SignalPlus Breach Leads Binance and Deribit to Cut API Access

By Coinvote

Published November 6, 2026 - 07:21 UTC | 5 mins read

SignalPlus Breach Leads Binance and Deribit to Cut API Access

Binance and Deribit revoked every API key tied to SignalPlus after the derivatives platform confirmed an intrusion that began with a fake Microsoft Teams invitation. SignalPlus put losses below $82,000 and promised full reimbursement, but the episode lands days after Binance's own multibillion-dollar hack.

Two exchanges cut the connection to SignalPlus

Binance and the derivatives exchange Deribit said on Thursday that they had removed the API keys linked to SignalPlus, a platform that traders use to manage crypto options and derivatives positions. Cointelegraph reported that both exchanges described the step as a precaution and said their own systems were not affected. Deribit also cautioned that its customers could no longer trade, monitor positions or run automation via SignalPlus.

Binance wrote on X that user funds remain safe. Decrypt reported that Binance removed the keys as a precaution after SignalPlus alerted it to a possible security problem. Protos later added that SignalPlus had confirmed it was hacked.

How a fake Teams invitation opened the door

According to SignalPlus's account on X, as relayed by Cointelegraph and Protos, the attack began with a hijacked Telegram account of a person working for an outside technology vendor. Posing as that person, the attacker sent a SignalPlus engineer a bogus meeting invitation on Microsoft Teams. That invitation compromised the engineer's computer.

The intruder then waited. SignalPlus said the attacker used the engineer's access privileges to go after the internal network early on Wednesday, which Protos dates to November 4. The company said it detected and contained the intrusion. It paused its services and expects them to come back within a few days, once security reviews and patches are complete.

The numbers behind the incident

The reported figures are small next to the exchange-scale incidents that preceded this one. They still show how a single compromised workstation can lead to withdrawals of user money.

Losses: SignalPlus said they were below $82,000, and Cointelegraph reported that the company has begun reimbursing affected users in full.
Binance's earlier hack: Cointelegraph and Protos put it at $6.3 billion, while Decrypt cited about $6.4 billion drained from hot wallets on October 29.
Replenishment: Decrypt reported that Binance has covered roughly 98% of the stolen assets with its own money and is still acquiring the remainder.
Proof of reserves: Binance's new snapshot covers 44 tokens, up from 10, and can be checked once a zero-knowledge proof is generated in roughly 50 to 60 hours.
Threat volume: Cointelegraph reported that Binance co-founder Yi He said the exchange had stopped 57 suspected North Korea-linked threats in 2026.

Where the outlets agree and where they differ

All four outlets agree on the core event: Binance removed the keys and told users to check their positions and open orders directly on the exchange. The Defiant, for which only the headline and summary were available, adds that Binance asked users to hold off on reconnecting until a full resolution is confirmed. Decrypt and Protos add that Binance also urged users to switch on IP whitelisting.

The outlets differ on detail. Protos first framed the incident as a possible hack and later updated its article to include SignalPlus's confirmation. Cointelegraph gave the most complete timeline and was the only outlet to mention that SignalPlus had not required IP whitelisting for exchange API access. The size of Binance's own hack is given as $6.3 billion by two outlets and about $6.4 billion by Decrypt, and the sources do not explain the gap.

Only Decrypt places SignalPlus in Hong Kong and notes the FBI's attribution of the Binance theft to North Korean hackers, a claim Pyongyang has denied. Protos is the only outlet to list Bybit, Gate.io and OKX as SignalPlus partners.

What revoked keys mean for traders

Decrypt explained the practical effect. API keys let outside tools place trades on a user's behalf, so removing them stops any automated strategy running through SignalPlus until the user creates new keys. Users who relied on the platform for options positions across several venues therefore lost that single interface, even though funds on the exchanges were not reported as affected.

IP whitelisting limits a key to approved internet addresses, so a stolen key is far harder to use from an attacker's machine. SignalPlus acknowledged that it had not required this for exchange API access. "We take responsibility for this oversight," the company said, and it plans to tighten API requirements and internal controls.

A pattern of attacks on staff computers

Cointelegraph noted a parallel with the Binance incident. In Binance's postmortem, attackers posing as recruiters persuaded an engineer to download a harmful file presented as a coding task, and the compromised computer became a stepping stone to wallet infrastructure. At SignalPlus, the lure was a meeting invitation from a trusted-looking contact. In both cases, the sources describe an employee's machine as the entry point rather than a flaw in exchange code.

Yi He urged integrated third-party platforms to review their security controls and watch for suspicious activity, and said the threat was not limited to one company. Protos also listed recent attacks on Mercado Bitcoin and BitMart, while Cointelegraph linked to a report in which BitMart's founder called the security team severely understaffed.

Open questions to watch

Several points remain unsettled. SignalPlus has not yet said when services will return beyond the next few days, and Binance told users to wait for an all-clear before rebinding keys. It is also unclear whether other exchanges will follow Binance and Deribit in revoking keys.

Readers can check which API keys they have issued to third-party tools, confirm that each one is restricted to approved IP addresses, and review open orders on the exchange directly. Whether the vendor contact's compromised Telegram account was part of a wider campaign is not established in the sources.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$75,352	-6.5%	-3.6%	$1.51 trillion

CoinGecko data as of 2026-11-06 (UTC).

FAQ

How much did SignalPlus lose in the breach?

SignalPlus said losses were less than $82,000, according to Cointelegraph and Protos. The company has pledged to reimburse affected users in full and has begun doing so.

Are Binance user funds at risk from the SignalPlus incident?

Binance said its own systems are unaffected and that user funds remain safe. It removed all API keys linked to SignalPlus as a precaution, which stops automated trading through the platform until users reconnect with new keys.

How did attackers get into SignalPlus?

SignalPlus said an attacker used a compromised Telegram account of a vendor contact to send a fake Microsoft Teams invitation to an engineer. The engineer's computer was compromised, and the attacker later used that access to target the internal network.