I dunno how I missed this thread for so long, but let me state immediately and categorically that no data breach of any kind has happened at Cryptopia. Our support team has been bogged down by many situations similar to what was described in this thread, however in the many cases we've had to investigate there were some pretty common themes.
In some situations, an external data breach caused an email box of one of our users to become compromised, which was then used to reset the password of the associated account - in many instances, these accounts had no 2FA, or email 2FA to the email account which had already been owned.
In some situations, an external data breach caused a Cryptopia account to be directly compromised due to a shared login between Cryptopia and where ever the data breach occurred. In some of these instances the accounts received emails from us stating that an unsuccessful login had occurred before the correct username/password combination from the breach was used, and in other instances the correct username/password was submitted on the first attempt and no emails from us were sent.
We had a case where Google Auth was bypassed, however the user was using Google Auth as a Chrome extension and we concluded that the malicious user gained remote access to that persons computer, which included an auto-login session to the email associated with the Cryptopia account, and of course access to the browser for 2FA.
Outside of the above not-Cryptopia problem, no accounts with Google Auth or Cryptopia Auth were breached as part of the phishing attacks and data breaches that are outside of Cryptopia's control.
At the end of the day our user's account can only be as secure as the users set them up to be. We recently went and forced Email 2FA onto every account which had no 2FA, which has reduced this occurring but hasn't stopped it. One of the most heartbreaking things about some of our interactions with users that have been ripped off in this fashion is that they often blame our security rather than reflecting on what happened on their end; the end result being that they don't go and enable 2FA, ensure they have unique passwords everywhere, check for and remove malware, research and apply security best practices, etc, which ultimately leaves them open for a repeat incident.
What we've learned from this is that we need to go away and really look at how to use our site's pages and emails to educate our users and the crypto community around how security actually works. We need to update our 2FA pages to detail the strengths and weaknesses in various types of 2FA so that our users can make better decisions or at least be aware of the risks that they're taking with their choices; we need to update some of our email templates so that it tells you what's going on and provides an explanation of what this means and suggests some actions you may want to take - we discovered that most users didn't know how to react to a 'someone tried to log into you account and failed' email. We want to get to get our support tools, processes and headcount sorted so that we can be the first exchange to offer live chat support and be available to help our users in their moments of panic. The Crytpo community is growing rapidly and a factor of this is that many people that weren't the earliest of adopters aren't aware of the level of security paranoia that is required when you have a bunch of money sitting on accounts/computers that are connected to the internet.
If you go to our website, you will note that we use a different type of SSL cert to most other exchanges; it's not just 'Secure' but 'You're securely connected to Cryptopia Ltd [NZ]'. This is called an EV SSL certificate, which to obtain we have to be thoroughly vetted by Comodo as a real business that exists at a real location in the real world.
https://en.wikipedia.org/wiki/Extended_Validation_Certificate This is one of those security features where most users out there don't realize what the significance of a green address bar is compared to a white one. The benefit for us, is simply that it's harder for our users to be phished, because while a phishing site could have a minor change to the domain, they won't be able to replicate our SSL cert - but this only helps users that know what they're looking for.
Anyway, again, Cryptopia wasn't hacked.
My fault for not enabling 2 factor on this account .. I am pissed..
