The SignalPlus hack was small and contained, by the company’s own account. SignalPlus, a Hong Kong-based crypto options trading platform, said in a post on X on Thursday 5 November that an intruder had broken into its internal network in the early hours of Wednesday 4 November and taken less than $82,000 from a small number of user accounts. The company says it is paying the money back. The same day, Binance and Deribit revoked the customer API keys linked to SignalPlus as a precaution, cutting the tool off from accounts on both exchanges.
That is the whole of the incident as the three companies describe it. Neither exchange reports a breach of its own systems: Binance wrote that “Binance’s own systems are unaffected” and that “User funds remain safe”, according to CryptoPotato, and Deribit said it had no indication its systems or data were affected. No company, investigator or security firm has named an attacker, and no source links the SignalPlus intrusion to the far larger Binance hack of 29 October.
A note on sourcing. The statements of SignalPlus, Binance and Deribit were published on X, which we could not open. What follows relies on outlets that quote or embed them, chiefly crypto.news, CryptoPotato, CoinInsider and Bitcoin.com News, plus Binance’s own news summary.
SignalPlus hack: under $82,000 lost, reimbursements under way
SignalPlus put its losses at “less than $82,000”, crypto.news reports. Only accounts that had not set IP whitelisting on their exchange API keys were hit, and the company spoke of “a small number of accounts” without giving a figure. It says it has started reimbursing affected users case by case and has pledged to repay all of them. Users who think they lost funds are asked to contact SignalPlus so it can check their claim.
The firm also admitted a gap in its own setup. It had not made IP whitelisting mandatory for the exchange keys its users connected. “We take responsibility for this oversight,” SignalPlus wrote, as quoted by crypto.news. Its services are suspended in maintenance mode while it runs a security review, with a phased return expected “over the next few days”, crypto.news reports. No date has been given.
SignalPlus also told users that a disabled key does not mean the linked exchange account or its assets were compromised, according to CoinInsider. The revocations were applied across all connected accounts, whether or not they were touched.
A hijacked Telegram account, a fake Teams invite and one engineer’s computer
By SignalPlus’s own account, the attack did not start at SignalPlus. It started with the Telegram account of a contact at a third-party technology vendor, which the attacker had taken over. The vendor is not named.
Posing as that contact, the attacker sent a SignalPlus engineer an invitation to a Microsoft Teams meeting. The invitation was fake, and accepting it compromised the engineer’s computer. The intruder then stayed quiet for a while. In the early hours of 4 November, it began using the engineer’s access rights to move into the company’s internal network. SignalPlus says its team spotted the activity, blocked it and closed the openings it had used.
The company lists the fixes it plans: stricter requirements for API access, stronger security on development devices, tighter internal access controls and changes to how keys are managed. It also says it will share more threat information with exchanges, technology partners and security firms.
Several points are missing from the statements. SignalPlus has not said which malware was used, how many users were affected, or whether customer API keys or their secrets were copied. Bitcoin.com News notes that it has not been established whether attackers accessed customer credentials.
Binance and Deribit cut the keys, and CZ told users to revoke theirs elsewhere
SignalPlus runs on exchange APIs. Customers keep their assets on the exchange and give the tool a key that lets it read balances and place orders for them. SignalPlus, formed in 2021, offers options trading dashboards for Deribit, Binance, Bybit, OKX and Coincall, according to CryptoPotato, and Bitcoin.com News describes it as a fintech offering AI-assisted trading tools, options analytics and execution.
Once SignalPlus reported the problem, Binance removed all API keys tied to it as an immediate precaution, Binance’s news summary says. It asked SignalPlus users to log in to Binance directly to check positions and open orders, to wait until SignalPlus confirms full resolution before connecting any key again, and to turn on IP whitelisting. It also asked every third-party platform integrated with Binance to review its security controls, watch for unusual activity and contact the exchange about any concern. Binance co-founder Yi He passed on the same request, according to crypto.news.
Deribit, a major venue for crypto options and futures, did the same on 5 November. It revoked the customer API keys connected to SignalPlus, and warned that trading, monitoring and automation run through the tool on Deribit had stopped. Its advice to users matched Binance’s: check orders and positions, enable IP allowlisting, wait for SignalPlus.
Binance co-founder Changpeng Zhao went further on X. “If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys,” he wrote, as quoted by CryptoPotato. He added that it is generally recommended not to store API keys with any third-party platform, Bitcoin.com News reports. No source says Bybit, OKX or Coincall have revoked SignalPlus keys on their side, so on those venues the job is the user’s.
No link to the Binance hack of 29 October
The timing invites a connection, and the sources do not make one. Bitcoin.com News says Binance describes no established link between the SignalPlus issue and the October theft, and that no evidence ties the two together. The October breach hit Binance’s own wallet infrastructure; this one concerns keys held by an independent tool. Binance’s 3 November post-mortem described fake recruitment interviews, malicious development software and a compromised internal AI tool, crypto.news recalls. The FBI has attributed the October theft to North Korea’s TraderTraitor. Nobody has attributed the SignalPlus intrusion to that group or to any other.
| Date (2026) | Event | Source |
|---|---|---|
| 29 October | Binance hot-wallet theft, about $6.3 billion; no link to SignalPlus established | Bitcoin.com News |
| 4 November, early hours | Intruder uses a SignalPlus engineer’s access to reach the internal network; blocked | SignalPlus via crypto.news |
| 5 November | Binance and Deribit revoke all SignalPlus-linked API keys; SignalPlus reports losses under $82,000 | Binance, Deribit, SignalPlus via CryptoPotato, crypto.news |
| 6 November | SignalPlus services still suspended, phased return expected, no date | CoinInsider |
What API-key users should check now: revoke, rotate, whitelist
An API key is a permission slip. Whoever holds it can do on your exchange account whatever the key allows, without logging in and without a second factor. That is the trade-off behind every trading bot, portfolio tracker and options dashboard, and the reason our guide to how centralized exchanges work treats account access as part of custody.
For readers who connected SignalPlus or any similar tool, the steps that follow from the exchanges’ advice are plain:
- Open the API management page of each exchange you used with the tool and delete any key you no longer need, including keys on venues that have not acted, such as Bybit, OKX or Coincall.
- If you reconnect a tool later, create a new key rather than reusing an old one, and do it only after the provider confirms the problem is fixed, as Binance and Deribit ask.
- Restrict each key to a short list of IP addresses (whitelisting, or allowlisting at Deribit). SignalPlus says only accounts without it were hit.
- Leave withdrawal permission switched off. A dashboard or execution tool needs to read and trade, not to move funds out.
- Check open orders and positions directly on the exchange, since automated orders placed by the tool may still be live.
Exchanges have cut off a tool like this before. In late 2022 users of the trading bot provider 3Commas reported unauthorised trades on their FTX and Binance accounts. On 11 December its CEO, Yuriy Sorokin, disputed screenshots that blamed the company. On 28 December, the day Zhao said he was “reasonably sure” 3Commas keys had leaked, Sorokin confirmed that files leaked by a hacker were genuine and asked Binance, KuCoin and other exchanges to revoke all keys connected to 3Commas, Cointelegraph reported. In October, Japan’s GMO Internet cyberattack involved logins saved on rented trading servers. The risk sits with whoever stores the keys, and the IP restriction is what limits the damage when they leak.
How fake-meeting malware works, according to Mandiant
No source ties the SignalPlus intruder to a known group, and its statement names no malware. The technique it describes, though, is well documented. In a report published on 9 February 2026, Google’s Mandiant described an attack on a crypto fintech by UNC1069, a financially motivated actor it says is “suspected with high confidence to have a North Korea nexus”.
In that case the victim was approached from the hijacked Telegram account of a crypto executive. After some friendly exchanges came a Calendly link to a 30-minute call on a spoofed Zoom page. During the call, a fake audio fault prompted the victim to paste “troubleshooting” commands into the computer, a trick known as ClickFix. Those commands installed malware. Mandiant counted seven malware families on one macOS machine, which stole Keychain credentials, browser cookies and saved logins, and Telegram data.
Mandiant’s report concerns Zoom, not Teams, and a different victim. The pattern is what matters for readers: a trusted contact’s account, a meeting link, then a request to run or install something. Checking an unexpected invitation through a second channel, and refusing any “fix” that asks you to paste a command, cuts that chain early.
What SignalPlus has not said yet
SignalPlus has not named the vendor whose contact was impersonated, or the malware. It has not said how many accounts were hit, how much it has repaid so far, or whether any API secrets left its systems. It has not given a date for its services to return, and no other exchange has said whether it acted. Binance and Deribit have asked users to wait for SignalPlus to confirm full resolution before reconnecting. Until SignalPlus confirms it, any key re-linked to the tool is one the exchanges have asked users not to create.