Binance has revoked all API keys connected to third-party trading platform SignalPlus after a potential security issue, cutting off automated access to customer accounts as cryptocurrency exchanges move to prevent unauthorized trading.

The precautionary measure, taken on November 5, follows a security warning involving SignalPlus, which provides trading tools for cryptocurrency options and derivatives markets. Deribit, the crypto derivatives exchange, also removed API credentials associated with the platform after reviewing its own exposure — a parallel response that shows how a warning about a single vendor can ripple across multiple trading venues at once.

Binance confirmed that its systems were unaffected and that customer funds remained safe. Deribit likewise reported no evidence that its infrastructure or customer data had been compromised, according to a statement posted on X.

The nature of the potential SignalPlus security issue remains undisclosed. No confirmed financial losses or unauthorized customer transactions have been reported in connection with the warning.

Binance Cuts SignalPlus Access, Urges Users to Review Accounts

SignalPlus provides trading infrastructure that allows cryptocurrency investors to manage positions, execute strategies, and access derivatives markets through exchange API connections. These credentials enable external applications to interact with trading accounts without requiring users to log into the exchange for every transaction. Depending on their permissions, API keys can authorize order placement, account monitoring, and other trading operations. That arrangement is also what puts the episode in focus for automated traders: when a third-party tool holds active trading credentials, a security concern on the vendor's side can prompt exchanges to sever access on short notice, interrupting strategies that depend on those connections.

Binance's decision immediately invalidated existing SignalPlus connections, preventing the third-party platform from submitting further instructions using those credentials. However, revoking an API key does not automatically close positions or cancel existing orders on the exchange.

The exchange instructed affected customers to log in directly and review their open orders, positions, and recent account activity. It also recommended waiting until SignalPlus confirms that its security issue has been fully resolved before creating replacement API connections.

Binance founder Changpeng Zhao extended the warning to users of other cryptocurrency exchanges, advising traders to revoke SignalPlus-related API keys wherever they had connected the service. Zhao also cautioned against storing exchange API credentials with third-party providers, emphasizing the risks of allowing external platforms to control trading permissions. His message effectively turned one exchange's precautionary step into an industry-wide advisory for anyone using the platform.

Binance encouraged users to enable IP whitelisting, which restricts API access to approved network addresses, and asked integration partners to review their security controls for suspicious activity. Deribit maintains similar account security recommendations, including IP restrictions, limited API permissions, and additional authentication protections — controls aimed at limiting what any single credential can do if misused.

Security Alert Follows Binance's $6.3 Billion Breach

The precautionary action comes one week after Binance suffered a $6.3 billion cryptocurrency theft on October 29, which U.S. authorities attributed to North Korea's TraderTraitor hacking operation. That incident involved compromised employee devices, stolen credentials, and unauthorized access to internal wallet infrastructure.

Binance subsequently replenished approximately 98% of the affected assets, while working with blockchain partners to freeze or intercept approximately $2.85 billion in stolen cryptocurrency. There is no evidence connecting the SignalPlus warning to the earlier exchange breach.

The latest measures also follow recent security incidents involving other cryptocurrency platforms and their external service providers. On November 2, Trade.xyz restored compromised GitBook documentation, while an earlier attack on Polymarket exploited malicious code distributed through a third-party monitoring service. Unlike those incidents, the SignalPlus warning has not been linked to confirmed fund losses, compromised trading infrastructure, or malicious transaction activity. Taken together, the string of cases shows third-party service providers becoming a recurring focal point in crypto security responses, with exchanges treating vendor risk as part of their own exposure.

Neither Binance nor Deribit has disclosed how many customer accounts were connected to SignalPlus at the time the credentials were revoked. With the issue's nature still undisclosed, the immediate open questions are what prompted the warning, how many users were affected, and under what conditions automated access might resume — Binance has tied replacement API connections to SignalPlus confirming the issue is fully resolved.

Source: Crypto Adventure