Binance and Deribit Revoke SignalPlus API Keys After Intrusion Traced to Fake Teams Invite
Binance and Deribit revoked API keys linking SignalPlus to customer accounts on November 5 after SignalPlus reported an intrusion that began with a fake Microsoft Teams invitation. SignalPlus put losses below $82,000 to date and said it has begun reimbursing affected users.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Exchanges Cut SignalPlus Access
Binance cut its connections with the third-party trading platform SignalPlus on November 5 after issuing a security warning, and Deribit revoked all customer API keys linked to SignalPlus the same day. API keys let software act on an exchange account within the permissions a user has granted, so revoking them stops trading, monitoring and automation that ran through SignalPlus. Both exchanges said their own systems and data were unaffected and that user funds remained safe.
Binance told SignalPlus users to check positions and open orders directly on its platform, to wait for SignalPlus to confirm full resolution before reconnecting API keys, and to enable IP whitelisting. Deribit's guidance was similar, covering open orders, positions and recent account activity, and it also recommended IP allowlisting. Neither exchange has independently verified that affected accounts are secure; their notices describe actions taken and advice given.
How the Intrusion Happened
SignalPlus said it detected an attack in the early hours of November 4 and contained the intrusion. In its account, attackers compromised a Telegram account belonging to a contact at a third-party technology vendor, impersonated that contact, and sent an engineer a fake Microsoft Teams meeting invitation. The engineer's computer was compromised as a result. SignalPlus said it contacted partner exchanges to disable every user API key tied to its platform and suspended services for a comprehensive security review. The company has not published a full forensic report, so the chain of access beyond the engineer's machine has not been independently verified.
Loss Estimates and Reimbursement
SignalPlus put losses below $82,000 in its assessment to date. It said reimbursement had begun on a case-by-case basis and pledged to repay all affected users. The $82,000 figure comes from SignalPlus itself; neither Binance nor Deribit has published a loss figure, and the two exchanges' notices say only that their own systems were not affected. The company's estimate may change as its review continues.
Broader Guidance for API Key Holders
Changpeng Zhao, Binance's founder, responded to the advisory by urging people who use SignalPlus on other exchanges to revoke their API keys, and he advised against storing exchange keys with third-party platforms. Binance separately asked third-party platforms integrated with it to review their security controls, monitor for unusual activity and contact the exchange immediately if they had concerns. Binance's Spot API documentation separates permission to place and cancel orders from permission to view private account data such as order status and trading history, and trading permission must be enabled explicitly, which limits what a compromised key can do when permissions are scoped carefully.
What to Watch
The key open question is when SignalPlus confirms full resolution and whether both exchanges will allow API keys to be reconnected. Binance and Deribit both tied reconnection to that confirmation. Further detail on the loss total, the forensic findings and the reimbursement process will determine how far the incident is contained.
Why It Matters
For Traders
Users of SignalPlus-linked bots should verify open orders and positions directly on the exchange before assuming any automated strategy is still running as configured.
For Investors
The incident highlights counterparty risk in third-party integrations, a factor that can affect exchange and platform reputations even when core exchange systems are unaffected.
For Builders
Scoped API permissions, IP allowlisting and vendor-side credential hygiene are the controls that limit damage when a single integration partner is compromised.
This article is for information only and is not financial advice. Read the full disclaimer.
