Binance, one of the world's largest cryptocurrency exchanges, has removed every API key linked to SignalPlus, a third-party crypto trading platform, after SignalPlus reported a "potential security issue," the exchange said on Thursday. Binance described the move as an "immediate precautionary measure" and said its own infrastructure was unaffected.

"Binance's own systems are unaffected. User funds remain safe," Binance said.

The exchange announced the decision in a post on X:

Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure. Binance's own systems are unaffected. User funds remain safe. If you used SignalPlus, please… pic.twitter.com/0HYYkTAW2p

— Binance (@binance) November 5, 2026

API keys allow third-party applications and trading tools to connect to a user's exchange account and place trades on their behalf. Such keys are commonly used by automated trading bots and portfolio tools to read balances and execute orders. Depending on the permissions set when a key is created, that access can range from read-only data visibility to trade execution and, in some cases, withdrawals. By revoking them, Binance has cut off that connection, meaning any automated strategies running on the exchange through SignalPlus will stop until users set up new keys.

Binance urged SignalPlus users to log into their accounts directly to review their positions and open orders. It recommended waiting until SignalPlus confirms the issue has been fully resolved before reconnecting any tools, and reminded customers to always enable IP whitelisting, a setting that restricts an API key to a list of approved internet addresses.

The exchange also called on all third-party platforms integrated with Binance to review their security controls, monitor for unusual activity, and contact the company immediately if they spot any concerns.

SignalPlus is a Hong Kong-based platform that provides trading tools for crypto options and derivatives. It connects to several exchanges, including Binance. Such API-based integrations are standard across the crypto industry, where exchanges routinely let external trading tools, bots, and portfolio services connect through user-generated keys.

Binance's Hack and Recovery

The precautionary step comes a week after Binance was hit by the largest hack in crypto history, in which attackers drained about $6.4 billion from its hot wallets—internet-connected wallets exchanges use to process day-to-day withdrawals—on October 29. The FBI has attributed the theft to North Korean hackers it calls TraderTraitor, a claim Pyongyang has denied.

Binance has said the attack began when a fake recruiter persuaded one of its engineers to download a malware-laced coding assignment. The attackers then used the stolen credentials to reach an internal wallet signing service.

On Wednesday, Binance said it has replenished about 98% of the stolen assets from its own funds and is still buying the remainder, mostly less liquid tokens, through market and over-the-counter channels. The exchange has also taken a new proof-of-reserves snapshot covering 44 tokens, up from 10. Proof-of-reserves reports are designed to demonstrate that an exchange holds sufficient assets to cover customer balances. Users will be able to verify the snapshot once its zero-knowledge proof is generated in about 50 to 60 hours; zero-knowledge proofs allow verification of an exchange's reserves without exposing individual account data. Completion of that proof is one of the near-term markers to watch, along with whether SignalPlus confirms its security issue is fully resolved—the condition Binance set before users reconnect any tools.

The exchange is still restoring services. On Thursday, it began reopening withdrawals for more assets in phases, prioritizing tokens based on user demand over the past week. Deposits remain open.

Source: Decrypt