Binance and Deribit removed API keys connected to SignalPlus after the third-party digital-asset trading platform reported a potential security issue, cutting off its automated access to customer exchange accounts. Binance said its own systems were unaffected and user funds remained safe. Deribit told Reuters that its investigation found no indication that its systems or data were affected. The action disables SignalPlus-linked trading, monitoring and automation until users create and bind new credentials; it is a containment step, not public confirmation that either exchange was breached.

What the exchanges changed

Binance said it proactively removed all API keys linked to SignalPlus as an immediate precaution. Its official notice told affected users to log in to Binance directly, review their positions and open orders, and wait for SignalPlus to confirm full resolution before connecting new keys. Binance also recommended IP whitelisting, which limits a credential to approved network addresses. Reuters reported that Deribit took the same broad step and said it had found no evidence of impact to its own infrastructure. Binance co-founder Changpeng Zhao urged people using SignalPlus with other exchanges to revoke those keys as well.

Related reporting: Fed and OCC Reportedly Check Banks After Binance Hack

Why revoking an API key matters

An exchange API key can allow outside software to read account data and, depending on the permissions granted, place or cancel trades without the user signing in for every action. A key may be configured without withdrawal permission, but that does not eliminate trading risk if an unauthorized party can still change positions or create orders. Revocation invalidates the credential and blocks further access through that connection. It also interrupts legitimate strategies, alerts and dashboards, which is why Binance directed users to inspect their accounts and open orders through the exchange itself.

What remains unclear

The public Binance notice did not describe the technical cause, the number of connected accounts or whether any SignalPlus user suffered a loss. Reuters likewise reported the exchanges' precautions without establishing the scope of the underlying SignalPlus issue. No evidence in the reviewed sources shows that Binance or Deribit systems were compromised through this event. The absence of a confirmed exchange breach does not make the disruption immaterial: automated traders can lose access to risk controls or execution tools while connections are disabled, and any pre-existing positions still require direct review.

A separate event from the October Binance breach

The SignalPlus alert arrived during heightened scrutiny of exchange security after the October 29 attack on Binance, but the events should not be merged. The earlier incident concerned unauthorized access within Binance's wallet-signing environment. The new action concerns credentials held or used by a third-party trading platform to connect customer accounts to exchanges. Reuters cited the prior breach as context for the industry's sensitivity, while neither Binance nor Deribit publicly linked SignalPlus's warning to that attack. Treating them as separate incidents avoids implying a recurrence or shared attacker without evidence.

What users and platforms are waiting for

Binance advised users not to reconnect SignalPlus until the platform confirms the issue is fully resolved. Any later reconnection will require fresh keys because the revoked credentials cannot resume access, and the exchange recommended enabling IP whitelisting when new keys are created. Binance also asked other integrated platforms to review security controls and monitor for unusual activity. The next material disclosures would be SignalPlus's detailed incident account, the number of affected users, any confirmed losses, service-restoration timing and the safeguards required before exchanges accept new connections. Until those facts are published, the verified development is the precautionary revocation itself.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.