Binance Revokes All SignalPlus API Keys After Breach

High attention and emotional sentiment detected.

So the response came in hours, not days. Binance posted the news at 10:51 UTC and stressed that its own systems were unaffected. According to the exchange, user funds remain safe.

What Binance Announced

Binance framed the move as an immediate precaution. First, it cut off every API key linked to SignalPlus. Then it told affected traders to log into Binance directly and review their positions and open orders.

The exchange also gave three clear instructions. Wait until SignalPlus confirms full resolution before rebinding any keys. Always enable IP whitelisting. And review controls if you run any platform that connects to Binance.

You can read the full statement in the official Binance post. Notably, Binance did not confirm any unauthorized trades on its platform. For now, the revocation stands as a defensive step rather than a reaction to confirmed losses.

How the SignalPlus Attack Unfolded

SignalPlus is a Hong Kong fintech founded in 2021. It builds trading tools for options and derivatives, and it connects to Binance, Deribit, OKX, and others through user-generated keys.

SignalPlus later shared the timeline itself. In its official disclosure around 13:28 UTC, the firm said the attack began in the early hours of November 4.

The entry point was social engineering, not a protocol flaw. First, attackers compromised a third-party Telegram account belonging to a technology-vendor contact. Then they sent a fake Microsoft Teams meeting invite to a SignalPlus engineer.

That invite compromised the engineer’s computer. After that, the attacker moved into the internal network. However, the damage stayed small because most accounts used IP whitelisting.

SignalPlus said it detected and contained the intrusion quickly. So it paused terminal services and worked with exchange partners to revoke every linked key. The firm also admitted it had not previously required IP whitelisting as mandatory.

The Damage: Losses Under $82,000

The reported damage is modest by crypto-hack standards. According to SignalPlus, total losses sit under US$82,000. The firm said it will reimburse all affected users in full.

The attack hit only a small number of accounts, and all of them lacked IP whitelisting. SignalPlus has not published an exact count of affected users or revoked SignalPlus API keys. Neither has Binance or Deribit.

Importantly, no on-chain evidence of drained funds has surfaced. No attacker wallets, Etherscan links, or Dune dashboards tracking this incident have been published so far. The small loss figure points to unauthorized trading rather than mass withdrawals.

Deribit and CZ Join the Response

Binance was not alone. Deribit also revoked all connected SignalPlus keys, announcing the move around 12:21 UTC. In its statement, Deribit said its systems and data were unaffected.

Meanwhile, Binance co-founder CZ weighed in directly. Around 11:05 UTC, he urged users to revoke SignalPlus keys on any other exchange too. He also gave a broader warning in his post.

“It is generally recommend that you do not store your API keys with any 3rd party platform,” CZ wrote. That advice cuts to the heart of the incident.

Why API Keys Are the Weak Point

An exchange API key is a pair of credentials. It lets an outside app act on your account without a fresh login each time. Permissions are granular, so a key can be read-only, trade-enabled, or withdrawal-enabled.

Best practice is simple. First, disable withdrawal permission. Then restrict the key with IP whitelisting so it only works from approved server addresses.

Still, a compromised third party can do damage even without withdrawal rights. For example, an attacker can place bad trades, open risky positions, or trigger fees and liquidations. That is the likely path here, given the small loss figure.

So revoking the keys is the correct first move. Once the exchange kills the key, the stolen access dies with it. As a result, your core custody stays intact if the exchange itself is unaffected and withdrawals were off.

What SignalPlus Users Should Do Now

The immediate steps are clear. First, log into Binance, Deribit, or any connected exchange directly and check your positions and open orders. Next, do not rebind your keys until SignalPlus confirms full resolution.

After that, rebuild your keys with tighter controls. Enable IP whitelisting, disable withdrawals, and review every third-party connection you still trust. SignalPlus expects to restore services over the next few days.

This incident is a reminder, not a panic. The risk was never Binance or Deribit custody. Instead, it sat with the third party holding the SignalPlus API keys. Tight key hygiene would have blocked even the small losses that slipped through.

None of this is financial advice. Always verify security steps through official exchange channels before you act. For now, watch for the SignalPlus all-clear, then rebind carefully.