Binance said it disabled API keys linked to SignalPlus after the trading platform reported a security issue. SignalPlus said the partner exchanges’ precautionary action did not, by itself, mean that linked exchange accounts or assets had been compromised. Binance advised users to check their positions and open orders directly on the exchange before reconnecting any keys.
Why Binance disabled SignalPlus-linked keys
Binance announced the removal after SignalPlus reported a potential security issue. SignalPlus said partner exchanges disabled all keys associated with its platform as a precaution. Binance also said its own systems were unaffected and its customers’ funds remained safe, a statement limited to Binance and its customers.
An API key is a credential that lets an outside application connect to an exchange account and submit trades. Cutting off a key blocks that access through the credential; it does not, on its own, establish that the exchange account or its assets were accessed.
What SignalPlus said about the incident
SignalPlus said it detected unusual activity in the early hours of November 4. In a statement published November 5, the company said its investigation had traced the incident to a contact at a third-party technology vendor whose Telegram account had been compromised. SignalPlus said the attacker impersonated that contact, sent an engineer a fake Microsoft Teams invitation, compromised the engineer’s computer and later used the engineer’s access against SignalPlus’s internal network. Those details are SignalPlus’s account of its investigation.
SignalPlus reported total losses below $82,000, said it had begun reimbursing affected users case by case, and committed to reimbursing them in full. It also said the precautionary key deactivation did not mean linked account information or assets had been compromised. The company’s reported losses and reimbursement commitments are separate from Binance’s statement about its own customers.
If a trading tool’s exchange connection is disabled, review positions and open orders through the exchange itself before reconnecting it.
What Binance advised users to check
Binance advised users to log in to Binance directly, review their positions and open orders, and wait for SignalPlus to confirm the issue was resolved before reconnecting keys. It also recommended IP allowlisting, which restricts API access to approved internet addresses. Binance’s incident guidance includes those account checks and the allowlisting recommendation.
Changpeng Zhao separately urged users to revoke SignalPlus keys on other exchanges as well.
SignalPlus acknowledged that it had not previously made IP allowlisting mandatory for exchange API access. The company said it planned to strengthen access requirements, endpoint security, internal controls and key management.
SignalPlus’s service response
In its November 5 statement, SignalPlus said it had suspended platform services for a security review. It said services would return in phases after the review and necessary patches, once the company determined restoration was safe.
