In this article5 sections
Binance removed every API key connected to third-party trading platform SignalPlus on Nov. 5, 2026, after SignalPlus reported a potential security issue, according to Bitcoin.com News. The exchange said its internal systems were unaffected and that customer funds stayed safe.
In an announcement posted on X, Binance described the removal of the SignalPlus-linked keys as an immediate precautionary measure. crypto.news reported that the decision applies specifically to API keys tied to SignalPlus, which lets traders connect exchange accounts to outside trading tools.
Also read: Binance Ties $6.34B Hack to Fake Interviews, AI Tool
Key facts
- Binance revoked all SignalPlus API keys on Thursday, Nov. 5, 2026, after the platform reported a possible security problem.
- Binance said its own systems were unaffected and user funds remained safe.
- Founder Changpeng Zhao urged traders using SignalPlus on any other exchange to revoke their API keys as well.
- Binance has not established a link between the SignalPlus issue and its $6.34 billion hack of Oct. 29.
- Affected customers were told to check positions and open orders directly in their Binance accounts and to enable IP whitelisting before reconnecting.
What SignalPlus users were told to do
SignalPlus is a Hong Kong-based fintech company that offers AI-enabled trading tools, options analytics and execution services. Its software plugs into exchanges through APIs, which let customers trade without moving assets off the exchange.
Binance advised users to review their positions and outstanding orders in their own accounts and to wait until SignalPlus confirms the problem is resolved before setting up new API connections. It also recommended IP whitelisting, which limits API access to approved internet addresses, and asked other integrated platforms to review their security controls.
Zhao’s warning went beyond Binance. In a social media post, he said traders who use SignalPlus with other exchange platforms should revoke all their API keys, and he generally advised against storing API keys with any third party. He also referenced Deribit, the options and futures exchange, noting it had reported the concern. CoinCentral and crypto.news both reported that Deribit flagged the issue earlier.
Co-founder Yi He repeated the exchange’s position that Binance’s own systems were unaffected and advised customers to inspect open orders, hold off reconnecting credentials and use IP whitelisting. According to crypto.news, she framed the warning as aimed at third-party integration partners in general rather than SignalPlus alone, saying on X that this was not a challenge for any single company.
The Oct. 29 breach in the background
The revocation lands a week after a separate attack. On Oct. 29, attackers drained roughly $6.34 billion in cryptocurrency from Binance, with Bitcoin.com News reporting that 17 hot wallets were compromised across multiple blockchains.
CoinCentral, citing the exchange’s postmortem, reported that the campaign began in June when an engineer downloaded a tampered software package, and that in September attackers posing as recruiters sent another engineer a coding assignment that was actually malware. Access to the internal wallet-signing service followed, allowing transfers outside the normal withdrawal process.
crypto.news reported that Binance’s investigation found fraudulent recruitment interviews, malicious software and compromised internal AI tools were used, and that part of the attack relied on Ethereum’s EIP-7702 authorization mechanism. Stablecoin issuers and industry partners froze or intercepted about $2.85 billion, and Binance said it would absorb the losses. CoinCentral reported that 98% of affected token assets had been replenished by Oct. 31, while crypto.news put that recovery at about 98% by Nov. 4, with less-liquid tokens still being bought. The FBI attributed the theft to North Korea’s TraderTraitor group; North Korea denied responsibility.
Why it matters
The two incidents are different in kind. October’s breach involved Binance’s own wallet infrastructure, while the latest response concerns credentials held by an independent trading platform. That distinction matters for traders who granted SignalPlus permission to place orders on their behalf, because API keys can carry transaction rights without requiring a manual login each time.
What to watch
The next marker is SignalPlus itself: Binance said users should wait for the platform to confirm the issue is resolved before connecting again. Neither the nature of the suspected vulnerability nor whether customer credentials were accessed has been established publicly.
Reported by Bitcoin.com News.
Sources: Bitcoin.com News, crypto.news, CoinCentral