re: COINEXX BREACH
Of course not.
Prior to Coinexx’s recent enhancements to security, the
protocol was to send an email prompt (I believe) to confirm
the request.
My understanding was that any request would need to be initiated
from within their web portal login ( Coinexx dot com ) which
they would have been able to do, since they had stolen the
login credentials. What I find weird is that the request appears
to have been initiated by an email message, which Coinexx
provided us, as we tried to find out what had happened.
HERE IS THE FORGED EMAIL WHICH CONEXX PROVIDED.
Their claim was that because the request had come from the
registered email address, they were bound to honor the
withdrawal request, yes, as incredibly as that sounds. By the
way no such email was sent from the real email account,
and examination of the email headers (not provided)
would probably have shown that. (I don’t want to go deep into
a rat hole on this…) From Coinexx, in response to our
challenge that the email request was fraudulent:
Dear [client],
Kindly refer to the following email for the withdrawal request we received
from your registered email address. The withdrawal was only processed
after we received the withdrawal request from the registered email address.
Best Regards
Support Team!
On Fri, May 17, 2019 at 7:30 PM [client] <[client]@protonmail.com> wrote:
Account ID - XXXXXXXX
Amount - USD 97
Bitcoin
1NwX7NSmYBKhxZzdu4Y8QeRU7LD13xFphV
Sent with ProtonMail Secure Email.
NOTE THE TERSE “MACHINE GENERATED” NATURE OF
THE ALLEGED WITHDRAWAL REQUEST. NO SUCH
EMAIL WAS SENT FROM THE REAL EMAIL ACCOUNT.
[EDIT] apparently they are not aware that email return addresses
can be spoofed fairly easily !! incredible their security
staff overlooked that simple fact, but apparently true.
'Nuff said. The important thing is that Coinexx has now allegedly
instituted better security on withdrawals. I don’t know exactly
what they are now, but this was a clear failure in their Security
on funds withdrawal.
hyperscalper