Binance cuts all SignalPlus API keys after third-party security warning

Binance has revoked every customer API key linked to SignalPlus, the Hong Kong-based options and derivatives trading platform, after SignalPlus reported a "potential security issue" on Thursday November 5, 2026. Binance posted on X that its own systems and user funds are "unaffected" and that the cut is an "immediate precautionary measure" until SignalPlus confirms the incident is resolved. Automated trading strategies that routed through SignalPlus will halt until users create new keys. Primary sources: CoinDesk and Decrypt.

What happened

Binance took the API cut unilaterally — i.e., without waiting for SignalPlus to complete its own forensic review — and told users to:

1. Log in to Binance directly and check their current positions and open orders.
2. Wait for SignalPlus to confirm the issue is resolved before reconnecting any API keys.
3. Enable IP whitelisting on any new keys they do create, so that API traffic can only originate from pre-approved addresses.

Neither Binance nor SignalPlus has quantified any funds moved, accounts touched, or endpoints compromised. Binance has not said whether it detected anomalous SignalPlus-originated traffic, or whether the cut is based purely on SignalPlus's own disclosure. SignalPlus itself has not issued a public post-mortem at the time of writing.

Mechanism — API-key compromise paths

A third-party trading platform that holds an exchange API key is, by design, an authenticated delegate: it can place orders, transfer within the account, and (if the key was granted withdrawal permission) move funds off-exchange. The API-key pathway is the standard escalation target in a third-party compromise, because the exchange's own hot wallets and matching engine don't have to be touched. Every API-key compromise in the past three years at this scale has gone through one of three paths:

1. Stored keys at the third party. The third party holds plaintext or recoverable key material; an attacker reaches the storage.
2. Session tokens / middleware. The third party is itself breached, and the attacker uses its live session to issue orders in the user's name.
3. Prompt-injection / automation abuse. Rarer, but relevant for AI-driven platforms where user-controlled instructions can be redirected into trading actions.

Binance's call to revoke all keys and insist on IP whitelisting on fresh ones addresses paths 1 and 2 at the exchange layer. It is the right conservative move, independent of which path SignalPlus actually suffered.

CZ's warning: Deribit also affected

In a parallel X post reported by CoinDesk, Changpeng Zhao (CZ) told users: "if you use SignalPlus for any other exchange platform, it's time to revoke all your API keys." CZ added that Deribit has also reported the issue and advised against storing API keys with third-party platforms. Decrypt's write-up does not mention Deribit, and we have not independently verified any Deribit statement at time of publication. Treat the Deribit angle as CZ's attribution until Deribit confirms directly.

Impact

• Automated strategies. Any strategy running through SignalPlus — delta-hedging bots, option-selling programs, cross-exchange arbitrage — will not execute on Binance until a new key is issued, whitelisted, and reconnected. SignalPlus-driven liquidity on Binance options and spot pairs will drop proportionally over the cut window.
• SignalPlus users on other venues. If the issue extends to any of SignalPlus's other exchange connections (Deribit per CZ, and others not yet named), users with keys on those venues face the same revoke-and-rotate drill.
• Binance balance sheet. Binance says none of this involves its own hot wallets or user balances. That is the material distinction from the October 29 hot-wallet drain, which the FBI on October 31 attributed to the North Korea-linked group TraderTraitor.

What to do (operators and SignalPlus users)

1. Revoke all SignalPlus API keys on every connected exchange, not just Binance. Rotate before a next session even if Binance has pre-emptively invalidated the Binance-side keys.
2. On fresh keys: enable IP whitelisting, strip withdrawal permission, and scope order permissions to the pairs the strategy actually needs.
3. Review recent trades against your own books; if anything looks out of pattern between the last known-good session and the cut window, flag to the exchange's account recovery process in writing.
4. Wait for SignalPlus's post-mortem before reconnecting any key; if the post-mortem does not identify the compromise path and the fix, do not reconnect.

Context — one week post-$6.4B drain

Binance is cutting third-party integrations one week after the record $6.4 billion hot-wallet theft of October 29 and the phased withdrawal reopening on November 1. The playbook here is defensive-by-default: assume the counterparty is compromised, revoke access, and make the counterparty prove it isn't before restoring connectivity. That is a stronger security posture than the exchange typically shows for integration partners, and it is the natural reaction when the incident-response team is still active on another file. Whether SignalPlus's actual compromise turns out to be severe or minor, the asymmetric cost of leaving a potentially compromised integration live right now is far higher than the cost of a few disrupted trading programs.