So everything started back in June 2015. After using Coinbase as my "online btc vault" for about 4-5 months keeping anywhere from $2500 worth of btc to $10,000. I got very interested on how their "Vault" system works and how safe it is. After testing it out and experimenting with it for over a week i was able to find one of the most major exploits on the site. In a nutshell what the exploit allowed me to do was to put my account into negative balance while withdrawing the btc, which basically resulted in me being able to cashout infinite Bitcoins even if i didn't have them on my account. Instead of abusing the exploit i have decided to help Coinbase fix the exploit by telling them step to step instructions on how to reproduce the bug on hackerone. After they were able to fix the exploit i was rewarded a measly $5,000 bounty, which i thought was unfair and was expecting to get upwards of $25,000. I helped them fix something that could have damaged them in hundreds of thousands of dollars, maybe even Millions if the exploit was executed correctly with the right amount of people. Anyway so after i got my bounty and moved on they put some kind of "secret" ban on my account, which i was unaware of and got no email at the time telling me the account was banned or locked in any kind of way. So i find out that they put lock on my bitcoins and whatever i would send to my coinbase wallet i couldn't withdraw or use it in any way. I sent them few support emails and got no clear response. After further investigation into their Vault i was able to discover almost identical exploit which resulted in the same manner as the previous one. After informing Coinbase on the new exploit it took them few months to reply on hackerone and after they did they fully put ban on my coinbase account for no relevant reason and after that they sent me request on hackerone to give them further instructions, which they clearly knew that i was unable to do that because moments before they asked for that they had banned my account. Time passed with no clear reply from Coinbase and they labeled the newer exploit as "Informative" Rewarding me with no bounty. After trying to replicate the new exploit on a new account it was clear that they had fixed it and didn't reward me for it.
I didn't want this to go public and tried to deal with Coinbase in private, but with no clear resolvement i have no other choice, but to just put this out for everyone.
Proof:first exploit resolvement on hackerone:
https://i.imgur.com/GgD0L0l.pngproof of the first exploit being performed correctly:
https://i.imgur.com/x2miZOk.png https://i.imgur.com/bUKlXhY.pngproof of ban from coinbase after they fix the second exploit:
https://i.imgur.com/C3uyA2V.pngsecond exploit being marked as "Informative" after they had fixed it and banned me from accessing coinbase:
https://i.imgur.com/Z8EXORY.pngNOTE: I only used Coinbase to keep my bitcoins in their wallet. I have never used Coinbase as a mean to buy or sell my bitcoins.
