Binance and Deribit disabled application-programming-interface credentials linked to SignalPlus on 5 November after the external crypto-options trading technology provider reported a potential security problem. The action severs the affected third party's trading access until users create authorised connections again. Binance said its own systems were unaffected and customer funds remained safe; Deribit said its investigation had found no indication of compromise of its own systems or data.[1][2]
An API key can let authorised software submit or cancel orders, read account data or manage positions without a person signing in for every transaction. Its particular permissions depend on configuration. Blocking the key removes a potential delegated execution route, but it does not necessarily liquidate existing positions or cancel outstanding exchange orders. That distinction makes direct account review important.[1][2]
Binance told affected users to log into the exchange independently, inspect positions and open orders, and postpone reconnecting SignalPlus until the provider confirmed resolution. It recommended IP whitelisting, which constrains where a credential can be used. Binance co-founder Changpeng Zhao also urged users of SignalPlus at other exchanges to revoke affected credentials. Those are precautionary operational instructions, not a finding that all linked keys were stolen or used improperly.[1][2]
Exchange response versus what remains unconfirmed
| Evidence or rule | Verified detail |
|---|---|
| Binance | Removed SignalPlus-linked API keys; said its systems were unaffected |
| Deribit | Revoked connections; found no evidence its systems or data were compromised |
| Affected customers | Review open orders and positions directly on the exchange |
| Reconnection | Wait for provider clearance; restrict new keys by IP where supported |
| Losses attributable to this alert | No verified amount disclosed in the cited announcements |
For institutional desks, the event exposes a dependency often hidden inside execution stacks. Traders may select a regulated or established venue and nonetheless place orders through a separate software provider, whose access management becomes part of the overall control perimeter. A platform operator, an executing exchange and a custody provider can each have distinct incident responsibilities.[1][2]
A useful control inventory would distinguish read-only credentials from trading-enabled ones, review withdrawal permissions, confirm how keys are stored and rotated, and preserve an independent route to check live exchange exposure. Removal of API access may interrupt algorithms, hedge maintenance and order cancellation. Desk operators must verify which actions actually completed before assuming that their systems are flat.[1][2]
The SignalPlus incident follows unrelated recent security reporting around Binance, but the two events should not be conflated. Neither the exchange statements nor the reporting reviewed establishes the number of SignalPlus accounts compromised, a loss figure attributable to this potential incident, or when normal connectivity will resume.[1][2]
The confirmed change on 5 November was an exchange-side credential revocation and a request for customer verification. Further claims about root cause, confirmed exploitation or resolution require a subsequent technical disclosure from SignalPlus or affected venues. Following revocation, traders should verify each live exchange position and open order directly; a disconnected algorithm does not prove orders were cancelled or hedges closed.[1][2]
Sources & further reading
- Binance removes SignalPlus-linked API keys after potential security issue Binance official account · 5 Nov 2026 · Accessed 5 Nov 2026
- Binance, Deribit remove SignalPlus API keys after security issue Reuters · 5 Nov 2026 · Accessed 5 Nov 2026