Cryptocurrency exchanges Binance and Deribit revoked all customer API keys linked to the derivatives trading platform SignalPlus on November 5, 2026, as a precaution after the company reported a security incident.
Both exchanges confirmed that their own systems and data remained unaffected.
Deribit noted that trading, monitoring, and automated activity conducted through SignalPlus had ceased for its users as a result.
Binance stated that customer funds on its platform stayed secure and advised anyone who had connected via SignalPlus to log into their Binance accounts directly to review open positions and orders.
The exchange recommended waiting for SignalPlus to confirm full resolution before reconnecting any keys and enabling IP whitelisting—which restricts API access to pre-approved network addresses—for future connections.
Binance also encouraged all third-party platforms integrated with it to review their security controls and watch for unusual activity.
SignalPlus, which provides infrastructure allowing professional and institutional traders to manage crypto options and other derivatives positions across multiple exchanges from a single interface, disclosed the details of the incident the same day.
SignalPlus Announcement on Security Incident Response and User Protection
In the early hours of November 4, the SignalPlus team detected anomalous activity and identified that our systems were the target of a cyberattack. The team acted swiftly to contain the incident and…
— SignalPlus (@SignalPlus_Web3) November 5, 2026
According to the company’s public statement, anomalous activity was detected in the early hours of November 4.
The intrusion originated from a compromised Telegram account belonging to a contact at one of SignalPlus’s third-party technology vendors.
An attacker used that account to impersonate the contact, contacted a SignalPlus engineer, and delivered a fraudulent Microsoft Teams meeting invitation.
This social-engineering tactic compromised the engineer’s computer.
The intruder remained inactive on the device for a period before leveraging the engineer’s access privileges to target the company’s internal network in the early hours of November 4.
SignalPlus reported that its team detected the activity, blocked the attack, and closed the identified vulnerabilities.
Total losses stemming from the incident were assessed at under $82,000.
The company stated that it had already begun reimbursing affected users in full on a case-by-case basis and remained committed to making all impacted customers whole.
As a protective measure applied across its user base, SignalPlus immediately contacted partner exchanges and arranged for every associated user API key to be disabled on the exchange side.
It also suspended its own platform services while conducting a comprehensive security review.
The company emphasized that the deactivation of an API key does not indicate that the linked account information or assets were necessarily compromised.In its statement, SignalPlus acknowledged a gap in its own controls: it had not previously made IP whitelisting mandatory for exchange API access.
The firm described this as an oversight for which it takes responsibility and said it would tighten API access requirements, strengthen endpoint security on development devices, improve internal access controls, and enhance key management.
Services are expected to return online in phases over the following days once the review and necessary patches are complete.
During the suspension, users can continue managing accounts, positions, and orders directly through the official platforms of the connected exchanges.
Binance co-founder Changpeng Zhao separately advised that anyone using SignalPlus on any other exchange should revoke those API keys as well, and generally recommended against storing exchange API credentials with third-party platforms.
The coordinated response by the exchanges and SignalPlus’s containment steps limited the financial impact, while highlighting the risks inherent in third-party API integrations that rely on social-engineering resistance and strict access controls.
