Binance said on Thursday it has removed all API keys linked to SignalPlus after the crypto options platform reported a potential security issue. The exchange called the removal an immediate precaution and said its own systems were unaffected and user funds remain safe.
Binance advised SignalPlus users to log in to Binance directly to review their positions and open orders. It also recommended waiting until SignalPlus confirms full resolution before binding any new keys, and to always enable IP whitelisting. Beyond those customers, Binance asked every third-party platform integrated with it to review its security controls, monitor for unusual activity, and contact the exchange immediately if they detect any concern.
Deribit Also Cuts Access
Deribit also revoked every customer API key connected to SignalPlus that day, saying SignalPlus had informed it of a potential security concern. As a result, all trading, monitoring, and automation run through SignalPlus on Deribit have stopped, the exchange warned. It told users planning to reconnect to wait for official word from the SignalPlus team.
SignalPlus, formed in 2021, offers options trading dashboards for Deribit, Binance, Bybit, OKX, and Coincall. Binance founder Changpeng Zhao (CZ) extended the warning to those other venues. “If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys,” Zhao wrote on X.
The SignalPlus alert comes a week after attackers took $6.3 billion from Binance’s hot wallets on October 29. The FBI has tied those attackers to North Korea’s TraderTraitor group.
Third-Party Keys Have Leaked Before
An exchange API key lets outside software trade on an account without the user’s password. That access has made trading tools a target before. Users of one such tool, 3Commas, reported unauthorized trades on FTX and Binance accounts in late 2022. Its CEO, Yuriy Sorokin, first disputed that the tool was at fault. Sorokin then admitted in December 2022 that the leaked customer API keys came from 3Commas.
