Binance founder Changpeng Zhao has told traders who use SignalPlus on any exchange to revoke their API keys, after the exchange removed every key linked to the third-party trading platform on Thursday, Nov. 5, 2026. The move followed a potential security issue that SignalPlus itself reported, and Binance described the step as an immediate precaution. It came one week after Binance's record $6.34 billion hack on Oct. 29 — an incident the exchange says is unrelated, and one with no established link to the SignalPlus problem.

Binance Acts as an “Immediate Precautionary Measure”

SignalPlus flagged the potential problem to Binance before any public action was taken. In a statement on X, the exchange confirmed it had severed all connections tied to the platform and said its own infrastructure was untouched.

“Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure,” Binance said. It added that “Binance's own systems are unaffected. User funds remain safe.”

Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure. Binance's own systems are unaffected. User funds remain safe. If you used SignalPlus, please… pic.twitter.com/0HYYkTAW2p

— Binance (@binance) November 5, 2026

The revocation has a direct mechanical effect: once a key is deleted, the outside platform can no longer authenticate to that account, so any credentials SignalPlus held for Binance users stop working entirely while the underlying issue is investigated.

Warning Reaches Beyond Binance

Zhao, widely known as CZ, said the risk was not limited to one exchange. “If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys,” he wrote on social media. He also said that Deribit, a crypto derivatives exchange focused on options and futures, had reported the issue, and he advised traders not to store API keys with any third-party platform.

The scope of that warning follows from how these credentials work: each exchange issues its own API keys to a connected platform, so removing them on Binance alone leaves equivalent keys active anywhere else SignalPlus was authorized.

Binance co-founder Yi He reiterated that the exchange's systems were unaffected. She told customers to check open orders, hold off on reconnecting affected keys and enable IP whitelisting.

Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure. Binance's own systems are unaffected. If you used SignalPlus, please log into your…

— Yi He (@heyibinance) November 5, 2026

How the API Risk Works

SignalPlus is a Hong Kong-based financial technology company that offers AI-enabled trading tools, options analytics and execution services. Its software links to exchanges through application programming interfaces, or APIs — keys that let outside apps place trades on a user's behalf without moving funds off the exchange or requiring a fresh login each time.

If an API key is compromised, attackers could use it to make unauthorized trades, even when withdrawals are switched off.

Binance told affected users to review positions and open orders directly in their accounts, and said traders should wait for SignalPlus to confirm the issue is fixed before setting up new connections. The exchange also urged users to enable IP whitelisting, which limits API access to approved internet addresses, and asked other connected platforms to review their own security controls.

Second Security Event in One Week

The action came exactly one week after Binance suffered the largest crypto hack on record. On Oct. 29, attackers took about $6.34 billion after reportedly compromising 17 hot wallets across several blockchains. That breach involved compromised developer systems, malicious software and unauthorized access to wallet-signing tools, and Binance has said the attack began with a fake job interview.

The FBI linked the theft to North Korea's TraderTraitor group, which is also tied to the 2025 Bybit hack. North Korea denied responsibility. Tether, Circle and other partners reportedly froze or intercepted about $2.85 billion of the stolen funds. Binance pledged to cover customer losses and began reopening withdrawals in phases on Nov. 1. By early Nov. 5, blockchain tracking estimates put about $3.2 billion still under the attackers' control, most of it held in bitcoin and ether.

Binance says no link has been established between the October hack and the SignalPlus issue. The earlier breach hit the exchange's internal wallet systems, while the latest step concerns keys tied to an outside platform. The exact nature of the SignalPlus problem has not been made public, and it is not yet known whether any customer credentials were accessed. Those two open questions set the timeline from here: Binance has told traders not to reconnect until SignalPlus confirms the issue is fixed, and with Deribit having reported the issue as well, the platform's findings will matter to users across more than one exchange. On the Oct. 29 breach, further movement of the stolen funds remains the figure that recovery partners and blockchain trackers have been updating.

Source: Blockonomi