Artist Banksy's team was warned his website had a security weakness seven days before a hacker scammed a fan out of $336,000. The BBC reports: On Tuesday a piece of art was advertised on Banksy's official website as the world-renowned graffiti artist's first NFT (non-fungible token). A British collector won the auction to buy it, before realizing it was a fake. A cyber-security expert warned Banksy that the website could be hacked, but was ignored. Sam Curry, a professional ethical hacker from the US and founder of security consultancy Palisade, said he first heard that the site could have a weakness on the social network Discord, last month.

"I was in a security forum and multiple people were posting links to the site. I'd clicked one and immediately saw it was vulnerable, so I reached out to Banksy's team via email as I wasn't sure if anyone else had. "They didn't respond over email, so I tried a few other ways to contact them including their Instagram, but never received a response." Mr Curry's disclosure, first reported by rekt.news was made initially by email on 25 August. The BBC was shown the email thread and has tried to contact Banksy's team several times, with no response.

Mr Curry says the website flaw -- which has now been fixed -- "allowed you to create arbitrary files on the website" and post your own pages and content. The new page, called 'Banksy.co.uk/NFT,' was deleted shortly after the auction, with Banksy's team saying: "Any Banksy NFT auctions are not affiliated with the artist in any shape or form." The British man who won the auction is a prominent NFT collector and Banksy fan known on Twitter as Pranksy. He said he felt "burned" when he was scammed out of nearly $340,000 in cryptocurrency coins, but was relieved when the hacker inexplicably returned most of the money to him by the end of the day.

In mid-July this year, Texas-based software provider SolarWinds released an emergency security update to patch a zero-day in its Serv-U file transferring technology that was being exploited in the wild. From a report: At the time, SolarWinds did not share any details about the attacks and only said that it learned of the bug from Microsoft's security team. In a blog post on Thursday, Microsoft revealed more details about the July attacks. The company said the zero-day was the work of a new threat actor the company was tracking as DEV-0322, which Microsoft described as "a group operating out of China, based on observed victimology, tactics, and procedures." Microsoft said the group targeted SolarWinds Serv-U servers "by connecting to the open SSH port and sending a malformed pre-auth connection request," which allowed DEV-0322 operators to run malicious code on the targeted system and take over vulnerable devices. The OS maker did not go into details about what the intruders did once they breached a target. It is unclear if the hackers were interested in cyber-espionage and intelligence collection or if DEV-0322 was a run-of-the-mill crypto-mining gang.

New submitter throx shares a report from Android Police: For months users of the three-year-old Pixel 3 series have been complaining of a common and dreadful problem: seemingly random shutdowns that completely lock their devices. The Pixel 3 and 3 XL have been plagued by the "EDL Mode" bug, which locks the device with no screen or button inputs and makes it more or less impossible to use. To date there's no clear solution to this problem, at least not one that's easily available to even advanced users.

Google's official support channels are aware of the issue, and that it seems to be accelerating in terms of users in the last few months. But since more or less every Pixel 3 and 3 XL sold is out of warranty at this point, options are limited. You can start an official support ticket with Google and pay for a repair, or (as one volunteer on the Google support forums suggests) take it into an authorized repair shop to see if their Qualcomm tools can get the phone to wake up. At the time of writing there doesn't seem to be any indication of a user-accessible fix for the EDL issues.

Cybercrime and computer security reporter Brian Krebs tells the story of a cybercrime group that compromises up to 100,000 email inboxes per day, and apparently does little else with this access except siphon gift card and customer loyalty program data that can be resold online. From the report: The data in this story come from a trusted source in the security industry who has visibility into a network of hacked machines that fraudsters in just about every corner of the Internet are using to anonymize their malicious Web traffic. For the past three years, the source -- we'll call him "Bill" to preserve his requested anonymity -- has been watching one group of threat actors that is mass-testing millions of usernames and passwords against the world's major email providers each day. Bill said he's not sure where the passwords are coming from, but he assumes they are tied to various databases for compromised websites that get posted to password cracking and hacking forums on a regular basis. Bill said this criminal group averages between five and ten million email authentication attempts daily, and comes away with anywhere from 50,000 to 100,000 of working inbox credentials.

In about half the cases the credentials are being checked via "IMAP," which is an email standard used by email software clients like Mozilla's Thunderbird and Microsoft Outlook. With his visibility into the proxy network, Bill can see whether or not an authentication attempt succeeds based on the network response from the email provider (e.g. mail server responds "OK" = successful access). You might think that whoever is behind such a sprawling crime machine would use their access to blast out spam, or conduct targeted phishing attacks against each victim's contacts. But based on interactions that Bill has had with several large email providers so far, this crime gang merely uses custom, automated scripts that periodically log in and search each inbox for digital items of value that can easily be resold. And they seem particularly focused on stealing gift card data.

"Sometimes they'll log in as much as two to three times a week for months at a time," Bill said. "These guys are looking for low-hanging fruit -- basically cash in your inbox. Whether it's related to hotel or airline rewards or just Amazon gift cards, after they successfully log in to the account their scripts start pilfering inboxes looking for things that could be of value." According to Bill, the fraudsters aren't downloading all of their victims' emails: That would quickly add up to a monstrous amount of data. Rather, they're using automated systems to log in to each inbox and search for a variety of domains and other terms related to companies that maintain loyalty and points programs, and/or issue gift cards and handle their fulfillment. Why go after hotel or airline rewards? Because these accounts can all be cleaned out and deposited onto a gift card number that can be resold quickly online for 80 percent of its value.

An anonymous reader quotes a report from Motherboard: It looks like a Lightning cable, it works like a Lightning cable, and I can use it to connect my keyboard to my Mac. But it is actually a malicious cable that can record everything I type, including passwords, and wirelessly send that data to a hacker who could be more than a mile away. This is the new version of a series of penetration testing tools made by the security researcher known as MG. MG previously demoed an earlier version of the cables for Motherboard at the DEF CON hacking conference in 2019. Shortly after that, MG said he had successfully moved the cables into mass production, and cybersecurity vendor Hak5 started selling the cables. But the more recent cables come in new physical variations, including Lightning to USB-C, and include more capabilities for hackers to play with.

"There were people who said that Type C cables were safe from this type of implant because there isn't enough space. So, clearly, I had to prove that wrong. :)," MG told Motherboard in an online chat. The OMG Cables, as they're called, work by creating a Wi-Fi hotspot itself that a hacker can connect to from their own device. From here, an interface in an ordinary web browser lets the hacker start recording keystrokes. The malicious implant itself takes up around half the length of the plastic shell, MG said. MG said that the new cables now have geofencing features, where a user can trigger or block the device's payloads based on the physical location of the cable. "It pairs well with the self-destruct feature if an OMG Cable leaves the scope of your engagement and you do not want your payloads leaking or being accidentally run against random computers," he said. "We tested this out in downtown Oakland and were able to trigger payloads at over 1 mile," he added. He said that the Type C cables allow the same sort of attacks to be carried out against smartphones and tablets. Various other improvements include being able to change keyboard mappings, the ability to forge the identity of specific USB devices, such as pretending to be a device that leverages a particular vulnerability on a system.

An anonymous reader shares a report: An anonymous reader Days before Christmas in 2015, Juniper Networks alerted users that it had been breached. In a brief statement, the company said it had discovered "unauthorized code" in one of its network security products, allowing hackers to decipher encrypted communications and gain high-level access to customers' computer systems. Further details were scant, but Juniper made clear the implications were serious: It urged users to download a software update "with the highest priority." More than five years later, the breach of Juniper's network remains an enduring mystery in computer security, an attack on America's software supply chain that potentially exposed highly sensitive customers including telecommunications companies and U.S. military agencies to years of spying before the company issued a patch.

Those intruders haven't yet been publicly identified, and if there were any victims other than Juniper, they haven't surfaced to date. But one crucial detail about the incident has long been known -- uncovered by independent researchers days after Juniper's alert in 2015 -- and continues to raise questions about the methods U.S. intelligence agencies use to monitor foreign adversaries. The Juniper product that was targeted, a popular firewall device called NetScreen, included an algorithm written by the National Security Agency. Security researchers have suggested that the algorithm contained an intentional flaw -- otherwise known as a backdoor -- that American spies could have used to eavesdrop on the communications of Juniper's overseas customers. NSA declined to address allegations about the algorithm.

Juniper's breach remains important -- and the subject of continued questions from Congress -- because it highlights the perils of governments inserting backdoors in technology products. "As government agencies and misguided politicians continue to push for backdoors into our personal devices, policymakers and the American people need a full understanding of how backdoors will be exploited by our adversaries," Senator Ron Wyden, a Democrat from Oregon, said in a statement to Bloomberg. He demanded answers in the last year from Juniper and from the NSA about the incident, in letters signed by 10 or more members of Congress.

The biggest frustration among new car owners is that they can't get their car and smartphone to talk to one another, a new J.D. Power study finds. From a report: Consumers want their digital lives to follow them seamlessly in the car, which is why Apple CarPlay and Android Auto have become so popular. But if the wireless connection is glitchy, such features don't work, leaving car owners unhappy. "Owners are caught in the middle when vehicle and phone technologies don't properly connect," says Dave Sargent, vice president of automotive quality at J.D. Power.

1 in 4 problems cited by car buyers in the first 90 days of ownership involves infotainment, according to the J.D. Power 2021 Initial Quality Study (IQS), released Tuesday. For the first time in a decade, voice recognition is not the top problem; instead, it's Apple CarPlay/Android Auto connectivity, which worsened significantly, especially for those trying to connect wirelessly. About one-third of new cars now come with a built-in WiFi hub, which may or may not be compatible with a phone's operating system.

Microsoft is announcing that Windows 11 will be released on October 5. The new operating system will be available as a free upgrade for eligible Windows 10 PCs, or on new hardware that ships with Windows 11 pre-loaded. From a report: The free upgrade to Windows 11 will start rolling out on October 5th, but like many Windows upgrades in the past, it will be available in phases. New eligible devices will be offered the upgrade first, and then Windows 11 will become available for more in-market devices in the weeks and months following October 5th. "Following the tremendous learnings from Windows 10, we want to make sure we're providing you with the best possible experience," explains Aaron Woodman, general manager of Windows marketing at Microsoft. "We expect all eligible devices to be offered the free upgrade to Windows 11 by mid-2022."

Last week, media reported how Microsoft's Windows 11 won't technically leave millions of PCs behind -- the company told the press that it won't actually block you from installing Windows 11 on a PC with an older CPU, so long as you download and manually install an ISO file all by yourself. But it turns out even that technicality has a technicality. The Verge: Microsoft is now threatening to withhold Windows Updates from your copy of Windows 11 -- potentially even security updates -- if you take that route. We're not sure why the company didn't mention it in our original briefing, but Microsoft has since told The Verge that unsupported PCs won't be entitled to receive Windows Updates, and that even security and driver updates may be withheld.

A columnist for Inc. writes that Google "may reduce the salaries of employees who choose to work at home full-time, based on the cost of living where they live, according to an internal calculator viewed by Reuters."

They also argue that Google's move is "likely to be a disaster." It may seem sensible, given that a salary that barely covers a San Francisco studio apartment might get you a mansion in, say, Topeka. That's the logic Google says it's using. "Our compensation packages have always been determined by location," a spokesperson told Reuters.

But cutting pay for existing employees who opt to work from home is a terrible idea and it shows a complete lack of emotional intelligence. If Google is smart, it will shelve this idea. So will Facebook, Twitter, the UK government, and any other company considering a similar move. Here's why:

1. A salary is about more than just paying the bills... In real life, a pay cut will feel like an insult to most employees, even if it has nothing to do with their performance or their value to the company. You're literally telling them that they're worth less. Is that the message you want them to hear?

2. Google is being greedy... Like other tech giants, it's thrived during the pandemic. Cutting people's salaries when your share price has more than doubled, your revenues are up 62 percent, and your profits are up even more seems like the pinnacle of corporate greed. Not a good look.

3. It will make Google even more unequal than it already is...

"While workers who want to stay at home forever have been especially vocal about their demands, a silent majority of Americans do want to get back to the office, at least for a few days a week..." reports the New York Times. The article, shared by long-time Slashdot reader gollum123, cites the opinions of workers in a variety of industries. In a national survey of more than 950 workers, conducted in mid-August by Morning Consult on behalf of The New York Times, 31 percent said they would prefer to work from home full time. By comparison, 45 percent said they wanted to be in a workplace or an office full time. The remaining 24 percent said they wanted to split time between work and home... The data intelligence company's findings echoed recent internal surveys by employers like Google and Twitter, as well as outside surveys by firms like Eden Workplace. Among those craving the routines of office life and cubicle chatter: social butterflies, managers, new hires eager to meet colleagues, and people with noisy or crowded homes...

Certainly, some people have thrived in their new remote work lives. They saved time and money, and sometimes increased productivity. The degree to which employees have embraced permanent remote or hybrid work models has been "stunning" to company executives, said Tsedal Neeley, a Harvard Business School professor who has studied remote work for decades. But for others, Professor Neeley said, it has removed needed barriers between work and home life, increased a sense of isolation and led to burnout. "Some people just dislike the screen — their physicality and their proximity to others is a big part of what work looks like," she said.
In the Times' article, here's how one 23-year-old recent college graduate starting at Google described their own dilemma.

"If we don't get a really solid foundation at this company in our first six months, our first year, what foot does that leave us on for the rest of our time at the company?"

Long-time Slashdot reader theodp writes: Mr. President," Code.org founder Hadi Partovi told President Joe Biden and tech CEOs from Microsoft, Amazon, Google, Apple, and IBM at Wednesday's Presidential Summit on Cybersecurity, "America's cybersecurity problem is an education problem. I loved [Microsoft CEO] Satya Nadella's wonderful analogy to the car industry, and like Satya said, we need standards for seatbelts in every car for sure. But if none of the drivers took a course in basic safety skills, our roads could never, ever be safe. That's the current state of affairs on the roads of the internet. Without proper education, we can't address our nation's weakest link. If you look around, every CEO is nodding their head because they know we need a plan to educate every American on basic cyber security hygiene, and also a plan to staff up our cyber defense workforce. This needs to start early, in K-12, and reach everybody."

A newly-released White House Fact Sheet announcing "Ambitious Initiatives to Bolster the Nation's Cybersecurity" notes that tech-bankrolled "Code.org announced it will teach cybersecurity concepts to over 3 million students across 35,000 classrooms over 3 years, to teach a diverse population of students how to stay safe online, and to build interest in cybersecurity as a potential career."

Infosecurity magazine reports: Some of the world's biggest tech companies have committed tens of billions of dollars to improving supply chain security, closing industry skills gaps and driving security awareness among the public, according to the White House.

As reported by Infosecurity yesterday, the Biden administration welcomed the CEOs of Microsoft, Apple, Google, IBM and others to a meeting yesterday to discuss the "whole-of-nation" effort needed to address cybersecurity threats." The result of that encounter has been a series of commitments from these firms, including $10bn from Google over the next five years to expand zero trust and improve supply chain and open source security. The tech giant will apparently also help 100,000 Americans earn "digital skills certificates."

IBM said it would train 150,000 people in cyber skills over the coming three years and focus on improving the diversity of the security workforce, while Microsoft has committed $20bn over five years to drive security by design, and $150m for federal, local and state governments. Apple will establish a new program to improve supply chain security, including among its 9000 US suppliers, with multi-factor authentication (MFA), vulnerability remediation, event logging and incident response all playing a key role. Amazon is making MFA devices available to all AWS customers and rolling out the security training it offers employees to the general public.

Aside from these commitments, the White House announced the expansion of its Industrial Control Systems Cybersecurity Initiative, from the electricity sector to natural gas pipelines, and said the National Institute of Standards and Technology (NIST) would develop a new framework for supply chain security. In another potentially significant move, insurer Resilience said it would require policyholders to meet a threshold of cybersecurity best practice as a condition of receiving coverage — something experts have been demanding for some time across the industry.
NextGov.com also quotes the president's remarks about a cybersecurity executive order issued May 12th: "Because of that order, government will only buy tech products that meet certain cybersecurity standards, which will have a ripple effect across the software industry, in our view, ultimately improving security for all Americans,"

T-Mobile said a cyberattack earlier this month that exposed millions of customer records was carried out using specialized tools to gain entry to the network, followed by brute force-style hacking techniques to access user data. From a report: "In short, this individual's intent was to break in and steal data, and they succeeded," Chief Executive Officer Mike Sievert said Friday in a statement, the company's fullest account yet of what happened. The company has hired cybersecurity provider Mandiant and consulting firm KPMG to improve its defenses, he said. The breach, the fourth that has compromised T-Mobile customer records in as many years, involved personal information including names, dates of birth, Social Security numbers and driver's license information. Sievert said the company is working with law enforcement and can't share further details of what happened. Further reading: T-Mobile Hacker Explains How He Breached Carrier's Security.

A team of scientists from a Swiss university has discovered a way to bypass PIN codes on contactless cards from Mastercard and Maestro. From a report: The now-patched vulnerability would have allowed cybercriminals to use stolen Mastercard and Maestro cards to pay for expensive products without needing to provide PINs on contactless payments. Discovered by a team from the Department of Computer Science at the ETH Zurich university, the attack is extremely stealthy and could be easily deployed in a real-world scenario if new bugs in contactless payment protocols are discovered. The general idea behind the attack is for an attacker to interpose itself between the stolen card and a vendor's Point-of-Sale (PoS) terminal, in what security researchers would normally call a Man/Person/Meddler-in-the-Middle (MitM) scenario.

To achieve this, an attacker would require: a stolen card, two Android smartphones, a custom-made Android app that can tamper with a transaction's fields. The app is installed on both smartphones, which will act as emulators. One smartphone will be placed near the stolen card and act as a PoS emulator, tricking the card into initiating a transaction and sharing its details, while the second smartphone will act as a card emulator and be used by a crook to feed modified transaction details to a real-life PoS terminal inside a store.

Elise Blanchard, writing on Mozilla blog: [...]

What happened in 1993 to suddenly make hyperlinks blue? No one knows, but I have some theories. I often hear that blue was chosen as the hyperlink color for color contrast. Well, even though the W3C wasn't created until 1994, and so the standards for which we judge web accessibility weren't yet defined, if we look at the contrast between black as a text color, and blue as a link color, there is a contrast ratio of 2.3:1, which would not pass as enough color contrast between the blue hyperlink and the black text. Instead, I like to imagine that Cello and Mosaic were both inspired by the same trends happening in user interface design at the time. My theory is that Windows 3.1 had just come out a few months before the beginning of both projects, and this interface was the first to use blue prominently as a selection color, paving the way for blue to be used as a hyperlink color.

Additionally, we know that Mosaic was inspired by ViolaWWW, and kept the same gray background and black text that they used for their interface. Reviewing Mosaic's release notes, we see in release 0.7 black text with underlines appearing as the preferred way of conveying hyperlinks, and we can infer that was still the case until something happened around mid April right before when blue hyperlinks made their appearance in release 0.13. In fact, conveying links as black text with underlines had been the standard since 1985 with Microsoft 1, which some once claimed Microsoft had stolen from Apple's Lisa's look and feel.

I think the real reason why we have blue hyperlinks is simply because color monitors were becoming more popular around this time. Mosaic as a product also became popular, and blue hyperlinks went along for the ride. Mosaic came out during an important time where support for color monitors was shifting; the standard was for hyperlinks to use black text with some sort of underline, hover state or border. Mosaic chose to use blue, and they chose to port their browser for multiple operating systems. This helped Mosaic become the standard browser for internet use, and helped solidify its user interface as the default language for interacting with the web.

Microsoft has warned thousands of its cloud computing customers, including some of the world's largest companies, that intruders could have the ability to read, change or even delete their main databases, according to a copy of the email and a cyber security researcher. From a report: The vulnerability is in Microsoft Azure's flagship Cosmos database. A research team at security company Wiz discovered it was able to access keys that control access to databases held by thousands of companies. Wiz Chief Technology Officer Ami Luttwak is a former chief technology officer at Microsoft's Cloud Security Group. Because Microsoft cannot change those keys by itself, it emailed the customers Thursday telling them to create new ones. Microsoft agreed to pay Wiz $40,000 for finding the flaw and reporting it, according to an email it sent to Wiz. Microsoft's email to customers said it has fixed the vulnerability and that there was no evidence the flaw had been exploited. "We have no indication that external entities outside the researcher (Wiz) had access to the primary read-write key," according to a copy of the email seen by Reuters.

According to the Wall Street Journal, the person behind T-Mobile's recent security breach that affected more than 50 million customers is a 21-year-old named John Binns. " Binns said he broke through the T-mobile defenses after discovering an unprotected router exposed on the internet, after scanning the carrier's internet addresses for weak spots using a publicly available tool," reports Axios. From the report: "I was panicking because I had access to something big," he wrote in Telegram messages to the Journal. "Their security is awful." "Generating noise was one goal," Binns said. He declined to say whether he sold any of the information he stole, or whether he was paid for the hack.

Some of the information exposed in the breach included names, dates of birth, social security numbers and personal ID information. The breach is being investigated Seattle's FBI office, according to the Journal.

An anonymous reader shares a report: Steven Adair hunts hackers for a living. Back in January, in a corner-of-his-eye, peripheral kind of way, he thought he saw one in his customer's networks -- a shadowy presence downloading emails. Adair is the founder of a cybersecurity company called Volexity, and he runs traps to corner intruders all the time. So he took a quick look at a server his client was using to run Microsoft Exchange and was stunned to "see requests that we're not expecting," he said. There were requests for access to specific email accounts, requests for confidential files. He followed all this requested information to a virtual server off-site. "The hair is almost rising on my arms right now when I think about it," Adair told NPR later. "This feeling of like, oh, crap this is not what should be going on." What Adair discovered was a massive hack into Microsoft Exchange -- one of the most popular email software programs in the world. For nearly three months, intruders helped themselves to everything from emails to calendars to contacts. Then they went wild and launched a second wave of attacks to sweep Exchange data from tens of thousands of unsuspecting victims. They hit mom-and-pop shops, dentist offices, school districts, local governments -- all in a brazen attempt to vacuum up information.

Both the White House and Microsoft have said unequivocally that Chinese government-backed hackers are to blame. NPR's months-long examination of the attack -- based on interviews with dozens of players from company officials to cyber forensics experts to U.S. intelligence officials -- found that stealing emails and intellectual property may only have been the beginning. Officials believe that the breach was in the service of something bigger: China's artificial intelligence ambitions. The Beijing leadership aims to lead the world in a technology that allows computers to perform tasks that traditionally required human intelligence -- such as finding patterns and recognizing speech or faces. "There is a long-term project underway," said Kiersten Todt, who was the executive director of the Obama administration's bipartisan commission on cybersecurity and now runs the Cyber Readiness Institute. "We don't know what the Chinese are building, but what we do know is that diversity of data, quality of data aggregation, accumulation of data is going to be critical to its success."

An anonymous reader quotes a report from CNBC: Interviews with Coinbase customers around the country and a review of thousands of complaints reveal a pattern of account takeovers, where users see money suddenly vanish from their account, followed by poor customer service from Coinbase that made those users feel left hanging and angry. Making the issue even worse, cryptocurrency transactions cannot be reversed, according to the FBI. Experts say once criminals access an account, funds can be drained in minutes. Coinbase, which went public in April, has a market cap of about $65 billion, has more than 68 million users in 100-plus countries, more than 2,100 full-time employees and $223 billion in held assets, according to the company. While the cryptocurrency exchange company has grown rapidly, complaints have continued to arise. Since 2016, Coinbase users have filed more than 11,000 complaints against Coinbase with the Federal Trade Commission and Consumer Financial Protection Bureau, mostly related to customer service. Former employees told CNBC the company's customer service practices shifted over time, with representatives struggling to keep up with demand.

After a review of Coinbase's complaints, the Better Business Bureau in March determined the company has a "pattern of complaints from customers who state they are locked out of their accounts, even after providing required information or updates." The organization has received 1,128 complaints in the past three years, according to its website. BBB said it sent a letter to Coinbase in order to address the customers' complaints and receive feedback from any implemented improvements. The group has "not heard a response from this business, about the situation, pattern of complaints for the last three years," Alma Galvan, a marketing and communication manager with the organization, said in an email to CNBC. In an email to CNBC, Coinbase said: "Over the years, we've consistently updated our customer support offerings to help us scale. In early 2020, we moved to email as our primary channel of support. Many of our customer inquiries require our agents to conduct a significant amount of research to resolve the issue. And, to avoid long wait times, communicating asynchronously via email was the preferred method. However, we recognize that customers want real-time support, and that's why we're rolling out phone support for ATOs this month and live messaging for all customers later this year."

Asked about the number of customer service complaints, the company said: "Over the past several years, our customer base grew exponentially. We grew from 43+ million users at the end of 2020 to 68+ million registered users, as of June 30, 2021. Through all this growth, some of our customers unfortunately experienced challenges and delays reaching our support team, which resulted in a negative impact for some of our customers. Improving our customer experience remains a top priority for Coinbase." They declined to disclose how many customers' accounts have been hacked or the total amount it has refunded customers as a result of the hacks.