Binance and Deribit Suspend SignalPlus API Keys Following Cyberattack
On Thursday, cryptocurrency exchanges Binance and Deribit announced the revocation of API keys associated with SignalPlus, a crypto derivatives trading platform, as a precautionary response to a security breach. Both exchanges confirmed that their internal systems remained secure. However, Deribit cautioned its users that trading, monitoring, and automation services through SignalPlus were disrupted.
SignalPlus suffered a cyberattack prompting the exchanges to block their API access to the platform as a safeguard against further risks.
Yi He, co-founder of Binance, urged third-party platforms integrated with Binance to strengthen their security protocols and stay vigilant for suspicious activities, emphasizing that the threat extended beyond just one organization.
SignalPlus offers infrastructure for trading crypto derivatives, especially options, enabling professional and institutional traders to handle positions across multiple exchanges using a single unified platform.
According to SignalPlus on X, the breach started with the takeover of a Telegram account belonging to a contact at a third-party technology provider. The attacker impersonated this contact and sent a fake Microsoft Teams meeting invite to a SignalPlus engineer, compromising that employee’s computer.
The attacker remained inactive on the compromised computer before leveraging the engineer’s access rights to infiltrate SignalPlus’s internal network early Wednesday morning, the company reported.
SignalPlus detected and contained the intrusion, reporting losses under $82,000. The company is fully reimbursing impacted users. Services have been temporarily suspended, with plans to resume operations in the coming days after completing security assessments and applying necessary fixes.
SignalPlus admitted it did not require IP whitelisting for API access to exchanges, acknowledging this oversight. The company stated it will implement stricter API access controls and bolster internal security measures. IP whitelisting restricts API usage to approved internet addresses only.
This incident occurred shortly after Binance revealed details about a $6.3 billion hack on October 29 that also involved compromised employee devices.
Binance’s investigation found attackers posing as recruiters tricked an engineer into downloading malware disguised as a coding task. This malware enabled access to further systems and ultimately the exchange’s wallet infrastructure.
Yi He noted on Tuesday that Binance had blocked 57 suspected North Korea-related cyberattacks in 2026, including fake interviews, malicious software attempts, and efforts to steal employee credentials.
SignalPlus’s attack followed closely on the heels of the massive Binance hack, highlighting ongoing cyber threats in the crypto sector.
Why it matters
The breach at SignalPlus underscores persistent cybersecurity challenges facing crypto exchanges and their partners, emphasizing the need for rigorous security measures and vigilance across interconnected platforms.
Prepared from the source material with AI-assisted editing and checked against the supplied facts.
Open original source ↗