Crypto exchanges Binance and Deribit said Thursday that they had revoked API keys connected to SignalPlus, a crypto derivatives trading platform, as a precaution after the company disclosed a security breach. Both exchanges said their own systems were unaffected, though Deribit warned that trading, monitoring and automation functions routed through SignalPlus had stopped working for its customers. Exchange API keys allow third-party platforms to execute trades and monitor accounts on a user's behalf, which is why revoking them cuts off those workflows even when the exchange itself shows no sign of compromise.

Binance co-founder Yi He said in a post on X that third-party platforms integrated with the exchange should review their security controls and monitor for suspicious activity, warning that the threat extended beyond any single company.

SignalPlus provides trading infrastructure for crypto derivatives, with a particular focus on options, enabling professional and institutional traders to manage positions across multiple exchanges through a single platform.

According to a statement the company posted on X, the attack originated from a compromised Telegram account belonging to a contact at a third-party technology vendor. The attacker impersonated the contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer, compromising the employee's computer.

The intruder then remained dormant on the compromised computer before using the engineer's access privileges to target SignalPlus's internal network early Wednesday, the company said.

SignalPlus said it detected and contained the intrusion, putting total losses at less than $82,000, and has begun fully reimbursing affected users. The company temporarily suspended its services and expects to restore operations over the next few days after completing security reviews and applying patches — a timeline that determines when customers regain the trading, monitoring and automation functions that were knocked offline.

SignalPlus also acknowledged that it had not required IP whitelisting for exchange API access. "We take responsibility for this oversight," the company said, adding that it would tighten API access requirements and strengthen internal security controls. IP whitelisting is a security measure that restricts API access to a predefined list of approved internet addresses.

Related: BitMart founder says security team 'severely understaffed' after new hack

SignalPlus attack follows $6.3B Binance hack

The SignalPlus incident comes days after Binance disclosed details of a $6.3 billion hack on Oct. 29, which also involved compromised employee computers. According to Binance's postmortem, attackers posing as recruiters tricked an engineer into downloading a malicious file disguised as a coding assignment. The attackers subsequently used the compromised computer to gain access to additional systems and eventually breach the exchange's wallet infrastructure. Taken together, the two breaches share a common opening move: an attacker impersonating a trusted contact or recruiter to compromise a single employee's machine, then using that foothold to reach deeper into company systems.

Binance co-founder Yi He said Tuesday on X that the exchange had detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages and attempts to steal employee credentials.

Source: Cointelegraph