7 Indicted in $300,000 Queens Bitcoin Theft, Say Prosecutors

August 14, 2024 Bitcoin.com

Queens Bitcoin Heist: Seven Charged With Grand Larceny and Money Laundering

August 11, 2024 Bitcoin.com

Names of non-US FTX users demanded by mainstream media outlets

April 6, 2023 Coin Telegraph

Ad Hoc Committee of Non-US Customers of FTX.com

A number of mainstream media outlets are pushing to publicize the personal details of FTX’s non-U.S. customers, similar to what happened with Celsius.

Some mainstream media outlets have objected to attempts to withhold the identities of non-United States customers of cryptocurrency exchange FTX during its bankruptcy proceedings.

In an April 4 filing to a Delaware Bankruptcy Court, media outlets Bloomberg, The Financial Times, The New York Times, and its parent firm the Dow Jones & Company jointly objected to the names of the customers being redacted, arguing the press and public have "a presumptive right of access to bankruptcy filings.”

Media group files objection to redacting FTX customer names.

If the objection succeeds, the names of up to 1.4 million customers and their FTX balances would be made public. pic.twitter.com/w0avsJ6JYv
— FTX 2.0pium (FTX Creditor) (@AFTXcreditor) April 5, 2023

While FTX’s debtors are able to argue for the names of creditors to be redacted in bankruptcy filings — and have done so — the media outlets believe FTX and its customers have failed to “justify such secrecy.”

The Ad Hoc Committee of Non-US Customers of FTX.com claimed in a Dec. 28 filing that publicly revealing the names and private information of non-U.S. customers leaves them vulnerable to identity theft, targeted attacks, and “other injury.”

In the recent filing, the media outlets argued that if the “permanent sealing” of the users were permissible on the grounds claimed by FTX and the Committee “then sealing customers’ names would be routine in virtually every bankruptcy proceeding.”

They added that “public access is of the utmost importance here,” as the magnitude of the FTX collapse has “ignited intense public interest in the U.S. legal system’s approach to the burgeoning and largely unregulated cryptocurrency market,” and added:

“The sealing of the names of FTX’s creditors to date has significantly impeded reporting on, and analysis of, these proceedings, leaving the public—and creditors— largely in the dark as to the United States’ enforcement of its bankruptcy laws in the crypto context”

In response to the Committee’s Dec. 28 filing, Judge John Dorsey allowed the names and addresses of the customers to be redacted for a further three months on Jan. 11, noting that he “remained reluctant at this point” to disclose the confidential information which may put creditors “at risk.”

Crypto lending platform Celsius had similarly tried to ensure that its customers' names remained redacted during its bankruptcy proceedings but failed to convince the judge, resulting in the personal details of thousands of customers being disclosed on Oct. 5, 2022.

A hearing on the matter is set to occur on April 12 at 1:00 pm Eastern Time.

NFT Creator, Sarah Zucker: The Sarah Show’s analog past meets dizzying digital future

Report: Terra Co-Founder Do Kwon Plans to Appeal Detention Extension After Arrest in Montenegro

March 26, 2023 Bitcoin.com

Debate over 2FA using SMS after SIM-swapping victim sues Coinbase

March 8, 2023 Coin Telegraph

2FA

While members of the crypto community are doubtful the lawsuit against Coinbase will be successful, it has sparked a conversation about the issues with SMS 2FA.

The crypto community is debating whether SMS two-factor authentication (2FA) should ever be used for account security following news that a Coinbase customer is suing the cryptocurrency exchange for $96,000.

On Mar. 6 Jared Ferguson filed a lawsuit against Coinbase in the United States District Court for the Northern District of California, claiming he lost “90% of his life savings” after funds were withdrawn from his account by identity thieves and Coinbase had refused to reimburse him.

Ferguson is said to have fallen prey to a type of identity theft known as “SIM swapping,” which allows fraudsters to gain control of a phone number by tricking the telecom provider into linking the number to their own SIM card.

This allows them to bypass any SMS 2FA on an account, and in this situation allegedly allowed them to confirm the withdrawal of $96,000 from Ferguson's Coinbase account.

Ferguson claimed he lost service after his phone was hacked on May 9, and noticed the funds had been taken from his Coinbase account after getting a new sim card and restoring his service as per instructions from his service provider T-Mobile.

T-Mobile was previously sued by a SIM-swapping victim in February 2021 following the theft of approximately $450,000 worth of Bitcoin (BTC).

Coinbase denied any responsibility for the hack of Ferguson’s account, telling him in an email that he is “responsible for the security of your e-mail, your passwords, your 2FA codes, and your devices.”

Members of the crypto community were generally doubtful that Ferguson’s lawsuit would be successful, noting that Coinbase encourages the use of authenticator apps for 2FA rather than SMS and describes the latter as the “least secure” form of authentication.

I'm guessing his password was compromised because it was used on other sites, one of which got breached. Also, Coinbase encourages Authenticator app for 2FA by labeling it "secure" and SMS as "moderately secure".
— Dave Ferguson (@_sc0rn) March 7, 2023

Some Reddit users discussing the lawsuit in a post titled “Never Use SMS 2FA” went as far as suggesting SMS 2FA should be banned, but noted that it was the only authentication option available for many services, as one user said:

“Unfortunately a lot of services I use don’t offer Authenticator 2FA yet. But I definitely think the SMS approach has proven to be unsafe and should be banned.”

Blockchain security firm CertiK warned of the dangers of using SMS 2FA in September, with its security expert Jesse Leclere telling Cointelegraph that “SMS 2FA is better than nothing, but it is the most vulnerable form of 2FA currently in use.”

Leclere said dedicated authenticator apps like Google Authenticator or Duo offer nearly all the convenience of using SMS 2FA while removing the risk of SIM swapping.

Reddit users shared similar advice but added authenticator apps on phones also make that device a single point of failure and recommended the use of separate hardware authentication devices.

Identity Theft