Binance and Deribit Revoke API Keys Following SignalPlus Security Breach

Major exchanges including Binance and Deribit have taken immediate action to revoke API keys linked to the crypto derivatives platform SignalPlus following a security breach. The move comes as users search for the latest Binance crypto hack details and updates regarding the safety of their assets. Both exchanges confirmed that their own internal systems remain secure, though Deribit noted that all automated trading and monitoring services through SignalPlus have been suspended for its customers.

SignalPlus, a platform that provides infrastructure for professional traders to manage options across multiple exchanges, identified the point of entry as a compromised Telegram account belonging to a third-party vendor. The attacker impersonated the vendor to send a fake Microsoft Teams meeting invitation to a SignalPlus engineer. By interacting with this link, the employee inadvertently allowed the attacker to compromise their computer. The perpetrator remained dormant for a period before using the engineer’s access privileges to infiltrate the company’s internal network.

SignalPlus pledged to fully reimburse users for losses totaling less than $82,000 following a security breach.

Security and API access

The platform has admitted that it did not previously require IP whitelisting, a security protocol that restricts API access to specific, approved addresses. SignalPlus acknowledged this oversight and has committed to strengthening internal security controls and tightening access requirements. Operations on the platform are currently suspended as the company conducts security reviews and applies necessary patches, with plans to restore services in the coming days.

Binance co-founder Yi He has urged all third-party platforms integrated with the exchange to conduct thorough security audits and remain vigilant against suspicious activity. This incident follows recent disclosures from Binance regarding a separate $6.3 billion hack involving compromised employee credentials and malicious files disguised as job assignments. Yi He noted that the exchange has actively prevented dozens of cyber threats throughout 2026, including attempts to steal employee data and the use of fraudulent job interviews.

Why it matters

The breach highlights the ongoing risks associated with third-party software integration in the cryptocurrency ecosystem. By failing to implement basic security measures like IP whitelisting, SignalPlus provided an entry point for attackers to reach exchange-linked accounts.

This incident serves as a reminder for institutional and professional traders to evaluate the security standards of the platforms they use to manage their portfolios. For users, the event underscores the importance of monitoring API permissions and ensuring that third-party services maintain robust defense mechanisms to protect against credential theft and unauthorized access.