Binance Revokes SignalPlus API Keys Over Security Breach

SignalPlus said attackers compromised an engineer’s computer, a breach that resulted in losses of less than $82,000. The company pledged to reimburse those losses in full. The method echoes the October attack on Binance itself, which also began with a social engineering vector aimed at an employee.

The Gap SignalPlus Admitted To

SignalPlus provides digital asset trading infrastructure, connecting exchange accounts to external tools through API credentials. Those keys let a third-party platform execute trades and monitor accounts on a user’s behalf. If the third party is compromised, an attacker inherits that access directly, with no password or two-factor code required.

The company also acknowledged that it had not required IP whitelisting for exchange API access. We take responsibility for this oversight, SignalPlus said, adding that it would tighten API access requirements and strengthen internal security controls.

Changpeng Zhao, Binance’s founder, widened the warning beyond Binance users. If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys, he wrote, and cautioned traders against storing exchange API credentials with outside service providers. Binance also recommended IP whitelisting for future API connections, which restricts access to approved internet addresses.

A Bad Week to Need Another Audit

The timing is awkward. The SignalPlus incident arrives roughly one week after about $6.3 billion in digital currency was stolen from Binance. The FBI attributed the theft, which occurred on or about October 29, to the North Korea-linked group TraderTraitor. North Korea has since denied being behind it. That attack began with a compromised employee downloading malware, and Binance is still restoring services and expanding its proof-of-reserves verification.

Neither Binance nor SignalPlus has disclosed technical details of the latest issue or confirmed customer losses from it. That leaves traders unable to tell whether their own funds were ever at risk or whether the breach stayed contained at the platform level. In the meantime, anyone running automated derivatives strategies through SignalPlus has to rebuild API connections, retest configurations, and wait for Binance’s all-clear.

The practical guidance from both sides comes down to a short list:

• Revoke any SignalPlus API keys on other exchanges
• Avoid storing exchange API credentials with outside service providers where possible
• Turn on IP whitelisting for every API connection you keep

Hashlytics Take

An API key without an IP restriction is effectively a bearer token: whoever holds it can use it from anywhere. That is why one compromised engineer laptop was enough, and why Binance’s only clean response was to revoke every key tied to SignalPlus at once. The lesson is less about SignalPlus than about defaults. Exchanges that let users generate unrestricted keys are handing third parties a liability they cannot control, and Binance’s new guidance suggests it knows that. Whether IP whitelisting becomes a hard requirement for integrations or stays a recommendation will say more about how seriously exchanges treat third-party risk than any statement made this week.