Coinbase, the leading crypto exchange, recently disclosed a potential weakness, declaring that a smaller part of its clients’ passwords is stored in plain content on an inner server log. In any case, the data was not mistakenly accessed by outside parties, the exchange further added.
Coinbase published the news in an official blog post on 16th August. As per the declaration, Coinbase has settled the instigation of the bug, and the platform is sure that the stored information was not “improperly accessed, misused, or compromised.”
Besides, the declaration indicated that 3,420 people at that point submitted another registration application, where they utilized a similar password. Coinbase was ready to resolve this by considering the password hash would match the previous password hash which was saved from the failed attempt of signing up.
In 3,420 cases, the potential clients utilized a similar password on their subsequent signup approach, where the result was successful, however, would bring about their password that matches the hashed version on the organization’s logs. Those clients were informed by Coinbase through email immediately.
Moreover, Coinbase reassured its clients that none of the information recorded in their logging framework seems to have been accessed and that they have reached the majority of the affected clients. According to the announcement, Coinbase utilizes AWS (Amazon Work Station) for internal logging, and it imparts information to a few log analysis services. These services and AWS are all eventually audited, and access to the data is said to be firmly restricted.
Advertisement
The appearance of the bug has happened because of Coinbase’s utilization of React.js server-side rendering on the signup page. When a client visits the page for signing up an account, React helps to show the forms that are to be filled out.
Coinbase said in the blog,
After we identified and fixed the bug, we traced back all the places where these logs might have ended up. We have an internal logging system hosted in AWS, as well as a small number of log analysis service providers. Access to all of these systems is tightly restricted and audited. A thorough review of access to these logging systems did not reveal any unauthorized access to this data. Additionally, we triggered a password reset for impacted customers, even though a password alone is not sufficient to access a Coinbase account our device verification emails and mandatory 2FA mechanisms would both have been triggered and blocked any unauthorized login attempts.
Furthermore, Coinbase revealed that it had activated password resets for any person whose account was affected. Coinbase’s revelation comes at the time of Binance and Huobi experiencing real information breaches.
Not like Coinbase, Binance and Huobi seem to have lost control of customer know-your-client information, which includes identity confirmation documents.
Coinbase is located in San Francisco, was established in June 2012, as a digital currency wallet and platform where traders and customers can execute with new digital currencies like Ethereum, Bitcoin, and Litecoin.
Advertisement
Related: Read our Coinbase review
Coinbase has extended its custodial arm, Coinbase Custody, having recently acquired crypto wallet Xapo’s industrial services. This ongoing acquisition has knocked up Coinbase’s assets under the supervision of 7 billion dollars. As indicated by the recent announcement, Coinbase Custody is presently the biggest crypto custodian by AUC on the planet, with 120 customers across 14 distinct nations.
