SignalPlus says a cyberattack caused losses below $82,000 and that it has begun reimbursing affected users. The disclosure adds detail to a security warning that prompted Binance and Deribit to revoke API keys connected to the crypto derivatives trading platform on November 5.
For traders, the immediate disruption reaches beyond the reported losses. Removing an API connection interrupts the software used to monitor accounts or automate trading, making direct checks on the underlying exchange especially important.
Key Takeaways
- SignalPlus reported losses below $82,000 and promised full reimbursement for affected users.
- Binance and Deribit removed connected API keys as a precaution.
- Users should review orders and positions directly on their exchanges before reconnecting external tools.
What SignalPlus Disclosed
According to crypto.news’s account of the company’s statement, SignalPlus detected suspicious activity early on November 4. It traced the intrusion to a compromised vendor contact’s Telegram account, which an attacker used to send an engineer a fake Microsoft Teams invitation.
The company said the engineer’s computer was compromised and the attacker later used employee access to target its internal network. SignalPlus contained the intrusion, suspended services for review and coordinated the removal of exchange API connections.
SignalPlus acknowledged that it had not made IP whitelisting mandatory. It said a small number of accounts without that protection were affected and that reimbursements had begun on a case-by-case basis. The figures and repayment progress remain the company’s account of the incident.
Why Exchanges Removed the Keys
In an official notice, Binance said it removed all SignalPlus-linked API keys immediately as a precaution. It said its own systems were unaffected and customer funds remained safe.
Reuters separately reported that Deribit revoked connected keys and found no indication that its systems or data had been affected. These statements concern the exchanges’ infrastructure; they should be read alongside SignalPlus’s disclosure of losses involving its service.
A broad revocation is a containment measure. It cuts off an integration without requiring each customer to determine individually whether a credential was exposed. It does not, by itself, prove that every linked account suffered unauthorised activity.
Trading Permission Still Carries Risk
API keys allow software to perform the actions an exchange account authorises. Binance’s developer documentation distinguishes trading permissions from permissions used to monitor account information. A connection used only for viewing data has a different role from one allowed to submit orders.
That distinction matters even when withdrawals are disabled. Unwanted trades can change exposure, incur fees or disrupt a hedging strategy. Removing withdrawal access therefore does not make a trading-enabled connection risk-free.
IP whitelisting adds a restriction on where a key can be used. It works alongside limited permissions and secure key handling, rather than replacing them. UEEx’s wallet security guide explains the wider need to protect devices, credentials and access.
What Connected Traders Should Check
Binance advised customers to sign in directly, inspect positions and open orders, and wait until SignalPlus confirms resolution before linking new keys. Check each exchange separately if your setup uses several venues.
Also confirm which monitoring or automated tasks stopped when the connection was removed. Do not assume that disabling a key has closed an existing position or cancelled every order. Review the exchange’s own account records and keep references for any disputed activity. Keep an inventory of connected tools and the permissions each one needs. That record makes it easier to identify unused access and understand which parts of your trading workflow depend on a single provider.
Use verified support channels for reimbursement questions. Our guide to protecting crypto from hackers covers precautions against impersonation, while the UEEx crypto hacks archive documents other incidents affecting connected services and custody systems.
Conclusion
The SignalPlus incident shows why third-party access needs its own security checks. Traders should verify account activity directly, track the company’s reimbursement updates and review permissions before restoring an integration. An exchange remaining operational does not remove the need to check the tools connected to it.
