- Security Warning
- Chronology of Events: How did hackers steal $750k?
- When Convenience Becomes a Vulnerability
- Comparison Table: How Secure is Each Type of 2FA?
- Can We Enhance 2FA Security?
- 1. Dedicated Security Keys (e.g., YubiKey)
- 2. Maximize the Use of Existing Hardware Wallets (Trezor & OneKey)
- 4 Checklists to Enhance Security and Prevent Hacking
- Amidst the News of Exchange vs. Cold Storage, How Should We Position Ourselves?
Have you ever thought that just by enabling two-factor authentication (2FA) with the Google Authenticator app on your phone, your account should be secure?
If you're thinking that, I'd like you to pause and read this case. This is a major lesson that just happened to a long-term Bitcoin holder who lost over $750,000, or about 26-27 million baht, in less than 12 hours after transferring coins to an exchange!
How did this happen, even though the person had 2FA enabled? Today, I will clearly explain the hacking incident and recommend ways to enhance security by turning your existing hardware wallet into a 2FA key.
Security Warning
🚨 Security Warning: The "Cloud Sync / Cloud Backup" feature in many Authenticator apps is designed for convenience when changing devices. However, from a security perspective in the world of digital assets, it means entrusting your "final key" to the Cloud of your primary email account. If your Google or Apple ID account is hacked, all your 2FA codes will immediately be compromised. Therefore, if you use Authenticator apps, you should not use Cloud Backup.
Chronology of Events: How did hackers steal $750k?
- [Hackers infiltrated the Google Account for 3 months]
- [Obtained all 2FA codes from Google Authenticator's Cloud Backup]
- [Waited patiently until the victim transferred Bitcoin to an Exchange]
- [Hackers immediately logged in: Password + Email + 2FA codes were 100% correct]
- [Ordered withdrawal of all BTC at 3 AM → Exchange assumed it was the legitimate owner and approved]
When Convenience Becomes a Vulnerability
According to reports by Bitcoin News on X and leading crypto news outlets such as KuCoin News, there are three alarming points in the attack sequence:
- The Waiting Game: The hackers were not in a hurry. They secretly accessed the victim's Google account and waited for 3 months, silently monitoring email and other data.
- Single Point of Failure: Because the victim had enabled the "Cloud Backup" feature of Google Authenticator, the Secret Seed used to generate OTP codes was automatically synced to the Google account. Once the hackers seized the Google Account, they gained access to 2FA codes for all services.
- Exchange System Couldn't Differentiate: When the victim transferred $750,000 worth of Bitcoin to a major exchange in Australia, the hackers immediately withdrew the coins. Since they had the username/password, email confirmation, and 2FA codes, the exchange's system recognized them as the legitimate account owner and approved the withdrawal request at 3 AM.
Comparison Table: How Secure is Each Type of 2FA?
| 2FA Type | Convenience | Primary Risk / Vulnerability | Security Level |
|---|---|---|---|
| SMS OTP | Very High | Vulnerable to SIM Swap and SMS interception | ⚠️ Lowest |
| Cloud-Synced TOTP | High | If cloud account is hacked, all codes are instantly compromised | ⚠️ Medium-Low |
| Local-only TOTP | Medium | Safer, but inaccessible if phone is lost | 🟢 Good |
| Hardware Security Key | Medium-High | Requires carrying a physical device, 100% phishing protection | 🛡️ Excellent |
| Hardware Wallet 2FA | Medium | Requires on-screen confirmation, highest security + backup with Seed | 🛡️ Highest Security |
Can We Enhance 2FA Security?
One of the best solutions to mitigate the risk of 2FA codes being leaked via the Cloud is to switch to a physical security key, according to FIDO2 / WebAuthn / U2F standards.
1. Dedicated Security Keys (e.g., YubiKey)
- How it works: These are USB/NFC keys that use asymmetric cryptography. The key verifies the actual website domain before sending authentication, preventing hackers from using phishing sites or intercepting numeric codes.
- Recommendation: You should have at least two (a Primary Key for carrying and a Backup Key stored securely) in case one is lost.
You can read more about 2FA in the article: Why should we use 2FA? Can it really protect against hackers? or watch Why can 2FA still be hacked? for more information.
2. Maximize the Use of Existing Hardware Wallets (Trezor & OneKey)
Did you know that the hardware wallets you use to store crypto can also be transformed into 2FA keys?
- Trezor (Trezor Safe 3, Safe 5, Model T, Model One): Supports FIDO2 and U2F standards via USB cable. Simply go to the security settings page of Google, Binance, or other exchanges, select "Add Security Key," then plug in your Trezor and confirm on the device's screen.
- Special Feature: Trezor's FIDO2 data is generated from the device's Seed Phrase. This means if the device breaks or is lost, you can recover your 2FA key using the original Seed Phrase.
- OneKey (OneKey Pro, OneKey Touch, OneKey Classic 1S): Also supports FIDO and FIDO2 standards. It can be used for logging in and authenticating on browsers for Web2 accounts, Google accounts, and exchanges seamlessly without needing to purchase new equipment.
You can watch how to use 2FA on a Hardware Wallet here: How to use 2FA
4 Checklists to Enhance Security and Prevent Hacking
- Immediately disable Cloud Sync in Google Authenticator: If you are still using the old app, click on your profile picture in the app and select "Use without an account."
- Link Google Account and Exchange with a Hardware Key: Use a YubiKey or Hardware Wallet (Trezor / OneKey) as the primary authentication method.
- Set up Whitelist Withdrawal Address: Enable withdrawals only to pre-registered wallet addresses.
- Check Active Devices: Regularly check the Security page in your Google Account for any unfamiliar devices logged in.
Amidst the News of Exchange vs. Cold Storage, How Should We Position Ourselves?
Lately, many of you have probably seen a barrage of security-related news daily. This includes reports from exchanges about hacked accounts, data theft, or the risks of entrusting assets to intermediaries. Meanwhile, the cold storage/hardware wallet sector also sees news of firmware vulnerabilities or data breaches from shipping partners, leading many to question and wonder, "So, where should we truly store our coins to be safe?"
I'd like to suggest looking at it this way: In the world of digital assets, "no tool is 100% secure without the user's knowledge and understanding."
- Understand the strengths and limitations of each tool:
- Exchange: Designed for liquidity in buying, selling, or short-term transactions, but not for storing a lifetime's savings.
- Cold Storage / Hardware Wallet: Designed for maximum security through self-custody to mitigate intermediary risks, but this comes with the responsibility of securing your Seed Phrase and continuously updating your technical knowledge.
- Manage according to your risk tolerance and understanding (Risk-Adjusted Security): There's no one-size-fits-all solution. Some might store most of their assets in a hardware wallet and keep a smaller portion on an exchange for trading. The key is "never use a tool or function you don't fully understand." We should learn the correct storage methods, because convenience without caution, such as enabling Cloud Sync 2FA without understanding its implications, is often the first vulnerability hackers seek.
Ultimately, staying calm, not panicking with every news report, but regularly checking your account's security, and gradually learning and choosing methods suitable for your skill level, is the most crucial principle for protecting your assets long-term.
Having finished reading, what are your current methods for allocating coin storage and using 2FA? Feel free to comment and share your perspectives, or if you have any questions, you can contact us via LineOA @bitcast.
แชร์:
How to Choose a Hardware Wallet: A Beginner's Guide to Security from the Start