Binance and Deribit Revoke SignalPlus API Keys After Fake Teams Invite Attack

Binance and Deribit said they have revoked API keys tied to SignalPlus, a platform used for crypto derivatives trading, after a security breach that impacted customers’ ability to trade, monitor, and run automation via the service. Both exchanges emphasized that their own trading infrastructure was not affected, but Deribit warned that SignalPlus connectivity stopped functioning for users.

The incident highlights a growing pattern in exchange-security incidents: attackers gaining entry through compromised employee endpoints—often via social engineering—rather than directly breaking exchange systems.

Key takeaways

• Binance and Deribit revoked API keys connected to SignalPlus as a precaution following the breach.
• Deribit said SignalPlus-related trading and monitoring via its customers has stopped working.
• SignalPlus attributes the initial compromise to a hacked Telegram account tied to a contact at a third-party technology vendor.
• SignalPlus acknowledged it did not enforce IP whitelisting for exchange API access and said it will tighten requirements and security controls.
• The SignalPlus event follows Binance disclosures about a much larger hack earlier this month involving compromised employee computers.

Exchanges cut off SignalPlus API access

In a joint update shared Thursday, Binance and Deribit said they had revoked API keys that were linked to SignalPlus’s derivatives trading platform. Both exchanges stated that their own systems were unaffected by the breach.

Deribit’s warning was more specific for end users: trading, monitoring, and automation workflows that depended on SignalPlus have stopped working for its customers. In practice, that means traders who routed activity through SignalPlus may have faced interruption until the integration is restored and verified.

Binance co-founder Yi He further urged third-party platforms integrated with the exchange to audit their security controls and monitor for suspicious behavior. His message underscored the idea that the risk exposed by the breach may extend beyond the directly affected vendor.

How SignalPlus says the breach started

SignalPlus said the attack originated from a compromised Telegram account belonging to a contact at a third-party technology vendor. According to the company’s post on X, the attacker impersonated that contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer.

SignalPlus stated that the employee’s computer was compromised as a result of the interaction. The company added that the attacker remained dormant on the infected machine before using the engineer’s access privileges to target SignalPlus’s internal network in early Wednesday.

SignalPlus said it detected and contained the intrusion. The company reported total losses of less than $82,000 and said it has begun fully reimbursing affected users. It also said it temporarily suspended services and expects to restore operations over the next few days, after completing security reviews and applying patches.

What SignalPlus is changing: API access controls and IP whitelisting

A key part of SignalPlus’s own assessment focused on API access. The company acknowledged that it had not required IP whitelisting for exchange API access, describing the oversight directly.

In the company’s statement, SignalPlus said it takes responsibility for the lapse and will tighten API access requirements while strengthening internal security controls. IP whitelisting is designed to restrict API access to a predefined set of approved internet addresses, reducing the chance that stolen API credentials can be used from arbitrary locations.

For traders, this matters because API integrations are frequently the bridge between exchanges and institutional-style trading workflows. When those integrations are paused or credentials are revoked, the operational impact can be immediate—especially for teams relying on automation for options strategies and multi-exchange execution.

The broader security pattern: Binance’s earlier compromise

SignalPlus’s incident arrives days after Binance disclosed details of a separate hack that, according to earlier coverage linked from this report, was valued at $6.3 billion. That incident also centered on compromised employee computers.

Binance said in a postmortem that attackers posed as recruiters and tricked an engineer into downloading a malicious file disguised as a coding assignment. After compromising the employee workstation, the attackers allegedly moved laterally to access additional systems and ultimately breached the exchange’s wallet infrastructure.

Binance co-founder Yi He had also said previously that the exchange detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages, and attempts to steal employee credentials—though this count was framed as prevention and detection, not as a response to a single specific incident.

Read together, the SignalPlus and Binance disclosures point to a recurring vulnerability in the broader ecosystem: third-party and internal endpoints remain an attractive entry point. Even when exchanges are not directly breached, attackers can still disrupt trading operations by targeting the tools and intermediaries that connect institutional workflows to market venues.

What to watch next

Traders using SignalPlus should monitor when Binance and Deribit restore approved API access and whether SignalPlus completes its stated security review and service restoration on schedule. The critical uncertainty is how quickly integrations can be re-validated without further exposure, and whether the tightened API access measures—especially around IP restrictions and related controls—meaningfully reduce the chance of recurring compromise.