{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-binance-and-kraken-block-bribery-attempts-aimed-at-support-staff"},"incident":{"title":"Binance and Kraken block bribery attempts aimed at support staff","date":"2025-05","date_precision":"month","victim_org":"Binance and Kraken","sector":"Cryptocurrency","country":"United States","primary_vector":"Insider Recruitment","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"Contact was made over Telegram; no AI-generated media was reported.","outcomes":["Attempt Blocked"],"loss_usd":null,"loss_note":"No losses; both attempts were stopped before any customer data was exposed.","records_affected":null,"threat_actor":null,"summary":"In the weeks around the Coinbase insider breach, the same style of attack was attempted against Binance and Kraken. Bloomberg-sourced reporting said threat actors approached customer support staff at both exchanges over Telegram and offered bribes for system access and customer data. Both exchanges detected and blocked the approaches, and neither reported any user data exposure.","how_it_worked":"Attackers contacted individual support agents directly on Telegram, offering cryptocurrency payment and supplying step-by-step instructions on how to retrieve and exfiltrate customer records, evade internal monitoring, and receive payment. The pitch targeted people rather than systems, on the assumption that a support agent with broad record access is cheaper to buy than a vulnerability is to find. Binance's monitoring flagged the suspicious communication patterns, including bribe-related keywords and outbound Telegram contact attempts, while both exchanges relied on data-access policies tightened in late 2024 to limit what any single agent could pull.","lessons":"Access limits that make a single agent's data reach small, plus monitoring for recruitment-style contact and anomalous record retrieval, turn insider bribery into a detected event rather than a breach.","confidence":"Reported","sources":[{"title":"Social Engineering Plot Foiled at Binance and Kraken After Coinbase Breach Fallout","url":"https://yellow.com/news/social-engineering-plot-foiled-at-binance-and-kraken-after-coinbase-breach-fallout","publisher":"Yellow"}],"entry_type":"incident","slug":"2025-binance-and-kraken-block-bribery-attempts-aimed-at-support-staff","year":2025,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-binance-and-kraken-block-bribery-attempts-aimed-at-support-staff"}}