Binance removes SignalPlus API keys after SignalPlus reports hack

Binance removes SignalPlus API keys as a precaution

Binance has removed all API keys linked to crypto trading terminal SignalPlus. An API key is a code that lets a trading tool connect to an exchange account and trade on behalf of the user.

Binance described the move as an immediate precautionary measure after a hack at SignalPlus. Binance said its own systems are unaffected and user funds remain safe.

Deribit, a crypto derivatives exchange, also removed all SignalPlus API keys. It said it did so in response to a potential incident.

Actions taken and reported losses in brief

• Binance removed all SignalPlus API keys.
• Deribit removed all SignalPlus API keys.
• SignalPlus said under $82,000 worth of user funds were stolen.
• SignalPlus said it shut down the incident and will reimburse user losses.
• SignalPlus services will remain unavailable until the company confirms everything is secure.

What Binance and Deribit said

Binance posted on X that its own systems are unaffected and user funds remain safe.

Binance advised users to review their positions and open orders. It said users should wait for SignalPlus to give the all-clear before rebinding any API keys.

Binance also said users should always enable IP whitelisting. IP whitelisting limits which internet addresses can use an API key.

Binance called on third-party platforms integrated with it to review their security controls. It asked them to monitor for unusual activity and contact Binance immediately if they detect any concern.

Yi He of Binance also encouraged third-party platforms to review security controls and monitor for unusual activity.

What SignalPlus said happened

SignalPlus said on X that it was hacked and under $82,000 worth of user funds was stolen.

SignalPlus claimed it was targeted through a compromised Telegram account belonging to one of its third-party partners. Telegram is a messaging app.

SignalPlus claimed the attacker posed as that contact and communicated with one of its engineers. It said the attacker sent a fake Microsoft Teams meeting invitation.

SignalPlus said the engineer's computer was compromised. It said that by November 4, the attacker began using the engineer's access privileges to attack its internal network.

SignalPlus said it was able to shut down the incident. It said it will reimburse user losses.

Confirmed facts and claims that still need care

Confirmed in the source material: Binance and Deribit removed SignalPlus API keys, and Binance said its own systems are unaffected and user funds remain safe.

Reported by SignalPlus, but not independently confirmed in the source material: the Telegram account compromise, the fake Teams invitation, the compromise of the engineer's computer, and the start of the internal network attack by November 4.

SignalPlus said under $82,000 in user funds was stolen. The source material does not give a more exact figure.

Why a third-party hack reaches big exchanges

SignalPlus is partnered with major crypto firms such as Bybit, Gate.io, and OKX, according to the source material.

Because trading tools can connect to exchange accounts through API keys, a hack at a partner can lead exchanges to cut those connections as a precaution, even when the exchange itself reports no breach.

The source material also notes other hacks this month. It says Binance was hacked for $6.3 billion earlier this month and is opening further withdrawals and replenishing stolen funds. It says Brazilian crypto exchange Mercado Bitcoin was also hacked this month, as was BitMart.

What users were told to do while services are paused

Binance told users to review their positions and open orders. It told users to wait for an all-clear from SignalPlus before rebinding any API keys.

SignalPlus said its services will remain unavailable until it confirms everything is secure again.

Source for this article

• Protos

Read also: Fed and OCC reportedly check US banks after $6.3 billion Binance hack