Change your password: Poloniex cryptocurrency exchange reveals data leak

January 2, 2020 TH Author

The Poloniex cryptocurrency exchange has enforced a password reset for account holders following a data leak across social media.

A very common form of scam is known as phishing, in which fraudsters will send fraudulent emails while disguising themselves as legitimate companies. These messages are often crafted to lure would-be victims into visiting malicious domains, and in order to prompt them to do so, scammers may claim there has been suspicious activity detected in an account — and therefore the recipient needs to visit the website and change their password.

Once submitted, these credentials can then be used by fraudsters to hijack accounts, potentially steal data, and in the case of cryptocurrency exchanges, siphon away virtual funds.

In light of this trend, cryptocurrency holders need to verify password reset emails as legitimate before proceeding — and an email blasted to Poloniex users last week was recently confirmed as authentic over Twitter.

A Twitter user under the handle @charlysatoshi posted a screenshot of an email they received, purporting to be from Poloniex, warning of the “scam” message.

The email said that a list of leaked email addresses and passwords had been discovered on the microblogging platform, spreading with the claim that the credentials could be used to access Poloniex accounts.

“While almost all of the email addresses listed do not belong to Poloniex accounts, we are forcing a password reset on any email addresses that do have an account with us, including yours,” the email reads.

While the user originally believed the message was a phishing attempt, the cryptocurrency exchange’s support team responded on December 30, saying, “This is a real email! Please reset your password for account security.”

It is not certain at this time how far the data leak extends, or whether the forced password reset only involves email addresses on the list. The source of the security incident and how this information was obtained is also unclear.

TechRepublic: Security teams have a challenging and ever-changing role. Here’s how a SOC can keep up

On the same day, the cryptocurrency exchange also published a guide for setting up two-factor authentication (2FA) on accounts, which can provide an additional layer of security through a mobile device should basic username and password combinations become compromised.

The data leak brings to mind November’s incident involving BitMEX, a cryptocurrency trading post. An email was sent en masse to users informing them of upcoming changes to indices weighting, but due to human error, the email addresses of other users were included in the “To” field.

CNET: US Army bans TikTok app from government phones

While the failure to properly mask recipients may not seem like a massive issue, when combined with the fact that many of us reuse passwords and the availability of data dumps online, this may have exposed users to the risk of compromise. BitMEX has also recommended that users secure their accounts with 2FA.

The BitMEX Twitter account was also accessed by an external individual, but the company says this second problem was “unrelated.”

ZDNet has reached out to Poloniex with additional queries and will update if we hear back.

Previous and related coverage

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0