Last week, the exchange notified customers of the breach, adding the leaked information could be used to access Poloniex accounts, ZDNet reports. The email was shared on Twitter by user charlysatoshi, who initially thought it was a phishing attempt. However, Poloniex support confirmed on the social media site that it was, in fact, a legitimate email.
— Poloniex Customer Support (@PoloSupport) December 30, 2019 The exchange has also claimed that most of the emails listed aren’t attached to Poloniex accounts. “While almost all of the email addresses listed do not belong to Poloniex accounts, we are forcing a password reset on any email addresses that do have an account with us, including yours,” the email says. As ZDNet points out, Poloniex emphasized that most of the email addresses in the leak aren’t connected to the exchange. On the same day of the email also published a tweet advising users how to set up two-factor authentication (2FA) on their accounts.
Tada! ? — Poloniex Customer Support (@PoloSupport) December 30, 2019 It’s not entirely clear where the data leak has come from, who exactly was implicated in the breach, or if any accounts have been accessed by bad actors. Hard Fork has contacted Poloniex for further comment on the extent of the breach, we will update this piece in due course The lack of information might be a cause for concern for some Poloniex users. But it makes the enforced password change seem like a bit of a knee-jerk reaction, assuming it’s not trying to downplay the situation. All things considered, if you’re a Poloniex user, it’s probably best to follow their advice. Turn on 2FA and change your password. Better safe than sorry. Users are right to be weary of phishing attempts, though. Back in 2018, Google’s Play Store featured a fake cryptocurrency trading app claiming to be for Poloniex. Thankfully, the app was removed soon after it was uncovered by security researchers. Update January 3, 2020, 0727UTC: Poloniex has since issued a blog on the incident which can be found here. Despite the email stating that the exchange would be “forcing a password reset” it wanted to clarify that it did not force all customers to reset their passwords.
