Binance and Deribit revoke SignalPlus API keys after security breach
Binance and Deribit revoked all API keys connected to third-party trading platform SignalPlus following a security breach that resulted in under $82,000 in stolen user funds, while both exchanges confirmed their own systems remained unaffected.
Cryptocurrency exchanges Binance and Deribit have proactively removed all API keys linked to third-party crypto trading platform SignalPlus following a security incident at the firm. Both exchanges announced that their internal systems were not impacted by the event and that user funds held on their platforms remain safe.[1][2][3][5]
According to a disclosure by SignalPlus reported by Protos, the breach occurred after an attacker compromised the Telegram account of one of its external partners and posed as that contact to send a malicious Microsoft Teams meeting invitation to an engineer. The attacker compromised the engineer's device and, by Nov. 4, used those elevated permissions to infiltrate the internal network. SignalPlus stated that under $82,000 in user funds was stolen, pledging to fully reimburse affected customers while keeping its services offline until system security is verified.[3]
Following the revocation of access, Binance urged users who connected through SignalPlus to log directly into their accounts to review active positions and open orders. The exchange recommended enabling IP whitelisting and waiting for SignalPlus to confirm full resolution before rebinding any API keys. Former Binance CEO Changpeng Zhao also warned traders to revoke any SignalPlus API keys configured across other exchanges.[2][3][4][6]
Key facts
- Binance proactively removed all API keys tied to SignalPlus after the trading platform reported a potential security issue.
- Deribit also revoked all SignalPlus-linked API keys, reporting no indication of impact on its own systems or data.
- SignalPlus stated that an attacker used a compromised Telegram account from a partner to send a fake Microsoft Teams invite to an engineer, breaching its internal network.
- Less than $82,000 in user funds was stolen, and SignalPlus announced it will reimburse affected users.
- Binance advised users to review open orders and positions directly, enable IP whitelisting, and wait for resolution before reconnecting keys.
- Former Binance CEO Changpeng Zhao urged traders to revoke SignalPlus API keys on other crypto exchanges.
Sources · 7 sources
- WB
Wu Blockchain@WuBlockchainPost on X ·
Binance and Deribit Revoke SignalPlus-Linked API Keys Over Potential Security Issue Binance announced that it has proactively revoked all API keys linked to third-party crypto trading platform SignalPlus following a potential security issue reported by the platform. Binance said its systems remain unaffected and user funds are safe. Deribit has also removed SignalPlus-linked API keys as a precaution, stating that it found no indication of any impact on its systems or data. Both exchanges advised affected users to review their positions and open orders and wait for SignalPlus to confirm the issue has been resolved before reconnecting.
Open source - CB
Crypto Briefing@Crypto_BriefingPost on X ·
🚨JUST IN: Binance has removed all API keys linked to SignalPlus after a potential security issue, saying its systems and user funds remain unaffected. https://t.co/KFkN7J0tDg
Open source - PR
ProtosArticle ·
Binance drops SignalPlus API keys after potential hack Binance has removed all of its API keys associated with crypto trading terminal SignalPlus as an “immediate precautionary measure” following a hack at the third-party firm. Binance posted today to its X account, “Binance’s own systems are unaffected. User funds remain safe.” Crypto derivatives exchange Deribit also removed all SignalPlus API keys in response to a potential incident. We also encourage all third-party platforms integrated with Binance to review their security controls, monitor for unusual activity and contact us immediately if they detect any concern This is not a challenge for any single company…… https://t.co/ESQaw3baqT — Yi He (@heyibinance) November 5, 2026 Read more: BitMart hit by $391K hack amid security staff exodus SignalPlus says $82K in user funds were stolen SignalPlus has since confirmed on X that it was hacked and under $82,000 worth of user funds was stolen. It claims it was targeted via a compromised Telegram account belonging to one of its third-party partners. “Posing as this contact, the attacker communicated with one of our engineers and sent a fake Microsoft Teams meeting invitation,” SignalPlus claimed. The engineers computer was comprised, and then, by November 4, the waiting hacker “began using the engineer’s access privileges to attack our internal network.” SignalPlus says it was able to shut down the incident, and that it will reimburse user losses. In the meantime, SignalPlus’ services will remain unavailable until it’s confirmed everything is secure again. Binance warned users to check their accounts and positions Binance advised its users to review their positions and open orders while waiting for SignalPlus to give the all-clear before “rebinding any API keys, and always enabling IP whitelisting.” The exchange also called for its third-party partners to “review their security controls, monitor for unusual activity and contact us immediately if they detect any concern.” Crypto hack after crypto hack Binance was hacked for $6.3 billion earlier this month and is currently in the process of opening up further withdrawals and replenishing the stolen funds. Already this month, Brazilian crypto exchange Mercado Bitcoin was hacked , as was BitMart . LIVE: Binance says it’s yet to open up more token withdrawals Read more: Crypto survived cybersecurity awareness month… just SignalPlus is partnered with major crypto firms such as Bybit, Gate.io, and OKX. Update November 5, 14:07 UTC: Updated this article to include SignalPlus’ hack disclosure. Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post Binance drops SignalPlus API keys after potential hack appeared first on Protos .
Open source - CN
crypto.news@cryptodotnewsPost on X ·
JUST IN: Binance revokes all API keys linked to SignalPlus after reported security issue CZ has urged users to revoke SignalPlus API keys across other exchanges as well, warning against sharing exchange credentials with third-party platforms. https://t.co/kEWyofhaF9
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: Binance and Deribit have revoked API keys linked to third-party crypto trading infrastructure provider SignalPlus following a potential security issue. Both platforms said their own systems were unaffected and advised SignalPlus users to review their accounts before reconnecting.
Open source - BS
BSCN@BSCNewsPost on X ·
CZ warns traders after another Binance security breach CZ (@cz_binance), the former @Binance CEO, has strongly advised all traders to invalidate their @SignalPlus_Web3 API keys immediately on any exchange they trade with. "If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys," he explained. The derivatives exchange @DeribitOfficial first raised the security issue. Binance is taking precautionary measures and has already invalidated all its SignalPlus API keys. Traders should also review their other exchange accounts and invalidate their API keys.
Open source - CB
Crypto Banter@crypto_banterPost on X ·
🚨BINANCE REMOVES ALL SIGNALPLUS API KEYS AFTER POTENTIAL SECURITY ISSUE! @heyibinance says @binance proactively deleted every API key tied to third-party platform SignalPlus as a precaution after it reported a potential security issue. Binance’s own systems are unaffected. Users who connected SignalPlus should log in directly to check positions and open orders, enable IP whitelisting, and wait for SignalPlus to confirm it’s fully resolved before rebinding any keys.
Open source