Binance and Deribit have disabled all API keys connected to SignalPlus after the crypto derivatives infrastructure provider disclosed a cyberattack that compromised one of its engineers. Both exchanges said their own systems were unaffected: Binance stated that no user funds had been lost, while Deribit found no signs that its systems or data had been compromised.

SignalPlus said the incident began in the early hours of Nov. 4 and affected a small number of accounts that did not use IP whitelisting. In a statement shared on X on Nov. 5, the company said total losses stood under US$82,000 and that all affected users would be reimbursed in full.

TL;DR: In the early hours of Nov 4, SignalPlus was targeted in an attack that began with a compromised third-party Telegram account, affecting a small number of accounts without IP whitelisting. We detected and contained the intrusion quickly. As a precaution, we immediately worked with our CEX partners to revoke all SignalPlus-linked API keys and temporarily paused our terminal services. Total losses are under US$82k, and all affected users will be reimbursed in full. We expect to bring services fully back online over the next few days. Updates and user instructions will be shared through our official channels.

— SignalPlus (@SignalPlus_Web3) November 5, 2026 (X post)

Binance and Deribit Cut SignalPlus Access

The company reported the suspicious activity to its centralized exchange partners and requested that they suspend all of SignalPlus's API keys. It also shut down its trading terminal while carrying out a comprehensive security audit.

The coordinated revocation has effectively blocked trading, monitoring and automated execution through SignalPlus for the duration of the credential revocation period. Third-party terminals of this kind operate by connecting to customer exchange accounts through API credentials, which is why revoking the keys at the exchange level cuts the platform off from those accounts entirely.

Binance CEO Changpeng Zhao advised all users connected through SignalPlus to cancel their other API credentials as well. Separately, Binance co-founder Yi He urged third-party platforms integrated with the exchange to review their own security measures and watch for unusual activity.

We also encourage all third-party platforms integrated with Binance to review their security controls, monitor for unusual activity and contact us immediately if they detect any concern💁🏻‍♀️ This is not a challenge for any single company……

— Yi He (@heyibinance) November 5, 2026 (X post)

Fake Teams Invite Compromised an Engineer

SignalPlus traced the intrusion to the Telegram account of a contact at one of its external technology providers. The attacker impersonated that contact and sent a fake Microsoft Teams invitation to a SignalPlus engineer. After infecting the engineer's computer, the intruder lay silent until able to exploit the employee's access to the company's internal network.

The company said it detected the activity, blocked it and closed the vulnerabilities it identified.

IP Whitelisting Becomes a Key Failure Point

SignalPlus also acknowledged that its exchange API access was not protected by IP address whitelisting, a safeguard that restricts an API key so it only functions from pre-approved addresses. Without such a restriction, stolen credentials can be used from attacker-controlled infrastructure, subject only to the permissions configured on the key.

The company said it will adjust its API access policies, endpoint security, internal permissions and key-management access. It reiterated that total losses from the incident are below $82,000 and that affected users are being reimbursed in full. SignalPlus expects to bring services fully back online over the next few days, with updates and user instructions distributed through its official channels.

Crypto Firms Face Another Social Engineering Warning

The breach follows a separate $6.3 billion crypto heist at Binance on Oct. 29. Binance later said that attack was carried out through hacked employee computers, including an engineer targeted with a fake job interview, and the FBI attributed it to a North Korean hacking group.

Although the two incidents occurred independently, both illustrate a broader pattern of attackers targeting employees and trusted third-party relationships rather than exchange infrastructure itself.

SignalPlus said services will return on a phased basis once security reviews and patches have been implemented. While the SignalPlus terminal remains suspended, users can still manage their positions and open orders directly through the exchanges.

Source: CryptoNinjas