{"id":57658,"date":"2022-02-14T10:14:58","date_gmt":"2022-02-14T08:14:58","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=57658"},"modified":"2025-09-04T12:49:24","modified_gmt":"2025-09-04T09:49:24","slug":"white-hat-hacker-uncovers-vulnerability-in-coinbases-retail-trading-platform","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/white-hat-hacker-uncovers-vulnerability-in-coinbases-retail-trading-platform\/","title":{"rendered":"White hat hacker uncovers vulnerability in Coinbase&#8217;s retail trading platform"},"content":{"rendered":"<p>The cryptocurrency exchange Coinbase paused trading on its retail platform Advanced Trading after a white-hat hacker reported a vulnerability.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">For technical reasons, we are disabling retail advanced trading. This service will continue to be accessible, but new orders cannot be placed at this time. Existing orders are in cancel only mode.<\/p>\n<p>\u2014 Coinbase Support (@CoinbaseSupport) <a href=\"https:\/\/twitter.com\/CoinbaseSupport\/status\/1492245235841253376?ref_src=twsrc%5Etfw\">February 11, 2022<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>On Friday, February 11, a hacker going by the handle Tree of Alpha attempted to contact Coinbase&apos;s developers or leadership via Twitter.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u00abI&apos;m submitting a HackerOne report, but I fear it can&apos;t wait. I can&apos;t say more, but this could potentially wipe out the market\u00bb, \u2014 he wrote.<\/p>\n<\/blockquote>\n<p>HackerOne is a bug-bounty platform.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">Sounds like our team is in touch, thx for connecting with them, and we\u2019ll investigate.<\/p>\n<p>\u2014 Brian Armstrong \u2014 barmstrong.eth (@brian_armstrong) <a href=\"https:\/\/twitter.com\/brian_armstrong\/status\/1492219896658219008?ref_src=twsrc%5Etfw\">February 11, 2022<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<p>Based on the response from Coinbase co-founder and chief executive Brian Armstrong, the exchange\u2019s team reached out to the hacker within an hour of his tweet.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u00abIt looks like our team is in touch; thanks for reaching out to us, and we will conduct an investigation\u00bb.<\/p>\n<\/blockquote>\n<p>The suspension of Advanced Trading followed a few hours later. Trading on the platform was resumed by the evening of February 12.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">We\u2019ve re-enabled full service for retail advanced trading. Greatly appreciate the patience and understanding of those retail advanced trading customers using our exciting new platform prior to full-public launch. Customer funds remain safe and were not impacted. <a href=\"https:\/\/t.co\/tACcyQPMpZ\">https:\/\/t.co\/tACcyQPMpZ<\/a><\/p>\n<p>\u2014 Coinbase Support (@CoinbaseSupport) <a href=\"https:\/\/twitter.com\/CoinbaseSupport\/status\/1492274154061586433?ref_src=twsrc%5Etfw\">February 11, 2022<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Coinbase said that other services were not affected by the vulnerability, and customer funds were not harmed.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u00abAdvanced Trading has been resumed, and I have verified that the exploit has been patched as recommended. I will publish the full thread about the vulnerability and how Coinbase&apos;s swift response avoided serious damage to the company and the market as soon as I am allowed\u00bb, noted Tree of Alpha.<\/p>\n<\/blockquote>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">Advanced Trading is resumed, and I have verified that the exploit has been patched as recommended.<\/p>\n<p>Full thread on the vuln and how Coinbase&apos;s swift response avoided some serious company &#038; market damage as soon as I&apos;m allowed (hopefully next week).<\/p>\n<p>Good weekend to all. <a href=\"https:\/\/t.co\/pguInKORwW\">pic.twitter.com\/pguInKORwW<\/a><\/p>\n<p>\u2014 Tree of Alpha (@Tree_of_Alpha) <a href=\"https:\/\/twitter.com\/Tree_of_Alpha\/status\/1492447891381706754?ref_src=twsrc%5Etfw\">February 12, 2022<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>In August 2021, white-hat hacker Sam San <a href=\"https:\/\/u1f987.com\/en\/news\/white-hat-hacker-foils-350m-theft-in-sushiswap-defi-project\">helped fix the vulnerability<\/a> in the SushiSwap DeFi project. The bug could have led to the loss of 109,000 ETH.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The cryptocurrency exchange Coinbase paused trading on its retail platform Advanced Trading after a white-hat hacker reported a vulnerability.<\/p>\n","protected":false},"author":1,"featured_media":57659,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1301,138,1195],"class_list":["post-57658","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-blockchain-vulnerabilities","tag-coinbase","tag-white-hat-hackers"],"aioseo_notices":[],"amp_enabled":true,"views":"12","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/57658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=57658"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/57658\/revisions"}],"predecessor-version":[{"id":57660,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/57658\/revisions\/57660"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/57659"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=57658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=57658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=57658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}