Binance and Deribit Revoke SignalPlus API Access Following Security Alert
Exchanges proactively disconnect third-party trading tools after a potential security vulnerability was reported.
1Immediate API Access Revocation
On November 5, 2026, Binance and Deribit terminated all API connections linked to the trading platform SignalPlus. This proactive measure followed a security alert issued by the third-party service. Both exchanges confirmed their internal systems remain secure and customer funds are safe, despite the sudden disruption to automated trading services.
2Scope of Security Precaution
Binance instructed affected users to log in directly to their accounts to review positions and open orders. The exchange advised customers to wait for an official resolution from SignalPlus before establishing new API connections. Additionally, Binance urged all integrated third-party platforms to conduct thorough security audits to prevent potential breaches.
3Broader Industry Warning Issued
Changpeng Zhao, founder of Binance, expanded the warning beyond his own exchange. He advised users to revoke SignalPlus API keys across all platforms, including Bybit, OKX, and Coincall. Zhao emphasized the general risk of storing API credentials with third-party services, suggesting that users should avoid such practices to maintain account security.
4Context of Recent Breach
This incident occurs just one week after a massive $6.34 billion hack on Binance’s hot wallets on October 29. While the two events are separate, the timing has heightened security sensitivity. The FBI has attributed the earlier October theft to the North Korean group TraderTraitor, though North Korea denies any involvement.
5Distinction Between Security Incidents
The October 29 breach involved compromised developer systems and unauthorized access to internal wallet-signing infrastructure. In contrast, the SignalPlus issue concerns external API credentials that allow third-party software to execute trades. Binance clarified that there is no established connection between the massive October hack and the current SignalPlus security vulnerability.
6Mechanism of API Vulnerabilities
API keys allow external software to trade on behalf of users without requiring a password. This functionality makes them a frequent target for attackers. Similar incidents occurred in late 2022, when 3Commas confirmed that leaked customer API keys led to unauthorized trades on various cryptocurrency exchanges, including Binance and the defunct FTX.
7Recovery and Mitigation Efforts
Following the October hack, Binance began reopening withdrawals in phases on November 1. Approximately $2.85 billion of the stolen assets were frozen or intercepted by industry partners. As of November 5, blockchain tracking estimates suggest that attackers still retain control over roughly $3.2 billion in bitcoin and ethereum assets.
8Future Security Best Practices
Exchanges are now emphasizing the importance of IP whitelisting, which restricts API access to specific, approved internet addresses. As the investigation into the SignalPlus vulnerability continues, the lack of public details regarding the nature of the flaw underscores the necessity for users to remain vigilant and manage their own security credentials.