Binance and Deribit have disabled API keys connected to SignalPlus after the trading platform reported a potential security issue. The exchanges acted to limit possible unauthorized account access, although neither reported evidence of compromised exchange systems. Bitcoin (BTC) traded near $79,861 on November 5, 2026, as the incident raised fresh questions about third-party trading security.
Binance Disables SignalPlus Access and Issues Security Guidance
Binance removed API keys associated with SignalPlus after receiving notification of a potential security problem. The exchange said its internal systems remained unaffected, and customer funds remained safe. However, Binance advised affected users to avoid reconnecting their accounts until SignalPlus resolves the reported issue.
The exchange also recommended IP whitelisting, which restricts API connections to approved internet addresses. This measure helps users limit access to their accounts through authorized systems and reduces exposure to unauthorized connections. Additionally, Binance urged third-party trading platforms to review their security controls and report suspicious activity promptly.
The response highlights the risks that arise when traders grant external platforms access to exchange accounts. API keys allow connected services to perform permitted actions, including trading and managing orders, depending on assigned permissions. Therefore, users should review their API settings and remove unnecessary access while the platform investigates the incident.
Deribit Revokes Connected Keys After Its Investigation
Deribit also revoked customer API keys linked to SignalPlus after receiving notice of the potential security concern. The exchange said its investigation found no evidence that attackers had compromised its systems or accessed its data. Consequently, the reported issue has not established a breach of Deribit’s infrastructure.
The exchange’s action followed a precautionary approach similar to Binance’s response. By disabling the affected connections, Deribit limited continued access through the integration while the security concern remained under review. However, the exchange has not reported financial losses associated with the incident.
SignalPlus provides cryptocurrency options trading, market analytics, and risk-management tools through integrations with major exchanges. Its connection with Deribit allows users to manage options positions through an external interface rather than relying solely on the exchange’s platform. However, the latest restrictions show how problems at a third-party service can affect trading access across connected exchanges.
SignalPlus Security Issue Raises Questions About API Protection
API integrations help traders automate strategies, monitor markets, and manage positions across multiple trading venues. Nevertheless, these connections can introduce additional security risks when users grant external services permission to interact with exchange accounts. The level of exposure depends on the permissions attached to each key and the security controls protecting the connected platform.
Users can reduce potential risks by limiting API permissions to essential functions and enabling IP restrictions where available. They should also avoid granting withdrawal permissions unless a specific service genuinely requires them. Furthermore, traders should regularly review active keys and remove connections they no longer use.
The latest incident comes amid wider scrutiny of cryptocurrency exchange security following reports of major attacks and security upgrades across the industry. Binance has separately faced recovery efforts following an October 29 incident that reportedly affected approximately $6.34 billion in cryptocurrency assets. However, the available information does not establish a connection between that incident and the SignalPlus security concern.
Neither Binance nor Deribit has reported losses linked to the SignalPlus issue, and the exchanges have not identified compromised customer data. Meanwhile, SignalPlus has yet to disclose full details of the potential vulnerability in the supplied report. Until further information emerges, users should verify official updates before restoring API connections to either exchange.
