最高第 2 名 现在第 2 名
CZ总结四起数据泄露事件
CZ总结Coinbase、Bithumb及两家韩国券商的数据泄露，提醒防钓鱼和SIM卡攻击。
要点
- CZ 表示今天有 4 起数据泄露被报告：Coinbase 的供应商 Amplitude 泄露了部分用户的联系数据，Bithumb 发生用户数据泄露，韩国两家券商 Mirae Asset 和 Daishin Securities 也泄露了数据。
- CZ 表示泄露的交易所数据（姓名、邮箱、电话号码、地址、身份证件、交易记录）主要用于钓鱼、SIM 卡调包和社工攻击。
- CZ 建议为每个交易所使用独立的邮箱别名（如 SimpleLogin、Apple Hide My Email），并尽量用 VoIP 或第二张 SIM 卡的专用电话号码注册交易所账户。
- CZ 建议使用硬件安全密钥（YubiKey）或 passkey，避免短信 2FA，开启提币地址白名单和提币时间锁，并设置防钓鱼码。
要点和反应摘要由 AI 依据本页推文整理，请以原推为准。 我们怎么用 AI
原推
4 data leaks reported today:
1. Coinbase's vendor Amplitude exposed some users’ contact data (funds unaffected).
2. Bithumb (Korea) had user data leaks.
In TradFi, two securities firms in Korea leaked data:
3. Mirae Asset
4. Daishin Securities
You can't prevent a leak, but you can protect yourself.
Leaked exchange data (names, emails, phone numbers, addresses, ID documents, transaction history) is mostly used for phishing, SIM swapping, and social engineering.
Reduce info you share
- Use a unique email alias for each exchange (SimpleLogin, Apple Hide My Email, etc). A leak then can't be linked to your other accounts, and you can spot which service leaked.
- Share only what's required. Don't add optional profile details.
- Use a dedicated phone number (a VoIP or secondary SIM) for exchange accounts if you can, since leaked numbers are the main route to SIM swaps.
Lock down the account
- Use a unique, long password from a password manager.
- Turn on hardware security keys (YubiKey) or passkeys, or at least an authenticator app.
- Avoid SMS 2FA.
- Enable withdrawal address whitelisting and a withdrawal time lock if the exchange offers them.
- Set up an anti-phishing code, which puts a code you choose in every legitimate email from the exchange.
- Review active sessions and API keys regularly. Delete any API keys you don't use.
- Restrict API keys to withdraw-disabled and IP-whitelisted.
Defend against
- SIM swapping: Ask your carrier to add a port-out PIN or number lock.
- Phishing and impersonation: Assume anyone who contacts you about your account, "security issues," or "refund recovery" is a scammer, even if they know your name, balance, or recent trades.
- Exchange support staff don't ask for your password, 2FA codes, or seed phrase.
- Never click links in emails or texts. Go to the site yourself.
- "Wrench attacks": Leaked addresses plus holdings data have led to real-world extortion and robberies. Don't publicize your holdings, and keep large balances out of anything tied to your home address if you can.
If a breach is announced
1. Change the exchange password and any other account that reused it.
2. Check https://t.co/qtIGFkbaPO for your email address.
3. Revoke API keys and active sessions.
4. Review recent withdrawals and security settings.
5. Watch for phishing emails and texts that reference the breach, because scammers move fast after one.
Stay SAFU! 🙏
讨论 0
注册 登录 后参与讨论
还没有人讨论，来说第一句。