Crypto trading platform SignalPlus has confirmed that attackers compromised an engineer’s computer through a fraudulent Microsoft Teams invitation, prompting major cryptocurrency exchanges including Binance and Deribit to revoke SignalPlus API keys in response to the security incident Cointelegraph.
The breach resulted in losses of less than $82,000, which SignalPlus has pledged to reimburse in full. The attack utilized a fake Teams invite as its entry vector, allowing unauthorized access to internal systems and underscoring persistent social engineering vulnerabilities within digital asset infrastructure. The relatively limited scope of the SignalPlus incident contrasts sharply with recent larger-scale breaches, yet prompted immediate action from partner exchanges to sever API connectivity as a precautionary measure.
The SignalPlus compromise arrives as United States regulators intensify oversight of financial institution security protocols following last week’s $6.3 billion breach at Binance. According to reports, the Federal Reserve and the Office of the Comptroller of the Currency (OCC) have contacted banks to review security practices and assess transaction risks in light of the massive hack Cointelegraph.
Industry experts have raised concerns regarding systemic vulnerabilities exposed by the Binance attack, prompting regulatory outreach to traditional financial institutions that maintain exposure to cryptocurrency markets. The simultaneous occurrence of the targeted SignalPlus social engineering incident and the systemic Binance breach illustrates the diverse threat landscape facing digital asset platforms, ranging from sophisticated phishing tactics targeting individual employees to large-scale infrastructure compromises.
In response to heightened security concerns, Coinbase has publicly detailed its custody practices to reassure users, stating that the exchange was not affected by the Binance incident. The company emphasized that over 99% of customer cryptocurrency assets reside in offline cold storage, effectively placing them beyond the reach of external attackers The Block.
Coinbase further elaborated on its technical safeguards, including split private key mechanisms and kill switches designed to halt unauthorized withdrawal attempts Decrypt. These security disclosures highlight divergent approaches to asset protection across major exchanges, as platforms seek to demonstrate resilience against the attack vectors that have compromised competitors.
The convergence of immediate API access revocations by major exchanges and federal banking oversight signals a potential shift toward stricter security standards across the cryptocurrency ecosystem. As regulators probe traditional banking security practices in the context of crypto risks, and as exchanges audit third-party API integrations, the industry faces mounting pressure to implement hardened defenses against both targeted social engineering exploits and large-scale theft operations.