The attacker remained dormant on the compromised computer before using the engineer’s access privileges to target SignalPlus’s internal network early Wednesday, the company said.
SignalPlus said it detected and contained the intrusion, with total losses of less than $82,000, and had begun fully reimbursing affected users
The company temporarily suspended its services and expects to restore operations over the next few days after completing security reviews and applying patches. SignalPlus also acknowledged that it had not required IP whitelisting for exchange API access. “We take responsibility for this oversight,” the company said, adding that it would tighten API access requirements and strengthen internal security controls. IP whitelisting is a security measure that restricts API access to a predefined list of approved internet addresses.
Related: BitMart founder says security team ‘severely understaffed’ after new hack The SignalPlus incident comes days after Binance disclosed details of a $6.3 billion hack on Oct. 29, which also involved compromised employee computers. According to Binance’s postmortem, attackers posing as recruiters tricked an engineer into downloading a malicious file disguised as a coding assignment. The attackers subsequently used the compromised computer to gain access to additional systems and eventually breach the exchange’s wallet infrastructure.