Website Glitch Let Me Overstock My Coinbase
Summary: A flaw in Overstock.com's bitcoin checkout let customers pay with bitcoin cash, worth roughly 15 percent of bitcoin, while the site's invoices were denominated in bitcoin, and canceled orders were refunded in bitcoin rather than bitcoin cash. KrebsOnSecurity bought $78.27 of solar lamps for about $12.02 in bitcoin cash, and Overstock and Coinbase said the issue, which Coinbase said existed for about three weeks, was fixed within hours of being reported by researcher JB Snyder of Bancsec.
Bottom line: The refund direction was the real exposure: a customer could pay roughly $15,000 in bitcoin cash for a $100,000 item, cancel, and be refunded nearly $100,000 in bitcoin - an $85,000 gain per order, repeatable - which is the kind of asymmetry a security leader should test for in any multi-currency payment integration.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026