Newsroom / Binance

Binance and Deribit revoke SignalPlus API keys after breach with under $82K in losses

Automated trading through the third-party options platform has stopped and SignalPlus is offline. Binance tells users to wait for an all-clear before reconnecting, and to turn on IP whitelisting.

November 5, 2026 · Effective · Verified 2026-11-06 via official announcement

Binance said on 5 November 2026 that it had removed all API keys linked to SignalPlus, a third-party crypto derivatives trading platform, as a precaution, and said its own systems were unaffected. Deribit also removed its customers' SignalPlus keys. SignalPlus said an attacker reached its internal network early on 4 November, that losses are below $82,000 and that it has begun reimbursing affected users.

SignalPlus says the attack began with a compromised Telegram account belonging to a contact at a third-party technology vendor. Posing as that contact, the attacker sent one of its engineers a fake Microsoft Teams invitation, compromised the computer and stayed dormant before using the engineer's access. SignalPlus admits it had not required IP whitelisting for exchange API keys and says it takes responsibility for that gap. It posted a summary saying a small number of accounts without whitelisting were affected.

The immediate effect is on anyone trading through SignalPlus. Its services are in maintenance mode and will return in phases, with no date given. It says disabling a key does not mean an account or its assets were compromised. Positions and open orders can still be managed on each exchange directly. Cointelegraph reports Deribit warned that trading, monitoring and automation through SignalPlus had stopped working for its customers, and Deribit said it found no sign its systems or data were affected, Crypto Times reports, citing Reuters.

SignalPlus says every user API key at all of its partner exchanges was disabled, without naming them. Protos lists Bybit, Gate.io and OKX as partners; DexSheet did not find statements from those exchanges. Binance founder Changpeng Zhao told users of SignalPlus on any other platform to revoke their keys. CoinDesk notes compromised keys can allow unauthorized trades even when withdrawals are disabled. Neither Binance's nor SignalPlus's statement links this incident to the 29 October Binance hack.

“We recommend waiting until SignalPlus confirms full resolution before rebinding any API keys, and always enabling IP whitelisting.”

— Binance on X, 5 November 2026

Who this affects

Traders who connected Binance, Deribit or other exchange accounts to SignalPlus. Binance and Deribit users who never used SignalPlus are not part of this action.

Binance at a glance

More from the newsroom

• 2026-11-10 Binance to close Binance Pool, Cloud Mining and Pool Savings at 07:00 UTC on Nov. 10
• 2026-11-09 Binance lets affiliates share commission with up to 50 sub-affiliates across 7 levels
• 2026-11-08 Binance says forum listing of 335.9M user records is likely a scam, finds no breach
• 2026-11-06 Binance-controlled GOPAX halts trading and deposits after emailed hacking threat