Coinbase alerts users of phishing attack

On the Coinbase Community forum, which launched last week, Coinbase’s security team posted a message Tuesday that it had discovered that morning a phishing attack that came through email, requesting users to click to accept New User/Service Agreement.

Coinbase said the email prompted users to log into their accounts and authorize a malicious application to remove Bitcoins from their Coinbase wallet.

The company said it found the malicious application relatively quickly and shut it down. The phishing attack affected a small number of users, whom Coinbase will be reaching out to directly.

Coinbase said it will reimburse the affected users the Bitcoins they lost in the attack as it continues its investigation.

To prevent this situation from happening again, the company is reassessing its API/application approval process, as well as reviewing the limits of money that can be sent over an application.

Coinbase said it has started to talk about how it can proactively reach out to customers and educate them on how to use their Coinbase Vaults as a more secure way of storing their Bitcoins.

In its report on the phishing attack, Inside Bitcoins included a comment from an affected Coinbase user on Reddit: “This was really stupid of me as I should have checked and I have never fallen for something like this in the past, but it looked so legit…I remember a post that someone made here recently about Coinbase having a new service agreement so I blindly followed through.”

Inside Bitcoins reported that Coinbase is insured by Aon, but it is not likely that this is a case where insurance is covered. Inside Bitcoins pointed to Coinbase blog post published last August in which the company said it is insured against theft or hacking, but explicitly stated that it is not responsible for customer negligence.

Image courtesy of Coinbase