TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Binance revoked API keys connected to SignalPlus after the trading platform reported a potential security issue. Binance said its systems were unaffected and customer funds remained safe, and urged users to inspect positions and open orders directly on the exchange before reconnecting.
Binance revoked all API keys linked to SignalPlus after the digital-asset trading platform reported a potential security issue, the exchange said Thursday, cutting off the third party’s access to connected accounts as a precaution. Binance said its own systems were unaffected and customer funds remained safe, and advised users to review their positions and open orders directly on Binance.
Binance told SignalPlus users to log in to the exchange directly and check their trading positions and open orders. It recommended that customers wait until SignalPlus confirms the issue is resolved before reconnecting API keys. The exchange also advised users to enable IP whitelisting, which limits API access to approved internet addresses, and called on connected platforms to review their security controls.
The action cuts off SignalPlus’s API access to Binance accounts, but the available report does not establish whether the third-party issue led to unauthorized trades or affected user accounts. Binance described the key removal as precautionary and said the incident did not affect its own systems. Those statements do not by themselves explain the nature or scope of the problem reported by SignalPlus.
Binance co-founder Changpeng Zhao urged users to revoke SignalPlus API keys on other exchanges as well. He said Deribit had also reported the issue and advised traders against storing API keys with third-party platforms. His comments point to a potential exposure beyond Binance, but the report does not provide details about the issue at Deribit or confirm the extent of any impact across exchanges.
Why API Access Was Cut
API keys let outside applications connect to exchange accounts and place trades without requiring a fresh login each time. That convenience also creates a security risk: a compromised key may enable unauthorized trading, even if withdrawal permissions are disabled. Disabling the SignalPlus-linked keys blocks that route into Binance accounts while the reported issue is investigated.
For users, Binance’s instructions mean checking account activity through the exchange itself rather than relying on SignalPlus during the incident. Reviewing open orders and positions can help customers spot activity they do not recognize, although the source material does not say that such activity has been found. Reconnecting too early could restore access before the third-party problem is resolved.
The warning also highlights that security at an exchange and security at an outside trading service are separate concerns. Binance said its systems were unaffected, but users had entrusted API access to a service that reported a potential problem. IP whitelisting can restrict where a key is used, but the report does not describe it as a fix for SignalPlus’s underlying issue. Crypto trading carries a risk of loss, including from unauthorized activity.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How Third-Party Keys Connect
SignalPlus is a platform for digital-asset options trading that offers trading tools and insights. Traders may connect such services to exchanges through application programming interface, or API, keys. Those credentials allow an outside application to interact with an account under the permissions granted to the key.
Binance’s move was reported on Thursday, Nov. 5, after SignalPlus disclosed a potential security issue. The supplied report does not give a time for SignalPlus’s warning, describe the suspected weakness, or say when the problem began. It also does not establish whether Binance’s revocation was part of a wider industry response beyond Zhao’s reference to Deribit.
The report also notes that Binance suffered a major hack on Oct. 29, when attackers siphoned off $6.3 billion following a months-long campaign; roughly half was later frozen by Tether, Circle and others. That earlier incident is separate from the SignalPlus warning. Binance said its systems were unaffected in the current matter, and the source does not connect the two events.
What the Warning Does Not Establish
The nature of SignalPlus’s potential security issue, when it began and how many users or API connections may be affected have not been specified in the supplied report. It is also unclear whether any unauthorized trades occurred, whether customer accounts were accessed, or whether the issue involved exposed credentials, a software flaw or another cause.
Binance said its systems were unaffected and funds remained safe, but the report does not include an independent technical assessment or details on how the exchange verified the incident’s scope. Zhao referred to a report from Deribit, but no statement from Deribit is included here. SignalPlus’s resolution timeline and the conditions it will use to confirm the issue is fixed are also unknown.
When Users Can Reconnect
Binance’s guidance is to keep SignalPlus API keys disconnected until the platform confirms the issue has been resolved. Users can check their Binance positions, open orders and account activity directly in the meantime, and review whether their API settings use IP whitelisting. The report does not provide a timetable for a resolution or say when Binance might permit new SignalPlus connections.
The next material update would be a statement from SignalPlus explaining the issue and confirming what corrective steps it has taken. More information from Binance or other affected exchanges could clarify the scope, whether accounts were impacted and what safeguards are required before users reconnect. Until then, the full extent of the risk remains unconfirmed.
Key Questions
Why did Binance revoke SignalPlus API keys?
Binance said it removed all keys linked to SignalPlus after the trading platform reported a potential security issue. The exchange described the action as a precaution to cut off SignalPlus access to connected Binance accounts.
Did Binance say customer funds were affected?
No. Binance said its own systems were unaffected and customer funds remained safe. The report does not independently verify that statement or give details about any account-level investigation.
What should SignalPlus users do now?
Binance advised users to log in directly, review their positions and open orders, and wait for SignalPlus to confirm that the issue is resolved before reconnecting API keys. It also recommended IP whitelisting for API access.
Could a compromised API key allow withdrawals?
The report says compromised API keys can potentially be used for unauthorized trades even when withdrawals are disabled. It does not state that SignalPlus keys were compromised or that unauthorized trading occurred in this incident.
Is SignalPlus access safe to reconnect?
Binance advised users to wait until SignalPlus confirms the issue is resolved. No resolution time or technical explanation was provided in the supplied report, so the scope and status of the problem remain unclear.
Source: coindesk.com
