Hongkong based derivative trading platform, SignalPlus has confirmed that they have been compromised,
https://x.com/SignalPlus_Web3/status/2118334613374329154Losses are not that big though, as according to them it's below $82k and funds is SAFU and they have started reimbursing their customers.
Here's their incident report:
Incident Summary
Based on our investigation so far, the incident originated from a compromised Telegram account belonging to a contact at one of our third-party technology vendors. Posing as this contact, the attacker communicated with one of our engineers and sent a fake Microsoft Teams meeting invitation. This social engineering attack compromised the engineer’s computer, where the attacker then remained dormant.
In the early hours of November 4, the attacker began using the engineer’s access privileges to attack our internal network. Upon detecting the activity, we blocked the attack and closed the vulnerabilities identified. We then contacted our exchange partners to proactively disable all SignalPlus-related API keys and safeguard user funds, and promptly placed all SignalPlus services into maintenance mode.
And just like any other attacks that we have seen lately, initial target is 3rd party services->social engineering attack. Lessons here that we might consider best practice is to monitor your service real time, 24x7 and if they suspected of an intrusion, then stop your services immediately and then contact your partners, like here, Binance and Deribit that's why they revoked SignalPlus API right away so that there could no spill over to their partners.
