Key Takeaways:
- Binance and Deribit removed all the API keys associated with SignalPlus.
- The losses haven’t exceeded $82,000, SignalPlus said, and its users will be reimbursed.
- The attack started with a compromised Telegram account and a fake Microsoft Teams invite.
Binance and Deribit have disabled API keys connected to SignalPlus after the crypto derivatives infrastructure provider disclosed a cyberattack that compromised one of its engineers.
The exchanges claimed that there were no issues with their systems. Binance also stated that no funds of its users had been lost, and Deribit identified no signs that its systems or data were compromised.
Binance and Deribit Cut SignalPlus Access
SignalPlus said the incident began early on Nov. 4 and affected a small number of accounts that did not use IP whitelisting.
TL;DR: In the early hours of Nov 4, SignalPlus was targeted in an attack that began with a compromised third-party Telegram account, affecting a small number of accounts without IP whitelisting.
We detected and contained the intrusion quickly. As a precaution, we immediately worked with our CEX partners to revoke all SignalPlus-linked API keys and temporarily paused our terminal services.
Total losses are under US$82k, and all affected users will be reimbursed in full.
We expect to bring services fully back online over the next few days. Updates and user instructions will be shared through our official channels.
— SignalPlus (@SignalPlus_Web3) November 5, 2026
The company reported this suspicious activity to its centralized exchange partners and requested them to suspend all of SignalPlus’s API keys. The system also shut down its trading terminal in the course of a comprehensive security audit.
Binance CEO Changpeng Zhao advised all connected SignalPlus users that they should also cancel their other API credentials.
Yi He, Binance’s co-founder, independently urged third-party platforms connected to Binance to check security measures and keep an eye out for any unusual activity.
We also encourage all third-party platforms integrated with Binance to review their security controls, monitor for unusual activity and contact us immediately if they detect any concern💁🏻♀️
This is not a challenge for any single company……— Yi He (@heyibinance) November 5, 2026
The solution has effectively blocked trading, monitoring and automated execution via SignalPlus during the credential revocation period.
Read More: Binance Reveals How Hackers Moved $6.34B After Breaching Its Wallet-Signing System
Fake Teams Invite Compromised an Engineer
SignalPlus has identified that the attack is from a Telegram account of a contact at one of its external technology providers.
The attacker pretended to be that contact, and sent a fake invitation to a SignalPlus engineer. After infecting the engineer’s computer, the intruder sat silent until he was able to exploit his employee’s access to the company’s internal network.
SignalPlus states it did detect it, block the activity and closed the vulnerabilities it identified.
IP Whitelisting Becomes a Key Failure Point
The company also admitted that access to the exchange API was not IP address whitelisting. If not, the stolen credentials can be used from attacker-controlled infrastructure based on the permissions set on the key.
SignalPlus also will adjust API-access, endpoint security, internal permissions and key-management access. The company says total losses due to the incident are less than $82,000 and affected users are being reimbursed in full.
Crypto Firms Face Another Social Engineering Warning
The leak comes on the heels of another $6.3 billion crypto heist at Binance on Oct. 29.
Binance later stated that the attack was made through hacked employee computers, which included an engineer who was targeted using a fake job interview. The FBI would credit the attack to the North Korean hacking group.
While they occurred separately, both demonstrate trends of attacking employees or trusted third party relationships, rather than just attacking exchange infrastructure.
SignalPlus states that services will be back on a phased basis once security reviews and patches have been implemented. Users can still manage positions and open orders directly through the exchanges while the SignalPlus terminal remains suspended.
Read More: Cloudflare Unveils Stablecoin Monetization Gateway, Unlocking Instant x402 Payments for Any API
