Binance revokes Signalplus API keys after security alert

Key points

• Binance revoked every API key tied to Signalplus on 5 Nov 2026 as a precaution after the platform reported a possible security problem.
• Changpeng Zhao urged traders to revoke Signalplus API keys on other exchanges too, and advised against storing keys with third parties.
• The move came a week after Binance's 29 Oct 2026 breach, put at $6.34bn, with no evidence linking the two incidents.

Affected users were told to check positions and open orders directly in their accounts and to wait for Signalplus to confirm a fix before reconnecting.

Signalplus is a Hong Kong-based fintech offering AI-enabled trading tools, options analytics and execution services. Its software connects to exchanges through APIs, letting customers trade without moving assets off the exchange. Binance advised users to enable IP whitelisting, which limits API access to approved addresses, and asked other integrated platforms to review their security controls.

Binance founder Changpeng Zhao widened the warning, telling users of Signalplus on other exchanges to revoke their API keys and advising against storing keys with any third party. He cited Deribit, which he said had reported the concern. Co-founder Yi He repeated that Binance's systems were unaffected. The nature of the suspected vulnerability, and whether credentials were accessed, has not been established publicly.

The precaution came a week after Binance's 29 Oct 2026 breach, in which attackers reportedly compromised 17 hot wallets and about $6.34bn was stolen. The FBI attributed that theft to North Korea's TraderTraitor group, which North Korea denied.

What to watch: Signalplus customers are advised to wait until the platform confirms the issue is resolved before setting up new API connections.

Read the full story on Bitcoin.com News →