Binance and Deribit Sever Ties with SignalPlus After Security Breach

Major exchanges including Binance and Deribit have taken immediate action to protect users by severing connections with the crypto trading platform SignalPlus. The move follows a security incident that occurred in the early hours of November 4, which has triggered widespread concern regarding Binance crypto hack risks and third-party platform security.

SignalPlus reported that the breach originated from a compromised Telegram account belonging to a third-party technology vendor. An attacker impersonating this contact sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer. Clicking the link compromised the engineer’s computer, allowing unauthorized access to the company’s network. Upon detecting the intrusion, SignalPlus suspended its services to conduct a comprehensive security review and contacted partner exchanges to disable user API keys.

Binance and Deribit revoked API keys for SignalPlus users following a phishing-related security breach.

Understanding the Binance crypto hack response

Binance emphasized that its internal systems remained entirely unaffected and that user funds were secure. The exchange revoked API keys as a precautionary measure, advising users to manually verify their open orders and positions directly through the Binance platform. Similarly, Deribit revoked all customer API keys linked to SignalPlus, effectively halting all automated trading and monitoring functions for those accounts. Both exchanges have urged their users to refrain from reconnecting third-party services until SignalPlus confirms a full resolution of the issue.

Industry leaders, including Changpeng Zhao, have advised individuals using SignalPlus on any exchange platform to revoke their API keys immediately. Furthermore, there is a growing consensus that users should avoid storing keys with third-party platforms. Binance has also called upon all integrated third-party services to conduct thorough reviews of their security controls and to monitor for any unusual activity.

SignalPlus has acknowledged that it did not previously mandate IP whitelisting for exchange API access. As part of its recovery efforts, the firm plans to tighten access requirements, strengthen internal controls, and improve key management. The company has begun the process of reimbursing affected users on a case-by-case basis, with total losses estimated to be below $82,000. While SignalPlus intends to return to normal operations in phases, it has not yet provided a specific date for the restoration of services.

Why it matters

This incident highlights the inherent risks of using third-party applications that require API access to exchange accounts. For users, the event serves as a reminder to enable security features like IP whitelisting and to exercise caution when interacting with unexpected meeting invitations or external links.

By revoking access, exchanges are prioritizing the safety of customer funds over platform convenience. This event impacts all users who rely on automated trading tools, emphasizing the necessity of maintaining strict control over API permissions and regularly auditing third-party integrations.