Coinbase Trading Vulnerability Exposed by White-Hat Hacker

Coinbase, a cryptocurrency exchange, was notified of a vulnerability in its trading systems on Friday afternoon by the pseudonymous white-hat hacker “Tree of Alpha,” and temporarily suspended trading on its new Advanced Trading platform.

Around 6 p.m. UTC (1 p.m. ET) on Friday, @Tree of Alpha drew the attention of Coinbase leadership after tweeting that they had discovered a “potentially market-nuking” exploit and were submitting a HackerOne report.

What You Need To Know

HackerOne is a platform that manages bug bounty programs for companies such as Coinbase.

“The issue is sensitive and could allow malicious users to send all Coinbase order books to arbitrary prices,” the white-hat hacker told CoinDesk via Twitter.

Coinbase is one of the largest cryptocurrency exchanges, and its price feeds are used as inputs for oracles, which determine the true prices of tokens for applications like DeFi protocols.

Following the initial tweet, Tree of Alpha issued a follow-up tweet stating, “No actual Coinbase storages (cold or otherwise) are impacted.”

Within two hours of the Tree of Alpha’s initial tweet, the Coinbase Support Twitter account announced that Coinbase was suspending trading on its new Advanced Trading platform due to technical issues.

While the service would remain operational, users would only be able to cancel existing orders and not place new ones. The Advanced Trading service is only available to a select group of people.

Around 11 p.m. UTC (6 p.m. ET), Coinbase tweeted that it had “re-enabled full service for retail advanced trading.”

Coinbase CEO Brian Armstrong publicly tweeted his appreciation for Tree of Alpha’s assistance, writing, “.@Tree_of_Alpha you’re awesome – a big thank you for working with our team. Love how the crypto community helps each other out!”

This isn’t the first time Tree of Alpha has notified influential crypto companies about vulnerabilities in their codebase.

Tree of Alpha contacted CoinDesk last month about a problem with the site’s content management system (CMS).

The exploit allowed skilled programmers to view the headlines of CoinDesk articles saved as drafts, allowing them to make trading decisions based on non-public information. Since then, the problem has been resolved.

Tree of Alpha also investigated Tesla’s website, tweeting that the company was ready to accept crypto payments one day before CEO Elon Musk’s official Jan. 14 announcement that Tesla merchandise would be available for purchase in Dogecoin.

Tree of Alpha tests websites in search of revealing information that can be used to make profitable trades. Every now and then, a savvy hacker discovers a major vulnerability and reports it.

“In general I only leak and work to get alpha closed once it gets too widespread and it becomes advantageous to have it fixed to even out the playing field again,” Tree of Alpha told CoinDesk in a Twitter message when asked about their motivations for tweeting out alpha.