Binance has warned users about a surge in phishing texts disguised as urgent account security alerts — fake notices about changed settings and suspicious logins that push recipients to click shortened links and "verify" or "secure" their accounts on imitation pages built to harvest passwords and authentication codes.
The exchange said the fraudulent messages are designed to look like official Binance notifications, commonly warning of an unexpected login, a settings change or another supposed security issue requiring immediate action. "We've recently observed an increase in phishing attacks targeting crypto users," Binance said, without quantifying the increase, disclosing how many users received the messages, or providing a figure for losses connected to this specific campaign. The goal, as the exchange put it, is simple: get you to click before you think.
How the phishing texts work — and fail
The mechanism follows a mature playbook. The links route recipients to websites imitating Binance's login or account verification pages, where scammers collect the credentials and one-time codes needed to access the real account. Binance's counter-message is categorical: it will never ask customers to click a text-message link to verify or secure an account. Users who receive unexpected messages should open the official app or type the exchange's address directly, and can run any website, email, phone number or social account through Binance Verify to confirm whether it belongs to the exchange — before entering any information or contacting anyone presented as support. Anyone who already followed a suspicious link should contact Binance support through the official app and stop communicating with the sender, never sharing passwords, recovery phrases or authentication codes.
Impersonation has a costed history. In 2025, Australia's Federal Police flagged spoofed messages that appeared inside existing Binance message threads — a technique that defeats the "check the sender" instinct because the text lands in a genuine conversation. In 2023, Hong Kong police said 11 users lost about $446,000 after messages threatened account deactivation unless they completed verification. The industry's response is turning structural: in July 2026, Hong Kong's Securities and Futures Commission ordered licensed crypto platforms to abandon SMS, email and app-generated one-time codes, requiring phishing-resistant authentication methods within 12 months — an acknowledgment that OTP-based login is now the attack surface, not the defense.
What actually protects an account
Binance's advice centers on three controls that survive credential theft. A withdrawal address whitelist restricts transfers to destinations the account holder approved in advance, so an attacker with stolen login details still cannot route funds anywhere new. An anti-phishing code embeds a user-chosen marker in every legitimate Binance email, making spoofed emails identifiable at a glance — though the protection covers email, not SMS, which is exactly where the current campaign lives. And the exchange's automated fraud systems, which Binance says run more than 100 AI models, have cut phishing success rates eightfold — but platform controls cannot prevent losses when a user voluntarily hands over credentials or approves a transfer after deceptive instructions. The recent password-reset email panic showed how credential phishing scales, and enforcement agencies are now treating scam infrastructure as a priority target — but the individual account remains the softest layer in the stack.
The warning also lands in a week when Binance's security posture is under wider scrutiny. Its EU regulatory position remains contested, and the exchange is simultaneously cleaning up its listed assets and expanding products — a posture that depends on user trust compounding faster than attacker sophistication. For users, the practical checklist is short and unforgiving: no text link is a Binance login, no legitimate alert requires urgency, whitelists cost minutes and save accounts, and the moment a "security alert" arrives by SMS, the correct move is to close it and open the app. The phishing campaign has no announced victims and no disclosed losses — which is precisely why Binance published the warning before it does.
