Users managing exchange accounts through SignalPlus face interrupted trading and monitoring after Binance and Deribit revoked the platform’s connected API keys on November 5.
The exchanges acted after SignalPlus reported a security incident. Both said their own systems were unaffected, while SignalPlus subsequently disclosed losses below $82,000 and promised to reimburse affected customers.
For users, the immediate task is to review accounts directly through their exchange. A disabled third-party connection can stop automation without closing the positions or orders it previously managed.
Key Takeaways
- Binance and Deribit removed SignalPlus-linked API credentials as a precaution.
- SignalPlus says a fake meeting invitation led to an employee-device compromise.
- Customers should review positions and orders directly, and await confirmed security clearance before reconnecting.
Exchanges Cut Off Third-Party Connections
Binance said customer funds remained safe and advised users to inspect their positions and open orders through its official platform. Deribit said its investigation found no indication that its systems or data had been affected.
The revocations concern access granted to SignalPlus, which provides tools for options and derivatives trading. Deribit warned that trading, monitoring and automation through the service had stopped working.
This is different from a general exchange withdrawal suspension. Customers can still manage their accounts through the exchanges’ own interfaces, according to the statements.
Understanding the difference between exchanges and wallets helps separate where assets sit from the software used to interact with them.
SignalPlus Describes a Fake Meeting Invitation
According to its November 5 statement, reported by crypto.news, an attacker used a compromised vendor contact’s Telegram account to approach a SignalPlus engineer.
The attacker sent a fraudulent Microsoft Teams invitation that compromised the engineer’s computer. SignalPlus said suspicious internal-network activity began early on November 4.
The company reported losses below $82,000, said reimbursement had begun case by case, and placed services into maintenance mode. These figures and the attack explanation remain the company’s account of an ongoing investigation.
SignalPlus also acknowledged that it had not required IP whitelisting for exchange API access and said it would strengthen its controls.
Why API Permissions Matter
An API key lets software perform authorised tasks on an account. Its permissions determine the scope: reading balances, placing trades and initiating withdrawals are distinct capabilities.
Binance’s API wallet guidance explains these permission categories and the role of IP restrictions. An allowlist limits the internet addresses from which a credential can be used.
A read-only dashboard does not need authority to trade. Similarly, a tool that submits orders does not necessarily need withdrawal permission. Restricting access to the required functions reduces the actions an exposed credential can authorise.
For businesses integrating cryptocurrency payments, the broader lesson is to document which external services can read account information or initiate transactions. That inventory makes revocation more manageable when a provider reports an incident.
What Connected Users Should Review
Customers should follow Binance’s instruction to inspect positions and open orders directly. A stopped dashboard can otherwise leave users without the monitoring they normally rely on.
They should also review SignalPlus connections on any other exchanges they use. Binance founder Changpeng Zhao separately urged users to revoke those credentials.
Before reconnecting, confirm the provider’s official recovery instructions and review permissions again. Account passwords and two-factor authentication remain important, but they do not replace controls over separately authorised API credentials.
Different wallet and custody arrangements carry different responsibilities. Users should distinguish exchange-account access, third-party integrations and control of wallet keys when assessing exposure.
Revocation is also a containment measure, not a finding that every connected account suffered a loss. Users should compare their exchange records with their own expected activity, retain any relevant transaction details and report discrepancies through verified support channels. Recreating the same connection before the investigation is resolved would undermine the purpose of disabling it.
Conclusion
The SignalPlus incident shows how a third-party security problem can interrupt account management even when an exchange reports no compromise. Users should verify their positions directly, review connected credentials and wait for confirmed recovery guidance before restoring automated access.
