Binance Removes All SignalPlus API Keys After Reported Security Issue
Binance removed all API keys linked to SignalPlus after the platform reported a potential security issue. What users should do now.
Binance has removed all API keys linked to SignalPlus, the Hong Kong-based crypto options trading platform, after SignalPlus reported a potential security issue. The exchange announced the move on Thursday, November 5, and said its own systems are unaffected and user funds remain safe.
Removing the keys cuts the link between SignalPlus and users’ Binance accounts, so any automated trading strategy running through the platform has stopped, Decrypt reported.
What Binance told users
Binance asked anyone who used SignalPlus to log in to their Binance account directly and review their positions and open orders. It recommended waiting until SignalPlus confirms the issue is fully resolved before connecting any new API keys, and always turning on IP whitelisting, which limits a key to approved internet addresses.
The exchange also urged every third-party platform connected to Binance to review its security controls, watch for unusual activity and contact Binance at once if it sees a problem.
Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure.Binance’s own systems are unaffected. User funds remain safe.If you used SignalPlus, please log into your Binance account directly to review your positions and open orders. We recommend waiting until SignalPlus confirms full resolution before rebinding any API keys, and always enabling IP whitelisting.We also encourage all third-party platforms integrated with Binance to review their security controls, monitor for unusual activity and contact us immediately if they detect any concern
— Binance (@binance) November 5, 2026
CZ tells users on other exchanges to act
Binance founder Changpeng Zhao, known as CZ, quoted the announcement about 14 minutes later. He told SignalPlus users on other exchanges that “it’s time to revoke all your API keys,” according to crypto.news. He also advised against storing API keys on any third-party platform, and said Deribit had reported the problem earlier, according to Taiwan outlet ABMedia. WuBlockchain reported that Deribit has also revoked connected keys.
What is still unknown
Binance did not say what kind of problem SignalPlus reported. Reports on Thursday said SignalPlus had not yet explained the incident publicly, and no losses have been reported. The notices describe a potential issue, not a confirmed account takeover.
SignalPlus provides crypto options trading and risk tools, and it connects to several exchanges, with Binance among them. Users give it API keys so it can place trades on their behalf.
How this differs from the October hack
The incident is separate from the October 29 theft of about $6.3 billion from Binance itself, which the FBI has attributed to North Korea. This time the reported weak point is a third-party tool, not Binance’s own systems. Binance is still working to restore confidence after that attack, as we covered in our report on its claim to have replaced 98% of affected assets.
What traders can do now
- Check open positions and orders on each exchange you linked to SignalPlus.
- Delete the SignalPlus API keys on exchanges other than Binance, as CZ advised.
- Do not reconnect until SignalPlus confirms the problem is fixed.
- When you create new keys, turn on IP whitelisting and grant only the permissions the tool needs. Withdrawal access is rarely required.
This story is developing, and we will update it when SignalPlus or the exchanges say more.
