Binance, Deribit revoke SignalPlus API keys after fake Teams invite attack
Binance and Deribit cut SignalPlus access
Binance and Deribit revoked API keys connected to SignalPlus after a security breach at the crypto derivatives trading platform. API keys are codes that let an outside platform trade on an exchange on a user's behalf.
The exchanges said their own systems were unaffected. Deribit said trading, monitoring and automation through SignalPlus had stopped working for its customers.
SignalPlus said total losses were less than $82,000. The company said it had begun reimbursing affected users in full.
Key numbers and actions
- Losses from the breach were less than $82,000, according to SignalPlus.
- SignalPlus temporarily suspended its services.
- Binance and Deribit revoked SignalPlus API keys as a precaution.
- SignalPlus expects to restore operations over the next few days.
What SignalPlus says about the fake Teams invite
SignalPlus said on X that the attack started with a compromised Telegram account belonging to a contact at a third-party technology vendor. The attacker impersonated that contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer.
The invitation compromised the engineer's computer, according to SignalPlus. The attacker remained dormant on the computer before using the engineer's access privileges to target the company's internal network early Wednesday.
SignalPlus said it detected and contained the intrusion. The company also said it had not required IP whitelisting for exchange API access. IP whitelisting restricts API access to a predefined list of approved internet addresses.
SignalPlus said: “We take responsibility for this oversight.” It said it would tighten API access requirements and strengthen internal security controls.
What the exchanges said
Binance co-founder Yi He urged third-party platforms integrated with the exchange to review their security controls and monitor for suspicious activity. He warned that the threat extended beyond any single company.
The SignalPlus incident came days after Binance disclosed details of a $6.3 billion hack on Oct. 29. Binance said that attack also involved compromised employee computers.
According to Binance's postmortem, attackers posing as recruiters tricked an engineer into downloading a malicious file disguised as a coding assignment. The attackers then used the compromised computer to gain access to additional systems and eventually breach the exchange's wallet infrastructure. A wallet is a system that stores crypto assets.
Yi He also said Tuesday that Binance had detected and prevented 57 suspected North Korea-linked cyber threats in 2026. Those threats included fraudulent job interviews, malicious software packages and attempts to steal employee credentials, according to the report.
What happens next for SignalPlus
SignalPlus said it expects to restore operations over the next few days after completing security reviews and applying patches. It said it would also tighten API access requirements and strengthen internal security controls.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.