SignalPlus breached via fake Teams invite; Binance and Deribit revoke linked API keys
SignalPlus (crypto options / derivatives trading terminal)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Crypto options/derivatives terminal SignalPlus disclosed on Nov 5 2026 that attackers compromised an engineer through a fake Microsoft Teams invitation sent from a third-party vendor contact's hijacked Telegram account, then used that foothold against SignalPlus's internal network in the early hours of Nov 4. SignalPlus says total losses are under US$82,000, it is reimbursing affected users in full, and it has paused terminal services while it reviews security. As a precaution Binance and Deribit revoked all API keys linked to SignalPlus; both say their own systems were unaffected. SignalPlus acknowledges it had not made IP whitelisting mandatory for exchange API access. Users should manage positions on the exchanges directly and wait for SignalPlus before reconnecting API keys.
Why this severity: Exchange-linked API keys revoked across Binance and Deribit; SignalPlus reports under US$82k losses with full reimbursement and services paused; root cause was vendor Telegram compromise + fake Teams invite, plus missing mandatory IP whitelisting
- Started
- Nov 4, 2026
Affected
- SignalPlus terminal users whose exchange API keys were linked without IP whitelisting; all SignalPlus-linked API keys on partner CEXes were revoked as a precaution
Fixed in
- Intrusion contained Nov 4 2026; partner exchange API keys revoked; SignalPlus services in maintenance pending phased restore
Timeline3
Binance announces it has removed all API keys linked to SignalPlus as a precaution; CZ urges users to revoke SignalPlus API keys on other exchanges too. Deribit also revokes SignalPlus-linked keys. Both say their own systems were unaffected.
SignalPlus publishes its incident response: losses under US$82k, full reimbursement underway, services paused, and admission that IP whitelisting was not mandatory for exchange API access.
Attacker uses a compromised third-party vendor Telegram account to send a SignalPlus engineer a fake Microsoft Teams invite, compromises the engineer machine, then pivots into SignalPlus's internal network; SignalPlus detects and contains the activity the same day and contacts exchange partners.
Advisories2
News & write-ups2
Posts3
TL;DR: In the early hours of Nov 4, SignalPlus was targeted in an attack that began with a compromised third-party Telegram account, affecting a small number of accounts without IP whitelisting. We detected and contained the intrusion quickly. As a precaution, we immediately worked with our CEX partners to revoke all SignalPlus-linked API keys and temporarily paused our terminal services. Total losses are under US$82k, and all affected users will be reimbursed in full. We expect to bring services fully back online over the next few days. Updates and user instructions will be shared through our official channels.
Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure. Binance's own systems are unaffected. User funds remain safe. If you used SignalPlus, please
If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys. It is generally recommend that you do not store your API keys with any 3rd party platform. (Deribit also/first reported this.)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
