Community Trust ScoreVerified
Binance removed all API keys linked to the trading platform SignalPlus on Nov. 5 following a security warning. The exchange described the move as an immediate precaution and stated that its own systems were unaffected and user funds remained safe.
SignalPlus later confirmed that attackers had breached its network after an engineer was tricked with a fake Microsoft Teams meeting invitation. The platform reported losses below $82,000 in its initial assessment and stated that reimbursement for affected users had begun.
Exchange responses and user guidance
Deribit issued a separate notice confirming it had revoked all customer API keys connected to SignalPlus. The exchange stated that this action stopped trading, monitoring, and automation through the SignalPlus connection. Deribit noted that its systems and data were unaffected and directed users to check their accounts directly on the Deribit platform.
Binance advised affected users to review their positions and open orders directly on its platform. The exchange recommended that users wait until SignalPlus confirms full resolution before reconnecting any API keys. Binance also suggested enabling IP whitelisting as an additional security measure.
Deribit provided similar guidance, recommending IP allowlisting and waiting for official communication from SignalPlus before re-establishing connections. The exchange’s notice focused on helping users manage open orders, positions, and recent account activity independently of the third-party tool.
Changpeng Zhao, the founder of Binance, urged people using SignalPlus on other exchange platforms to revoke their API keys. He advised against storing keys with third-party platforms. Binance also called on other third-party platforms integrated with it to review their security controls, monitor for unusual activity, and contact the exchange immediately if they detected any concerns.
Attack vector and remediation steps
SignalPlus traced the incident to a compromised Telegram account belonging to a contact at a third-party technology vendor. The attacker impersonated this contact and sent an engineer a fake Microsoft Teams meeting invitation, which compromised the engineer’s computer.
The company detected the attack in the early hours of Nov. 4 and contained the intrusion. SignalPlus contacted partner exchanges to disable every user API key associated with its platform and suspended its services for a comprehensive security review.
In its statement, SignalPlus acknowledged that it had not previously made IP whitelisting mandatory for exchange API access. The company said it would tighten API access requirements and strengthen endpoint security, internal access controls, and key management. SignalPlus pledged to repay all affected users in full, noting that reimbursement had begun on a case-by-case basis.
Binance’s Spot API documentation separates the permission to place and cancel orders from the permission to view private account information. The exchange notes that trading permission must be enabled explicitly and provides examples of using separate keys for trading and monitoring. Binance Academy guidance explains that when IP restrictions are enabled, requests from addresses outside a key’s whitelist are rejected.
SignalPlus said its services would return in phases after its security review, necessary patches, and confirmation that restoration was safe. The company did not provide a fixed reopening date in its statement.
Frequently Asked Questions
What was the cause of the SignalPlus security breach?
SignalPlus stated that an engineer was tricked with a fake Microsoft Teams meeting invitation, which compromised the engineer’s computer. The incident was traced to a compromised Telegram account belonging to a contact at a third-party technology vendor.
How much money did SignalPlus report losing?
SignalPlus reported losses below $82,000 in its assessment to date. The company stated that reimbursement had begun and pledged to repay all affected users in full.
