Binance and Deribit revoked every API key linked to SignalPlus after the options and derivatives terminal disclosed a social-engineering intrusion that began with a fake Microsoft Teams invite. SignalPlus said losses are under $82,000 on its assessment so far and that reimbursements have already started case by case. Binance said its own systems were unaffected. Channel NewsAsia reported that Deribit, after an investigation, found no indication its systems or data were affected. The cutoffs still stopped automated trading through the tool for users who had connected their accounts.
The disclosures landed on Thursday, November 5. By Friday there was no material change beyond recaps and SignalPlus still pointing users to the same incident thread. The sharper lesson sits in what traders should do with third-party API keys, and in SignalPlus’s admission that IP whitelisting was never mandatory on its exchange connections.
How the intrusion unfolded
According to SignalPlus’s November 5 incident statement, the team detected anomalous activity in the early hours of November 4 and identified a cyberattack on its systems. The company traced the start of the path to a compromised Telegram account belonging to a contact at a third-party technology vendor. Posing as that contact, the attacker messaged a SignalPlus engineer and sent a fake Microsoft Teams meeting invitation. That social-engineering step compromised the engineer’s computer. The intruder then remained dormant.
In the early hours of November 4, SignalPlus said, the attacker used the engineer’s access privileges against the internal network. The company said it blocked the attack, closed identified vulnerabilities, contacted partner exchanges to disable SignalPlus-related API keys, and put its services into maintenance mode. A small number of accounts without IP whitelisting were affected. Total losses are below $82,000 on its assessment so far. Disabling an API key, it added, does not by itself mean the linked exchange account or assets were compromised — the precaution covered all users.
“We take responsibility for this oversight,” SignalPlus said of not requiring IP whitelisting as a mandatory condition for exchange API access. Planned fixes include tighter API access rules, stronger endpoint security on development devices, improved internal access controls and key management, plus deeper threat-intelligence sharing with exchanges and security firms. Services are expected back in phases after review and patches, with updates through official channels.
What Binance, Deribit and Coincall told users
Binance said that after a potential security issue reported by SignalPlus, it “proactively removed all API keys linked to SignalPlus as an immediate precautionary measure.” “Binance’s own systems are unaffected. User funds remain safe.” Users who used SignalPlus were told to log into Binance directly to review positions and open orders, wait until SignalPlus confirms full resolution before rebinding keys, and always enable IP whitelisting. Binance also asked other third-party platforms integrated with it to review controls and report concerns.
Changpeng Zhao said Deribit had also reported the issue, and urged traders: “If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys.” He added that it is generally recommended not to store API keys with any third-party platform. Channel NewsAsia reported that Deribit found no indication its systems or data were affected after an investigation.
Coincall published a security advisory on November 5 telling users who had connected via SignalPlus to revoke those API keys, review recent trading activity, enable IP allowlisting and two-factor authentication, and avoid reconnecting until SignalPlus confirms it is safe. Coincall said it had no information indicating its own systems were compromised, and noted that exchanges including Deribit had already taken precautionary measures.
What traders should do with API keys
API keys let a terminal place orders on an exchange account. When Binance or Deribit revokes every key linked to SignalPlus, strategies running through that terminal stop until new keys are issued. Users should open each exchange’s own website or app, check positions and open orders, and revoke any remaining SignalPlus-labeled keys on venues that have not already done so. Do not reconnect until SignalPlus says the issue is resolved, and turn on IP whitelisting on any new key so it only works from approved addresses.
Fake meeting invites are a common social-engineering pattern: a compromised chat account of a trusted vendor contact, an urgent calendar link, then malware on the recipient’s machine. That is a different lure from the fake job interview path described in Binance’s postmortem of its October 29 theft, and the two incidents are not linked. Both show how one engineered device can put trading credentials or internal tools at risk.
What to watch next
Watch for SignalPlus’s phased restart notices and for any update that raises or lowers the under-$82,000 loss figure. Also watch whether more venues publish advisories like Coincall’s, and whether reimbursements close out the affected accounts without dispute. Until SignalPlus confirms a safe reopen, treat any third-party reconnect prompt with caution.
FAQ
Were Binance or Deribit hacked in this incident? No. Both said their systems were unaffected. SignalPlus, a third-party trading terminal, was the compromised platform; the exchanges revoked linked API keys as a precaution.
How much was lost? SignalPlus said total losses are under $82,000 on its assessment to date and that it has begun reimbursing affected users in full on a case-by-case basis. That figure has not been independently confirmed as a final loss total.
What should SignalPlus users do now? Log into each exchange directly, review positions and orders, revoke SignalPlus-linked API keys if they are still active, enable IP whitelisting and 2FA, and wait for SignalPlus to confirm it is safe before reconnecting.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
