# SignalPlus breached via fake Teams invite; Binance and Deribit revoke linked API keys · pwn.watch > Crypto options/derivatives terminal SignalPlus disclosed on Nov 5 2026 that attackers compromised an engineer through a fake Microsoft Teams invitation sent from a third-party vendor contact's hijacked Telegram account, then used that foothold against SignalPlus's internal network in the early hours of Nov 4. SignalPlus says total losses are under US$82,000, it is reimbursing affected users in full, and it has paused terminal services while it reviews security. As a precaution Binance and Deribit revoked all API keys linked to SignalPlus; both say their own systems were unaffected. SignalPlus acknowledges it had not made IP whitelisting mandatory for exchange API access. Users should manage positions on the exchanges directly and wait for SignalPlus before reconnecting API keys. Page: https://pwn.watch/i/signalplus-telegram-teams-social-engineering-api-keys-nov-2026 · generated 2026-11-06T09:14:27.660Z ## Status - Severity: high · status: live · patch: partial - Product: SignalPlus (crypto options / derivatives trading terminal) - Started: 2026-11-04 - Affected: SignalPlus terminal users whose exchange API keys were linked without IP whitelisting; all SignalPlus-linked API keys on partner CEXes were revoked as a precaution - Fixed in: Intrusion contained Nov 4 2026; partner exchange API keys revoked; SignalPlus services in maintenance pending phased restore ## Follow this incident - RSS (one item per update): https://pwn.watch/i/signalplus-telegram-teams-social-engineering-api-keys-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/signalplus-telegram-teams-social-engineering-api-keys-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/signalplus-telegram-teams-social-engineering-api-keys-nov-2026.json - This file: https://pwn.watch/i/signalplus-telegram-teams-social-engineering-api-keys-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: Binance announces it has removed all API keys linked to SignalPlus as a precaution; CZ urges users to revoke SignalPlus API keys on other exchanges too. Deribit also revokes SignalPlus-linked keys. Both say their own systems were unaffected. (https://x.com/binance/status/2118295116716589383) - 2026-11-05: SignalPlus publishes its incident response: losses under US$82k, full reimbursement underway, services paused, and admission that IP whitelisting was not mandatory for exchange API access. (https://x.com/SignalPlus_Web3/status/2118334759697068490) - 2026-11-04: Attacker uses a compromised third-party vendor Telegram account to send a SignalPlus engineer a fake Microsoft Teams invite, compromises the engineer machine, then pivots into SignalPlus's internal network; SignalPlus detects and contains the activity the same day and contacts exchange partners. (https://x.com/SignalPlus_Web3/status/2118334759697068490) ## Fix brief # Security brief: SignalPlus breached via fake Teams invite; Binance and Deribit revoke linked API keys Source: https://pwn.watch/i/signalplus-telegram-teams-social-engineering-api-keys-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 08:53 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Crypto options/derivatives terminal SignalPlus disclosed on Nov 5 2026 that attackers compromised an engineer through a fake Microsoft Teams invitation sent from a third-party vendor contact's hijacked Telegram account, then used that foothold against SignalPlus's internal network in the early hours of Nov 4. SignalPlus says total losses are under US$82,000, it is reimbursing affected users in full, and it has paused terminal services while it reviews security. As a precaution Binance and Deribit revoked all API keys linked to SignalPlus; both say their own systems were unaffected. SignalPlus acknowledges it had not made IP whitelisting mandatory for exchange API access. Users should manage positions on the exchanges directly and wait for SignalPlus before reconnecting API keys. Severity detail: Exchange-linked API keys revoked across Binance and Deribit; SignalPlus reports under US$82k losses with full reimbursement and services paused; root cause was vendor Telegram compromise + fake Teams invite, plus missing mandatory IP whitelisting - Product: SignalPlus (crypto options / derivatives trading terminal) ## Affected versions - SignalPlus terminal users whose exchange API keys were linked without IP whitelisting; all SignalPlus-linked API keys on partner CEXes were revoked as a precaution ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Intrusion contained Nov 4 2026; partner exchange API keys revoked; SignalPlus services in maintenance pending phased restore After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes SignalPlus users: manage positions/orders on Binance, Deribit and other CEXes directly; do not reconnect SignalPlus API keys until SignalPlus says it is safe; enable IP whitelisting on any new API keys. Binance/Deribit say their systems were not breached. ## Latest updates - Nov 5, 2026: Binance announces it has removed all API keys linked to SignalPlus as a precaution; CZ urges users to revoke SignalPlus API keys on other exchanges too. Deribit also revokes SignalPlus-linked keys. Both say their own systems were unaffected. - Nov 5, 2026: SignalPlus publishes its incident response: losses under US$82k, full reimbursement underway, services paused, and admission that IP whitelisting was not mandatory for exchange API access. - Nov 4, 2026: Attacker uses a compromised third-party vendor Telegram account to send a SignalPlus engineer a fake Microsoft Teams invite, compromises the engineer machine, then pivots into SignalPlus's internal network; SignalPlus detects and contains the activity the same day and contacts exchange partners. ## Advisories - [SignalPlus Announcement on Security Incident Response and User Protection](https://x.com/SignalPlus_Web3/status/2118334759697068490) (SignalPlus) - [SignalPlus incident TL;DR (losses under US$82k; API keys revoked; services paused)](https://x.com/SignalPlus_Web3/status/2118334613374329154) (SignalPlus) ## Write-ups & news - [Binance cuts SignalPlus access after security warning, urges users to check accounts](https://www.coindesk.com/tech/2026/11/05/binance-cuts-signalplus-access-after-security-warning-urges-users-to-check-accounts) - [SignalPlus admits API security gap after hack costs under $82K](https://crypto.news/signalplus-hack-82k-binance-deribit-api-keys/) --- Machine-readable: https://pwn.watch/i/signalplus-telegram-teams-social-engineering-api-keys-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.