SignalPlus Loses Its API Keys: Binance and Deribit Pull the Plug 🔑

Binance and Deribit have revoked API keys linked to SignalPlus after the Hong Kong-based trading platform reported a potential security issue. SignalPlus provides tools for crypto options and derivatives and connects to several exchanges, including Binance and Deribit.

Binance said the action was an “immediate precautionary measure” and stated, “Binance's own systems are unaffected. User funds remain safe.” The exchange advised SignalPlus users to log in directly, review their positions and open orders, and wait until SignalPlus confirms the issue is fully resolved before reconnecting. Binance also recommended enabling IP whitelisting, which restricts an API key to approved internet addresses, and asked other third-party platforms to review their security controls, monitor for unusual activity and report any concerns immediately.

Deribit suspended SignalPlus-linked API keys while investigating and said it found no evidence of a breach affecting its systems or data. API keys allow external applications and trading tools to access users’ exchange accounts and place trades on their behalf, so revoking them interrupts automated strategies until replacement keys are configured.

The incident follows a major increase in scrutiny of exchange security after attackers drained about $6.4 billion from Binance hot wallets on October 29. The FBI attributed the theft to North Korean hackers it calls TraderTraitor, a claim Pyongyang has denied. Binance said the attack began when a fake recruiter persuaded one of its engineers to download a malware-laced coding assignment, after which attackers used stolen credentials to reach an internal wallet signing service.

Binance said on Wednesday that it had replenished about 98% of the stolen assets using its own funds and was buying the remainder, mostly less liquid tokens, through market and over-the-counter channels. It also took a new proof-of-reserves snapshot covering 44 tokens, up from 10, which users will be able to verify once its zero-knowledge proof is generated.