- SignalPlus suffered a cyberattack resulting in under $82,000 in losses after an attacker used a compromised vendor Telegram account to send a malicious Microsoft Teams invite.
- The firm took responsibility for not enforcing IP whitelisting for exchange API access and confirmed it has begun fully reimbursing affected users.
- The intrusion follows a massive $6.3 billion hack disclosed by Binance, highlighting an industry-wide trend of sophisticated social engineering attacks targeting crypto personnel.
Social Engineering Breach Leads to Network Intrusion at SignalPlus
Crypto trading software platform SignalPlus has suffered a targeted cyberattack resulting in under $82,000 in unauthorized losses. According to statements published by the company on X, the security breach began through an external breach of a third-party technology vendor. The threat actor hijacked the vendor contact’s Telegram account and leveraged that identity to send a fraudulent Microsoft Teams meeting link directly to a SignalPlus engineer, subsequently compromising the staff member’s workstation.
Following the initial endpoint compromise, the intruder took a stealthy approach, remaining dormant on the engineer’s device for a period. Early Wednesday, the attacker leveraged the employee’s internal access credentials to pivot directly into the core SignalPlus internal network. The company stated that internal monitoring systems detected and contained the breach before the actor could cause broader systemic damage.
Service Interruption, Full Restitution, and Security Oversights
SignalPlus confirmed that total financial damages remained under $82,000 and announced that it has already begun the process of fully reimbursing all impacted customers. In the immediate aftermath of the intrusion, the platform proactively halted services. SignalPlus plans to safely bring operations back online over the coming days once exhaustive security reviews are completed and technical patches are applied across its infrastructure.
The firm also was transparent regarding internal architectural shortcomings that facilitated the unauthorized activity, acknowledging that it had failed to enforce strict IP whitelisting protocols on exchange API integrations. We take responsibility for this oversight,
the company said. In response, SignalPlus pledged to implement mandatory IP whitelisting—which strictly limits API interactions to an authorized set of pre-approved network addresses—alongside more rigorous internal security controls.
Rising Threat of Social Engineering in the Crypto Sector
The breach at SignalPlus surfaces just days after crypto exchange Binance revealed the specifics of a colossal $6.3 billion security breach on October 29. Much like the incident at SignalPlus, the Binance exploitation stemmed from social engineering vectors aimed directly at individual personnel endpoints.
In Binance’s postmortem analysis, cybercriminals masquerading as corporate recruiters deceived an engineer into executing a malicious file presented as a standard coding test. That breached device served as the threat actor’s beachhead, granting the attackers lateral movement throughout Binance’s technical ecosystem until they successfully compromised the exchange’s core wallet infrastructure. Underscoring the intensity of the threat landscape, Binance co-founder Yi He revealed on Tuesday that the platform had identified and blocked 57 suspected North Korea-linked cyber threats during 2026, encompassing deceptive job interviews, weaponized software dependencies, and credential-harvesting campaigns.
Why This Matters
The consecutive breaches at SignalPlus and Binance underscore how vulnerable cryptocurrency platforms remain to social engineering attacks targeting individual staff and external third-party software supply chains. While centralized networks and smart contracts undergo heavy cryptographic auditing, human operators and third-party communication channels like Telegram remain prime entry points for hackers. SignalPlus’s remediation highlights the urgent necessity of zero-trust architectures, strict API controls like IP whitelisting, and enhanced supply-chain security to prevent vendor compromises from spilling into core production environments.
Frequently Asked Questions
How did the attackers compromise SignalPlus?
The breach started when an attacker compromised the Telegram account of a contact at an external technology vendor. Impersonating this trusted contact, the hacker sent a fake Microsoft Teams meeting link to a SignalPlus engineer, gaining unauthorized access to the employee’s computer and later pivoting into the company’s internal network.
What were the financial impacts, and are users being compensated?
The total losses resulting from the incident were contained to under $82,000. SignalPlus has announced that it has already initiated full reimbursements for all affected platform users while working on restoring services following security reviews.
What technical vulnerabilities did SignalPlus identify following the incident?
SignalPlus admitted that it had neglected to mandate IP whitelisting for its exchange API access. The platform has committed to tightening these API prerequisites and upgrading its overall internal security controls to prevent future unauthorized network access.
