Money

Coinbase warns users of 'large-scale' phishing threat

Coinbase says users fell victim to scammers earlier this year.

Julian Dossett Writer

Julian is a staff writer at CNET. He's covered a range of topics, such as tech, travel, sports and commerce. His past work has appeared at print and online publications, including New Mexico Magazine, TV Guide, Mental Floss and NextAdvisor with TIME. On his days off, you can find him at Isotopes Park in Albuquerque watching the ballgame.

See full bio

Julian Dossett

Oct. 1, 2021 11:58 a.m. PT

Just in time for Cybersecurity Awareness Month, Coinbase has disclosed a "large-scale" phishing attack that impacted users earlier this year.

In a Sept. 27 blog post, Coinbase announced that the "broad" attack occurred between April and early May of 2021. At least 6,000 Coinbase customers were affected by the attack.

In the blog post, the company claims that the scammers never breached Coinbase's "security infrastructure or broader systems." The company also stated that it "immediately fixed the flaw and have worked with these customers to regain control of their accounts and reimburse them for the funds they lost."

Coinbase detailed some of the tactics incorporated in the phishing attacks in its blog post. To gain control of user accounts, scammers sent phishing emails that claimed to be from Coinbase. When users clicked on a link in the email and entered their account credentials, the perpetrators were able to see the credentials and take control of the accounts.

What remains unclear is exactly how the hackers were able to identify the email addresses of a large number of Coinbase users. Coinbase said "there was no evidence to suggest the information was obtained from [inside] the company."

Coinbase did not immediately respond when asked if it could clarify how the scammers gained access to the email addresses.