Blue Ethernet connector representing severed third-party API access

Binance and Deribit Cut Off SignalPlus After Fake Teams Invite Compromises Engineer

By Isaac • November 6, 2026 12:00 pm • Comments

Binance and Deribit have severed API access tied to SignalPlus after the crypto trading platform said an engineer was compromised through a fake Microsoft Teams invitation.

The move matters because SignalPlus sits between traders and their exchange accounts. Its users can authorize software to monitor positions or place orders through API keys, depending on the permissions they grant.

When that trusted layer is compromised, exchanges have to assume the keys may no longer be safe.

Trending: Core Scientific Is Leaving Bitcoin Mining Behind as AI Revenue Takes Over

CryptoSlate reported that Binance disconnected SignalPlus-linked keys on Nov. 5, with Deribit issuing a similar notice that stopped trading, monitoring and automated account access through the platform. Both exchanges said their own systems and data were unaffected, while directing customers to inspect positions, open orders and recent activity through the exchanges’ first-party interfaces.

SignalPlus later said the losses identified so far were below $82,000 and that reimbursements had begun.

Binance described its action as a precaution and told SignalPlus users to check their positions and open orders directly through Binance rather than through the third-party platform.

The report traced the intrusion to the early hours of Nov. 4 and said SignalPlus contacted partner exchanges to disable associated keys after containing the compromise. SignalPlus then suspended its own services for a broader security review.

Deribit’s notice covered trading, monitoring and automation through SignalPlus, while directing customers back to the exchange for account review. Neither exchange supplied a timetable for reconnecting the third-party platform.

SignalPlus said restoration would happen in phases only after necessary patches and a safety review. It also pledged to repay all affected users on a case-by-case basis.

Deribit said it also revoked every customer API key connected to SignalPlus. That stopped trading, monitoring and automation through the platform.

Users were directed to inspect open orders, positions and recent account activity on Deribit itself.

How the attacker got in

SignalPlus traced the incident to a compromised Telegram account belonging to a contact at a third-party technology vendor. According to the company, an attacker impersonated that contact and sent an engineer a fake Teams meeting invitation.

The invitation compromised the engineer’s computer.

SignalPlus said it detected the intrusion early on Nov. 4, contained it, contacted partner exchanges and suspended services for a broader security review. It has not supplied a fixed reopening date.

The central lesson is bigger than one platform. An exchange API key can become a high-value target even when the exchange itself has not been breached.

Trading permission, account visibility and IP restrictions all depend on how the key was configured before it left the exchange.

SignalPlus acknowledged that it had not previously required IP whitelisting for exchange API access. It now says it will strengthen endpoint security, internal access controls and key management, with services returning in phases only after patches and reviews are complete.

For affected users, the practical response is straightforward: revoke old keys, inspect exchange activity directly, and do not reconnect SignalPlus until the platform and the exchanges confirm that the path is safe.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews