Binance pulls API keys tied to SignalPlus after a cyberattack
SignalPlus says the breach began with a fake meeting invitation and that losses are under $82,000. Binance says its own systems were not touched.
Binance removed all API keys linked to SignalPlus, a third-party trading platform, after SignalPlus reported a possible security problem. An API key is the credential that lets a program operate an exchange account without the password. The announcement came at 4:51 a.m. Thursday, Mexico City time.
SignalPlus said later on X that its systems were the target of a cyberattack and that losses total less than $82,000. It has begun reimbursing affected users case by case and promises to cover all of them. The platform suspended its services during a security review and plans to restore them in phases, with no date given.
Binance says its own systems were not affected and that user funds remain safe.
The breach started, according to SignalPlus, with the hijacked Telegram account of a contact at one of its technology vendors. Posing as that contact, the attacker messaged a SignalPlus engineer and sent a fake Microsoft Teams meeting invitation. The engineer's computer was compromised, and the intruder lay low. In the early hours of Wednesday, Nov. 4, the attacker used that machine's access against the company's internal network.
SignalPlus acknowledges a gap of its own. It did not require IP whitelisting, a filter that limits where an API key can be used from, as a condition for connecting to an exchange. The affected accounts were those without it.
Binance advises anyone who used SignalPlus to review positions and open orders in their own Binance account and to wait for SignalPlus to confirm the problem is resolved before relinking keys. Binance founder Changpeng Zhao suggested on X that anyone using the platform on another exchange revoke all their API keys. He said Deribit was the first to flag the problem.
Disabling a key does not mean the linked account or its assets were compromised, SignalPlus says. While the suspension lasts, users can manage positions and orders through each exchange.
Neither company links the incident to the $6.3 billion theft Binance reported on Oct. 29.
