1. Binance revokes SignalPlus access: what happened?
Binance removed every API key linked to the trading platform SignalPlus on Thursday, November 5, after SignalPlus reported a potential security issue. The exchange said its own systems were not affected and that customer funds are safe. It told affected users to check their positions and open orders directly on Binance and to hold off on reconnecting any keys until SignalPlus confirms the problem has been resolved.
The step cut SignalPlus off from the exchange accounts of its customers as a precaution. Binance announced the decision in a post on X, and the measure took effect across all connections that used the platform's keys. The exchange did not describe the nature of the issue at SignalPlus, and no details about its scope have been made public in the announcement.
2. What is SignalPlus and why do exchanges connect to it?
SignalPlus is a platform focused on digital asset options trading. It supplies traders with tools and market insights, and to do so it needs to connect to the exchanges where its users hold accounts. That connection is made through application programming interfaces, usually shortened to APIs.
Many crypto traders rely on outside software to manage activity across several venues at once. Portfolio dashboards, automated strategies and analytics tools all depend on the ability to read balances and submit orders without the trader logging in manually each time. This convenience is the reason third-party platforms are popular, but it also creates a link that sits outside the exchange's own security perimeter.
If one of these providers suffers a security problem, the connections it holds can become a point of exposure even when the exchange itself has not been breached. That is the situation Binance appears to be guarding against: the exchange's infrastructure is described as unaffected, yet the keys issued to a partner are only as safe as the partner's systems.
3. How can compromised API keys be abused?
API keys are credentials that let an outside application connect to an exchange account and carry out actions, such as placing trades, on the account holder's behalf. Because the key stands in for a fresh login, anyone who obtains it may be able to use it as the legitimate application would.
Exchanges typically let users set the permissions attached to a key, and withdrawals are often switched off for that reason. Even so, a breached key can still be used to make unauthorized trades. An attacker with trading access could open or close positions, change open orders or move a portfolio in ways the owner never intended, which can produce real financial losses without a single coin leaving the account.
For options traders in particular, unexpected orders or altered positions can carry significant risk, since derivatives can change in value quickly. This is why Binance asked SignalPlus users to review their positions and orders on the exchange itself instead of relying on the third-party interface, which may be affected by the issue.
4. What did Binance and CZ tell users to do?
Binance gave its users several concrete instructions. Those who connected through SignalPlus should log in to the exchange directly, inspect their trading positions and open orders, and avoid reconnecting API keys until SignalPlus confirms that the issue is fixed.
The exchange also recommended IP whitelisting, a setting that limits API access to a list of approved internet addresses. With it enabled, a stolen key cannot be used from an unrecognized location, which narrows what an attacker can do. Binance further urged other connected platforms to review their own security controls.
Binance co-founder Changpeng Zhao, widely known as CZ, widened the warning beyond Binance. In a post on X he told users who connect SignalPlus to any other exchange that it was time to revoke all of their API keys. He said the exchange Deribit had also reported the issue, and he advised traders not to store API keys with third-party platforms at all.
5. Why does the timing matter after the October 29 theft?
The alert arrives a week after Binance was hit by what has been described as the largest crypto hack on record. On October 29, attackers drained roughly $6 billion from the exchange after a months-long campaign, which was reported to have begun with a fake job interview. About half of the stolen funds were later frozen by Tether, Circle and others.
That context raises the stakes for any new security notice involving the exchange, even one that, according to Binance, concerns a separate company. Users who have just watched a record theft are likely to be more alert to warnings about account access, and the exchange has an incentive to act early and visibly when a partner reports a problem.
It is important to separate the two events. Binance has not linked the SignalPlus matter to the October theft, and it has said its own systems were not touched this time. The shared backdrop is the heightened attention to exchange security rather than evidence of a connection.
6. What should traders do next?
Several points follow from the notices. Anyone who linked SignalPlus to Binance should verify their live positions and open orders on the exchange and keep the connection disabled until SignalPlus gives the all-clear. Anyone who linked it to Deribit or another venue should consider revoking those keys as well, in line with the guidance from CZ.
More broadly, traders can reduce exposure by granting keys only the permissions they need, keeping withdrawals disabled, restricting each key to approved IP addresses and deleting keys that are no longer in use. Treating third-party connections as a risk to be managed, not a fixed convenience, is the main lesson of the episode.
What remains unresolved is the cause and scope of the issue at SignalPlus. Neither the platform nor the exchanges have publicly said how many users were involved, whether any unauthorized trades took place or when connections will be restored. Binance has said keys should stay disconnected until SignalPlus confirms a resolution, so that confirmation is the next development to watch.
7. How do options traders use platforms like SignalPlus?
An option is a contract that gives its holder the right, though not the obligation, to buy or sell an asset at a set price before a set date. Options traders use these contracts to speculate on price swings, to protect holdings against losses or to earn premiums, and the strategies can involve several contracts held at once, each with its own strike price and expiry.
Managing such a book is data-heavy. A trader may need to watch how the value of every position responds to price changes, to time and to volatility, and may want to adjust many legs quickly. Specialist platforms exist to collect those figures, present them in one view and help execute orders across the venues where the contracts are listed. To do this work, the platform has to be able to read account data and send instructions to the exchange.
That dependence explains why a problem at a tools provider is taken seriously. The platform may hold keys for many accounts at once, so a single weakness can touch a large number of traders across different exchanges simultaneously, which is why Binance acted on all of the keys instead of reviewing them one at a time.
8. Why do exchanges treat third-party connections as a risk?
An exchange can harden its own servers, staff access and wallet storage, but it has little control over the systems of the companies that receive its API keys. Each partner that stores keys becomes part of the chain of trust, and the weakest link determines how safe the whole arrangement is.
For that reason, exchanges generally offer controls that let users limit the damage if a key leaks. Permissions can be restricted so that a key may read balances but not trade, or trade but not withdraw. Address allow-lists tie a key to specific servers. Keys can also be deleted in an instant by the account holder, which ends the connection without affecting the rest of the account.
The Binance response combines these ideas. By revoking the keys on its side, the exchange did not wait for each user to act, and by recommending IP whitelisting it pointed to a setting that makes a stolen credential harder to exploit. The call from CZ to avoid keeping keys with outside providers goes a step further, suggesting that the safest key is the one that was never handed over.
9. What does IP whitelisting actually change?
Every device connected to the internet reaches a service from an address. With IP whitelisting enabled, the exchange accepts requests made with a given key only when they come from an address the user has approved in advance. A request that carries the right key but arrives from an unknown address is refused.
This matters in a scenario like the current one. If a key were taken from a provider's systems, the thief would normally operate from different servers than the provider's, so the allow-list would block the attempt. The control is not a complete defense, since an attacker who controls the approved servers could still send requests, but it removes a large share of easy abuse.
Users can pair the setting with narrow permissions and routine key rotation. Together these habits mean that a leaked credential has a short life, limited powers and a restricted route for use, which is the practical goal behind the exchange's advice.