型提款的新ID檢查，美國的支持中心，升級的安全控制，內部威脅監控以及內部威脅的仿真測試。

Notifications have already been sent to affected users, and Coinbase affirmed its commitment to keeping the community informed throughout the investigation. A formal disclosure was filed with the U.S. Securities and Exchange Commission today.

通知已經發送給受影響的用戶，Coinbase肯定了其在整個調查過程中保持社區通知的承諾。今天向美國證券交易委員會提出了正式披露。