This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.

Binance and Deribit revoked all SignalPlus API keys after a security alert. Binance said its own systems were unaffected and customer funds remained safe.

15 outlets in this story. Read their headlines below.

API Keys Cut Off

Binance revoked all API keys tied to SignalPlus after the Hong Kong-based trading infrastructure provider flagged a possible security issue, and the exchange said its internal systems were not affected while user funds remained safe. Binance founder Changpeng Zhao urged: "If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys," and Binance co-founder Yi He said every third-party platform integrated with the exchange should audit its security controls and watch for anomalous behavior. Deribit also removed SignalPlus-linked connections, and Deribit said its own investigation had so far found no sign that its systems or data were compromised.

Binance advised SignalPlus users to log in directly to check positions and open orders, to hold off reconnecting until the platform confirms the matter is fully closed, and to switch on IP whitelisting, which limits a key to pre-approved internet addresses. The SignalPlus disruption halted automated strategies routed through the third-party platform, because revoking API keys severs the credentials that let outside software reach into an exchange account and place orders on the user's behalf.

Fake Teams Invite

SignalPlus said an attacker used an engineer's access privileges after the company detected and contained the intrusion, and SignalPlus reported total losses of less than $82,000 while it began fully reimbursing affected users. SignalPlus traced the initial compromise to a Telegram account belonging to a contact at one of its third-party technology vendors, and SignalPlus said the attacker impersonated the contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer. SignalPlus said the attacker remained dormant on the compromised computer before using the engineer's access privileges to target SignalPlus's internal network early Wednesday, and SignalPlus said it expected to restore operations over the next few days after completing security reviews and applying patches.

SignalPlus acknowledged that it had not required IP whitelisting for exchange API access and said: "We take responsibility for this oversight," while it tightened API access requirements and strengthened internal security controls. Binance and Deribit warned that trading, monitoring, and automation through SignalPlus had stopped working for customers after the API key revocations, while customers could still use the exchanges' official platforms to view and manage accounts, positions, and open orders.

Aftermath and Scrutiny

The SignalPlus API-key revocation landed a week after Binance disclosed an October 29 hack in which attackers drained roughly $6.4 billion from its hot wallets, and the FBI attributed the theft to North Korean hackers it tracks as TraderTraitor. Binance said the breach began when a fake recruiter induced an engineer to download a malware-laced coding exercise, and Binance said stolen credentials were used to reach an internal wallet signing service. Binance said it had rebuilt about 98% of the stolen assets from its own reserves and was still acquiring the remainder, largely less liquid tokens, through market and over-the-counter channels.

Binance also expanded a proof-of-reserves snapshot to 44 tokens from 10, and Binance said withdrawals were reopening in phases by asset while deposits stayed open. Binance and Deribit framed the SignalPlus action as precautionary, with Binance telling integrated platforms to review security controls, monitor for unusual activity, and report concerns promptly, while SignalPlus had not publicly detailed the flaw or set a timeline for restoring connections.