SignalPlus Loses Its API Keys to a Fake Teams Invite—Exchanges Hit the Disconnect Button

Binance and Deribit revoked API keys linked to SignalPlus on Thursday after the Hong Kong-based crypto options and derivatives platform reported a potential security issue. SignalPlus said the intrusion began when a compromised Telegram account belonging to a contact at a third-party technology vendor was used to send a fake Microsoft Teams meeting invitation to a SignalPlus engineer, compromising the employee’s computer.

The attacker reportedly remained dormant before using the engineer’s access privileges to target SignalPlus’s internal network early Wednesday. SignalPlus said it detected and contained the intrusion, with total losses of less than $82,000, and had begun fully reimbursing affected users. The company temporarily suspended its services and expects to restore operations over the next few days after completing security reviews and applying patches.

Both exchanges said their own systems were unaffected. Binance described the key removals as an “immediate precautionary measure” and said, “Binance’s own systems are unaffected. User funds remain safe.” Deribit reported that its investigation found no evidence of a breach affecting its systems or data, while warning that trading, monitoring and automation through SignalPlus had stopped working for its customers. Binance urged users to log in directly to review their positions and open orders, wait for SignalPlus to confirm that the issue is fully resolved before reconnecting, and enable IP whitelisting, which restricts API access to approved internet addresses. Binance co-founder Yi He also asked other third-party platforms integrated with the exchange to review their security controls, monitor for suspicious activity and contact Binance immediately if concerns arose.

SignalPlus acknowledged that it had not required IP whitelisting for exchange API access. “We take responsibility for this oversight,” the company said, adding that it would tighten API access requirements and strengthen internal security controls. The incident came a week after attackers drained about $6.4 billion from Binance hot wallets on October 29 in the largest hack in crypto history. Binance has said it replenished about 98% of the stolen assets from its own funds, continued buying the remaining assets, and expanded a proof-of-reserves snapshot covering 44 tokens, up from 10, with a zero-knowledge proof expected to be generated in about 50 to 60 days. The FBI attributed the theft to North Korean hackers it calls TraderTraitor, a claim Pyongyang has denied.