Binance Pulls SignalPlus API Keys, Says Funds Safe After Deribit Flags Security Issue

TLDR

• Binance removed all API keys linked to SignalPlus on Nov. 5, 2026, after the platform reported a potential security issue.
• CZ told SignalPlus users to revoke API keys on every exchange, and said Deribit had also reported the issue.
• Binance says its own systems are unaffected and user funds remain safe.
• The move came one week after Binance’s $6.34 billion hack on Oct. 29.
• No link has been established between the two incidents, and the SignalPlus issue has not been fully explained.

Binance founder Changpeng Zhao has told traders who use SignalPlus on any exchange to revoke their API keys. The warning came on Thursday, Nov. 5, 2026, after Binance removed every API key linked to the third-party trading platform.

SignalPlus had reported a potential security issue before the move. Binance said it acted as an immediate precaution.

“Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure,” the exchange said on X. It added that “Binance’s own systems are unaffected. User funds remain safe.”

Warning Reaches Beyond Binance

Zhao, known as CZ, said the risk was not limited to one exchange. “If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys,” he wrote on social media.

He also said that Deribit, a crypto derivatives exchange focused on options and futures, had reported the issue. Zhao advised traders not to store API keys with any third-party platform.

Binance co-founder Yi He repeated that the exchange’s systems were unaffected. She told customers to check open orders, hold off on reconnecting affected keys and turn on IP whitelisting.

SignalPlus is a Hong Kong-based financial technology company. It offers AI-enabled trading tools, options analytics and execution services.

Its software links to exchanges through application programming interfaces, or APIs. These keys let outside apps place trades without users moving funds off the exchange or logging in each time.

If an API key is compromised, attackers could use it to make unauthorized trades. This can happen even when withdrawals are switched off.

Binance told affected users to review positions and open orders directly in their accounts. It said they should wait for SignalPlus to confirm the issue is fixed before setting up new connections.

The exchange also urged users to enable IP whitelisting, which limits API access to approved internet addresses. It asked other connected platforms to review their own security controls.

Second Security Event in One Week

The move came one week after Binance suffered the largest crypto hack on record. On Oct. 29, attackers took about $6.34 billion after reportedly compromising 17 hot wallets across several blockchains.

That breach involved compromised developer systems, malicious software and unauthorized access to wallet-signing tools. Binance has said the attack began with a fake job interview.

The FBI linked the theft to North Korea’s TraderTraitor group, which is also tied to the 2025 Bybit hack. North Korea denied responsibility.

Tether, Circle and other partners reportedly froze or intercepted about $2.85 billion. Binance pledged to cover customer losses and began reopening withdrawals in phases on Nov. 1.

By early Nov. 5, blockchain tracking estimates put about $3.2 billion still under the attackers’ control. Most of it was held in bitcoin and ether.

Binance says no link has been established between the hack and the SignalPlus issue. The October breach hit its internal wallet systems, while the latest step concerns keys tied to an outside platform.

The exact nature of the SignalPlus problem has not been made public. It is also not yet known whether any customer credentials were accessed.

The post Binance Pulls SignalPlus API Keys, Says Funds Safe After Deribit Flags Security Issue appeared first on Blockonomi.