Binance revokes SignalPlus API keys after third-party security warning

What happened

Binance has revoked every API key connected to SignalPlus after the third-party trading platform reported a potential security issue, a step the exchange described on Thursday as an immediate precaution. Binance said its own systems were not affected and that customer funds remained safe.

API keys are the credentials that let outside applications and trading tools reach a user's exchange account and place orders on their behalf. With the keys removed, the link between Binance accounts and SignalPlus is severed, and any automated strategies running through that connection will stop until users generate new credentials.

The exchange advised people who had used SignalPlus to sign into their Binance accounts directly to review positions and open orders. It also recommended holding off on rebinding any API keys until SignalPlus confirms the matter is fully resolved, and switching on IP whitelisting, which restricts a key to approved internet addresses.

Binance further called on other third-party platforms integrated with it to examine their security controls, monitor for unusual activity and get in touch straight away if they detect anything concerning. Both Decrypt and U.Today reported the exchange's statement.

Why it matters

The move highlights how much crypto trading now depends on outside infrastructure. Platforms such as SignalPlus sit between traders and exchanges, handling execution, analytics and automation, and the credentials that make that possible can, depending on permissions, allow unauthorized trading if they are exposed. Cutting the connection is disruptive but limits exposure while the cause is investigated.

For traders running automated strategies on Binance through SignalPlus, the practical effect is immediate: those strategies stop until fresh keys are issued and bound. The episode also puts pressure on other integration partners to show that their controls are sound, at a moment when Binance's own security is under intense scrutiny.

What the data shows

Binance's disclosure put the October 29 loss at about $6.4 billion, with roughly 98% of assets already replenished from the exchange's own reserves. The expanded proof-of-reserves covers 44 tokens rather than 10, and the zero-knowledge proof needed for verification is expected in about 50 to 60 hours. Precedent exists for API-related scares: in 2022, exposed credentials linked to the trading platform 3Commas prompted warnings and key revocations at several exchanges.

Background

The revocation lands a week after Binance suffered the largest hack in crypto history, in which attackers drained roughly $6.4 billion from its hot wallets on October 29. The FBI has attributed the theft to North Korean hackers it refers to as TraderTraitor, an allegation Pyongyang has denied.

According to Binance, the intrusion began when a fake recruiter convinced one of its engineers to download a coding assignment carrying malware, after which the attackers used stolen credentials to reach an internal wallet signing service. On Wednesday the exchange said it had restored about 98% of the stolen assets from its own funds and was still purchasing the remainder, largely less liquid tokens, through market and over-the-counter channels. It has also published a new proof-of-reserves snapshot covering 44 tokens, up from 10, which users will be able to check once a zero-knowledge proof is generated in roughly 50 to 60 hours. Services are still being restored, with withdrawals for more assets reopened in phases on Thursday based on user demand over the past week; deposits remain open.

What is still unclear

Neither company has explained what the SignalPlus issue actually is. The size of the potential vulnerability and the number of users affected have not been made public, and there is no confirmation that anyone reached customer accounts or that money was lost. Binance has not said when it would allow SignalPlus integrations to resume.

What to watch

The next signal will be a statement from SignalPlus confirming that the problem is resolved, which Binance has set as the condition for users to rebind keys. Also worth tracking: whether Binance names any other integration partners affected, how quickly its own withdrawal backlog clears, and whether the expanded proof-of-reserves verification goes live on the stated timeline.

Questions readers ask