The scammers informed victims that they needed to claim their winnings immediately and provided a link in the SMS. Upon clicking the link, victims were directed to log into their Binance accounts and provide their passwords, falling into the trap set by the attackers.
Binance has acknowledged that this type of attack is a common form of spoofing, where the sender of the message appears to be a trusted source. The objective is to deceive victims into following the instructions and unknowingly provide sensitive information.
Unfortunately, Binance admits that they are unable to combat this fraud effectively due to the nature of the GSM communication system that SMS messages rely on. The sender name can be easily manipulated without any checks from mobile operators, allowing scammers to pose as legitimate sources.
“Fixing this security loophole in SMS would require modifying GSM technology globally, which is an unrealistic prospect,” Binance concludes.
In a separate development, the National Agency for Prospective Projects of Uzbekistan (NAPP) announced that Binance, the world’s largest crypto exchange, will be fined for operating in the country without a license.