D4U｜Crypto Risk Isolation Labs

4 data leaks reported today: 1. Coinbase's vendor Amplitude exposed some users’ contact data (funds unaffected). 2. Bithumb (Korea) had user data leaks. In TradFi, two securities firms in Korea leaked data: 3. Mirae Asset 4. Daishin Securities You can't prevent a leak, but you can protect yourself. Leaked exchange data (names, emails, phone numbers, addresses, ID documents, transaction history) is mostly used for phishing, SIM swapping, and social engineering. Reduce info you share - Use a unique email alias for each exchange (SimpleLogin, Apple Hide My Email, etc). A leak then can't be linked to your other accounts, and you can spot which service leaked. - Share only what's required. Don't add optional profile details. - Use a dedicated phone number (a VoIP or secondary SIM) for exchange accounts if you can, since leaked numbers are the main route to SIM swaps. Lock down the account - Use a unique, long password from a password manager. - Turn on hardware security keys (YubiKey) or passkeys, or at least an authenticator app. - Avoid SMS 2FA. - Enable withdrawal address whitelisting and a withdrawal time lock if the exchange offers them. - Set up an anti-phishing code, which puts a code you choose in every legitimate email from the exchange. - Review active sessions and API keys regularly. Delete any API keys you don't use. - Restrict API keys to withdraw-disabled and IP-whitelisted. Defend against - SIM swapping: Ask your carrier to add a port-out PIN or number lock. - Phishing and impersonation: Assume anyone who contacts you about your account, "security issues," or "refund recovery" is a scammer, even if they know your name, balance, or recent trades. - Exchange support staff don't ask for your password, 2FA codes, or seed phrase. - Never click links in emails or texts. Go to the site yourself. - "Wrench attacks": Leaked addresses plus holdings data have led to real-world extortion and robberies. Don't publicize your holdings, and keep large balances out of anything tied to your home address if you can. If a breach is announced 1. Change the exchange password and any other account that reused it. 2. Check haveibeenpwned.com for your email address. 3. Revoke API keys and active sessions. 4. Review recent withdrawals and security settings. 5. Watch for phishing emails and texts that reference the breach, because scammers move fast after one. Stay SAFU! 🙏