Binance, Deribit Cut SignalPlus API Keys After Fake Teams Attack

A fake Teams invite, sent from a hijacked Telegram account, was all it took to knock a derivatives trading tool offline at two of the biggest crypto exchanges. Binance and Deribit both pulled every API key tied to SignalPlus on Thursday, and the firm's traders now have to check their positions by hand until the tool comes back.

Key points:

• Binance and Deribit removed every API key linked to SignalPlus after the trading tool said an attacker got in through a fake Microsoft Teams invite.
• SignalPlus says user losses stayed under $82,000 and it has started paying affected traders back in full.
• Binance founder CZ told traders to pull SignalPlus keys on every other exchange too, not just Binance and Deribit.

The attack took days, and it started with a chat message

SignalPlus told its own story in a post on X at 13:29 UTC on Thursday, November 5. An attacker first took over the Telegram account of a contact at a third-party tech supplier. Posing as that contact, the attacker chatted with a SignalPlus engineer and sent a fake invite to a Microsoft Teams video meeting. The invite was the way in. The engineer's computer was compromised, and the intruder went quiet.

In the early hours of Wednesday, November 4, the attacker used the access on that computer to hit SignalPlus's internal network. The firm says it spotted the activity, blocked the attack and patched the weak spots it found. It then told the exchanges, and from the exchange side every API key tied to SignalPlus was switched off. SignalPlus has paused its own services and says it will bring them back over the next few days, once its security reviews and patches are done.

Read also: CZ Wants Crypto Security Alliance After $6.3B Binance Hack — Will Firms Join?

The exchanges moved fast, and CZ went further

Binance posted at 10:51 UTC that it had removed all keys tied to SignalPlus as an immediate precaution, after the platform reported a possible security issue. Its own systems were unaffected, it said, and user funds stayed safe. Deribit did the same and warned that trading, monitoring and automation through SignalPlus had stopped working for its customers. Both exchanges told SignalPlus users to log in directly and check their positions and open orders, and to wait for the all-clear before linking any new keys.

CZ, the Binance founder, went a step further at 11:05 UTC. "If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys," he wrote on X. That matters because SignalPlus, formed in 2021, runs options trading screens for Deribit, Binance, Bybit, OKX and Coincall. Binance co-founder Yi He added that third-party platforms tied to the exchange should review their security controls and watch for odd activity, warning that the threat went past any single firm.

My own read is simple: The $82,000 loss is not the story. The missing IP whitelist is. SignalPlus admitted it had never made IP whitelisting a must for exchange API access. "We take responsibility for this oversight," the firm said, and it now plans to tighten API access rules and firm up its internal security. An API key is the code that lets an outside app trade on your exchange account, and IP whitelisting is the rule that says only a set list of approved internet addresses can use it. Without that rule, a stolen key works from anywhere.

The $82,000 figure comes with a catch

Here is the part traders should not skip. The $82,000 loss figure comes from SignalPlus itself, and the account of how the attack worked comes from the firm too. No outside investigator has yet confirmed the method, and the reimbursement is a pledge that has started, not a finished payment to every user. SignalPlus says the hit accounts were the ones without IP allowlisting, and that it is paying them back case by case. Treat the number as a strong signal, not an audited fact, and watch for proof that every affected trader actually gets paid.

There is a second catch. Binance and Deribit both say their own systems were not touched, and that is good news. But a clean exchange does not help a trader whose own keys were tied to a hacked tool. A stolen API key can place trades you never asked for, even when withdrawals are switched off. That is why the exchanges cut the keys first and asked questions later.

This is the same playbook as the $6.3 billion Binance hack

The SignalPlus break-in lands one week after Binance said hackers took $6.3 billion from its hot wallets on October 29, the biggest crypto theft on record. That attack also started with a compromised employee computer. In its postmortem, Binance said attackers posing as recruiters tricked an engineer into downloading a bad file dressed up as a coding test, then used that computer to reach more systems and finally the wallet setup. The FBI has tied those attackers to North Korea's TraderTraitor group, and Yi He said on Tuesday that Binance had spotted and stopped 57 suspected North Korea-linked threats in 2026, from fake job interviews to bad software packs and tries to steal staff logins.

The two attacks are not the same event, and no link between them has been shown. But the method rhymes. No smashed servers, no broken passwords, just one person tricked into opening one bad file or joining one fake meeting. Traders have seen this before, too. In late 2022, users of the tool 3Commas reported trades they never placed on FTX and Binance accounts, and the firm later admitted the leaked customer API keys had come from 3Commas. The lesson keeps repeating, and the bill keeps getting paid by traders.

Check your own API keys now

Start with three facts, and write them down before you change anything. First, which exchanges have API keys tied to SignalPlus, or to any third-party tool. Second, whether IP whitelisting is switched on for each key. Third, what your open orders and positions look like right now, so you can spot a trade you never placed. If you use SignalPlus on any exchange, pull those keys now, as CZ said, and do not link new ones until SignalPlus says its services are fully back and safe.

Then watch three things. Watch for SignalPlus to name a date for full service, not just "the next few days." Watch for proof that the reimbursements are done, not just started. And watch whether other exchanges that work with SignalPlus, like Bybit, OKX or Coincall, say anything of their own. Until the tool is back and the money is paid, treat every SignalPlus-linked key as dead, and check your positions by hand.

Read also: $106M Vanishes From EU Entity Exchange Accounts in Suspected Theft

— BitByLine News Desk

This post is news only, not financial advice. BitByLine never tells anyone to buy or sell crypto. That call is always yours, and the risk is yours too. Always do your own research first. Read our full Disclaimer.

Sources: Cointelegraph, CoinDesk.