Revoke the Keys: Binance Cuts SignalPlus Access

On 5 November Binance revoked every API key linked to SignalPlus after the third-party options and derivatives platform reported a potential security issue. The exchange said its own systems were unaffected and that customer funds remained safe. The same day, Binance co-founder Changpeng Zhao told traders to revoke SignalPlus keys on other venues too. The episode is not mainly about one vendor. It is about what a trading API key actually is: a high-privilege credential that can move positions even when withdrawals are turned off.

What Binance and Deribit did

In a post on X, Binance said that following a potential security issue reported by SignalPlus it had “proactively removed all API keys linked to SignalPlus as an immediate precautionary measure,” adding that “Binance’s own systems are unaffected” and that “user funds remain safe.” CoinDesk and Bitcoin.com News reported the same notice.

Affected customers were told to review positions and open orders directly on Binance, to wait until SignalPlus confirmed the issue was resolved before reconnecting keys, and to enable IP whitelisting when they do reconnect. Binance also called on other integrated platforms to review their own security controls. Deribit likewise revoked SignalPlus-linked keys; according to crypto.news, Deribit said its investigation found no indication that its systems or data had been affected, and warned that trading, monitoring and automation through SignalPlus had stopped for its customers.

Zhao’s advice went beyond Binance. “If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys,” he wrote, and added a broader caution against storing API keys with third-party platforms. CoinDesk noted that he also pointed to Deribit’s report of the issue.

What SignalPlus said happened

SignalPlus later published an incident statement covering the same window. According to crypto.news, the company said it detected suspicious activity early on 4 November, contained the intrusion, contacted exchange partners to disable connected customer credentials, and placed services into maintenance.

The company traced the initial compromise to a Telegram account belonging to a contact at a third-party technology vendor. Using that account, an attacker impersonated the contact and sent a SignalPlus engineer a fake Microsoft Teams meeting invitation. The social-engineering step compromised the engineer’s computer; the intruder remained dormant and then used the employee’s access against SignalPlus’s internal network in the early hours of 4 November.

SignalPlus said total losses were less than $82,000, that reimbursements had begun, and that the attack affected a small number of accounts without IP whitelisting. It also stated that disabling an API key does not mean the associated account or assets were compromised, and that the precaution applied to all users. Customers can still manage positions and open orders on the exchanges’ own platforms while SignalPlus remains suspended.

The control that was missing

In the same disclosure, SignalPlus acknowledged that it had not made IP whitelisting mandatory for exchange API access. “We take responsibility for this oversight,” the company said, according to crypto.news. Planned changes include tighter API access requirements, stronger controls on development devices and internal access, key-management changes, and deeper threat-intelligence sharing with exchanges and partners. Services are expected to return in phases after review and patches.

IP whitelisting is a blunt but useful constraint: it limits where a stored API key can be used. Without it, a key that leaves the intended host — through a compromised engineer laptop, a vendor channel, or a third-party tool that holds credentials — can be replayed from somewhere else. That is the operational gap the company named; it is also the control Binance told reconnecting users to enable.

Why trading API keys still matter with withdrawals off

Many traders treat “no withdrawal permission” as a soft ceiling on risk. It is not. An API key with trading rights can open, close and rewrite positions, cancel and replace orders, and force liquidations or adverse fills without ever moving coins off the exchange. The loss path is PnL and margin, not a chain withdrawal. That is why exchanges can treat a vendor-side incident as urgent even when their own custody rails look clean, and why Zhao’s advice to revoke keys on every connected venue is coherent with the threat model.

Third-party trading front-ends sit in an awkward place in that model. Assets stay on the exchange; the convenience comes from leaving a long-lived credential with software that can act as the trader. When that software — or an engineer device that can reach its key store — is compromised, the exchange’s correct move is often to cut the keys first and ask users to re-establish trust later. Binance and Deribit’s revocations fit that pattern.

Our view

We treat trading API keys the way we treat other high-privilege credentials: assume they will be stolen if they are stored where an attacker can reach them, and design as if “withdrawals disabled” is not a substitute for least privilege, short lifetime, IP binding and fast revoke. Vendor social engineering — a fake meeting invite from a compromised contact account — is a boring, effective path into exactly those stores. The SignalPlus losses reported so far are small relative to other recent incidents; the lesson is not the dollar figure. It is that a single third-party key store can force multiple exchanges to sever automation for their customers in a day.

As XDRIP Digital Management LLC, we build products and infrastructure in the XDRIP Universe where credentials, custody boundaries and operational controls have to hold under that kind of pressure. We are not a party to SignalPlus, Binance or Deribit’s response. We watch this class of incident because it repeats the same design question: who holds the key that can trade, how narrowly is it scoped, and how quickly can every venue that trusts it cut it off. Traders who still need third-party tooling should prefer keys that are IP-restricted, permission-minimal and easy to rotate — and should be ready to revoke them on every exchange the moment a vendor signals trouble.