Binance Revokes SignalPlus API Keys Days After $6.4 Billion Hack
Binance removed all API keys linked to third-party platform SignalPlus after SignalPlus reported a potential security issue, halting automated trading strategies that connect through it. The move came a week after the exchange suffered a $6.4 billion hot wallet theft that it is still working to recover from.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Binance Did
Binance removed all API keys linked to SignalPlus, the exchange said on Thursday, after SignalPlus reported a "potential security issue." Binance described the step as an "immediate precautionary measure" and said its own systems are unaffected and user funds remain safe.
API keys allow third-party tools to connect to a user's exchange account and place trades on their behalf. With the keys revoked, automated strategies running on Binance through SignalPlus stop until users generate new keys.
Guidance to Users and Integrators
Binance told SignalPlus users to log in directly to review their positions and open orders, and to wait for SignalPlus to confirm the issue is fully resolved before reconnecting. It also recommended enabling IP whitelisting, which restricts an API key to approved internet addresses.
The exchange asked all third-party platforms integrated with Binance to review their security controls, monitor for unusual activity and contact Binance immediately if they see concerns. SignalPlus, a Hong Kong-based provider of trading tools for crypto options and derivatives, connects to several exchanges, including Binance.
Context: The October Hot Wallet Theft
The SignalPlus action comes about a week after attackers drained roughly $6.4 billion from Binance hot wallets on October 29. The FBI has attributed that theft to North Korean hackers it calls TraderTraitor, a claim Pyongyang has denied. Binance has said the intrusion began when a fake recruiter persuaded an engineer to download a malware-laced coding assignment, after which attackers used stolen credentials to reach an internal wallet signing service.
Binance said Wednesday it has replenished about 98% of the stolen assets from its own funds and is still buying the remainder, mostly less liquid tokens, through market and over-the-counter channels. It has also expanded its proof-of-reserves snapshot to 44 tokens from 10. The zero-knowledge proof is expected in roughly 50 to 60 hours.
Recovery Status
Binance began reopening withdrawals in phases on Thursday, prioritizing tokens by user demand over the prior week. Deposits remain open. The sources do not give a timeline for full restoration of withdrawals, and they do not say whether any other third-party platforms have had API access revoked.
Why It Matters
For Traders
Users running SignalPlus-linked bots on Binance should expect those strategies to stay offline until the provider confirms a fix and they issue new keys.
For Investors
A second security incident within weeks raises questions about Binance's operational controls and its exposure to third-party integrations, which investors will weigh alongside the recovery timeline.
For Builders
Integrators should audit how their API key permissions, IP whitelisting and monitoring hold up if an exchange revokes access without warning.
This article is for information only and is not financial advice. Read the full disclaimer.
