Binance and Deribit Revoke SignalPlus API Keys After Phishing Breach

Binance and Deribit revoked API keys linked to crypto derivatives platform SignalPlus on Thursday, after an attacker compromised an engineer's computer through a fake Microsoft Teams meeting invitation. SignalPlus put total losses below $82,000 and pledged full reimbursement to affected users.

Both exchanges said their own systems remained unaffected. Deribit warned customers that trading, monitoring and automation running through SignalPlus had stopped functioning. Binance co-founder Yi He urged third-party platforms integrated with the exchange to review their security controls and monitor for suspicious activity, stating that the threat extended beyond any single company.

How did the attack unfold?

SignalPlus, which provides trading infrastructure for crypto options and lets professional and institutional traders manage positions across multiple exchanges from one interface, described the incident in a post on X. The attacker first compromised the Telegram account of a contact at a third-party technology vendor, then impersonated that contact and sent the fraudulent Teams invitation to a SignalPlus engineer. The engineer's computer was compromised on opening the invitation.

The intruder stayed dormant on the machine before using the engineer's access privileges to target SignalPlus's internal network early Wednesday, according to the company. SignalPlus said it detected and contained the intrusion, suspended services temporarily, and expects to restore operations over the next few days after completing security reviews and applying patches.

What security gap did SignalPlus admit?

The company acknowledged it had not required IP whitelisting for exchange API access — a control that restricts API calls to a predefined list of approved internet addresses. "We take responsibility for this oversight," SignalPlus said, adding that it will tighten API access requirements and strengthen internal security controls.

The exposure pattern echoes the October 29 breach of Binance itself. In that $6.3 billion incident, attackers posing as recruiters tricked an engineer into downloading a malicious file disguised as a coding assignment, then used the compromised machine to reach additional systems and ultimately breach the exchange's wallet infrastructure.

What is Binance doing about the wider threat?

Yi He said Tuesday that Binance detected and prevented 57 suspected North Korea-linked cyber threats in 2026. The attempts included fraudulent job interviews, malicious software packages and efforts to steal employee credentials.

The SignalPlus reimbursement process is already underway, and the platform's service restoration timeline — a few days, pending completed patching — will determine when institutional traders can resume automated multi-exchange workflows. Yi He's call for integrated platforms to audit their controls suggests exchanges may increasingly hold third-party API integrators to stricter security standards, with IP whitelisting and similar controls becoming baseline requirements rather than optional safeguards.