Both exchanges said their own systems were unaffected. Binance said customer funds remained safe, while Deribit said its investigation found no indication that its systems or data had been compromised.
The action matters because SignalPlus sits between professional traders and multiple exchanges, allowing customers to manage options and derivatives positions through API connections. Revoking those credentials immediately stops SignalPlus from interacting with affected exchange accounts until new keys are created.
What Happens to SignalPlus Users After the API Keys Are Revoked?
Binance told SignalPlus customers to log into their exchange accounts directly and review open orders and positions rather than relying on the third-party platform. It recommended waiting until SignalPlus confirms that the issue has been fully resolved before creating and linking new API credentials.
The exchange also advised customers to enable IP whitelisting, which limits API access to approved network addresses and can reduce the usefulness of stolen credentials.
Deribit took a similar approach. Revoking its SignalPlus-linked keys means trading, monitoring and automated strategies running through the platform can no longer operate on Deribit until users establish fresh connections.
Neither exchange has disclosed evidence that customer funds were stolen through SignalPlus. The nature of the potential security issue, how many API credentials may have been exposed and whether unauthorized trading occurred have also not been publicly established.
Investor Takeaway
Revoking API keys removes an immediate trading-access risk without requiring exchanges to suspend their wider platforms. The more important question is whether SignalPlus finds that credentials were actually exposed or misused rather than merely potentially vulnerable.
Why Do Third-Party API Connections Create a Different Security Risk?
API keys let trading applications interact directly with exchange accounts without users manually logging in for every transaction. Depending on their permissions, those credentials can allow software to read balances, monitor positions and place or cancel orders.
That creates a separate security layer from the exchange itself. An attacker does not necessarily need to compromise Binance or Deribit infrastructure if credentials held by a connected platform provide sufficient trading permissions.
Binance founder Changpeng Zhao urged users who connected SignalPlus to other exchanges to revoke those API keys as well. SignalPlus supports trading infrastructure across several digital-asset venues, making the potential exposure broader than a single exchange relationship.
Binance also asked third-party platforms integrated with its systems to review their own security controls and monitor for unusual activity.
Investor Takeaway
The episode shows that exchange security increasingly depends on the wider trading-technology stack. Institutional and professional traders can retain assets at an exchange while still creating external credential risk through execution, analytics and automation providers.
Why Is Binance Security Under Particular Scrutiny?
The SignalPlus warning comes only a week after Binance suffered a separate $6.3 billion security breach on October 29. There is currently no evidence linking the two incidents.
Binance later disclosed that the earlier attack began with fraudulent recruitment activity and malicious software that compromised employee systems before attackers reached internal wallet-signing infrastructure. The exchange’s investigation detailed how compromised developer credentials and internal systems contributed to the theft.
Binance initially suspended withdrawals while it rebuilt and reviewed affected infrastructure. Bitcoin, Ether and other withdrawals began reopening on November 1, with additional assets restored in phases.
Customer withdrawals subsequently produced billions of dollars in net outflows. By November 3, Binance said withdrawal activity had largely normalized and that it had replenished about 95% of the affected assets. Cumulative net outflows had reached about $5.28 billion by early Tuesday.
The SignalPlus action therefore arrives during an unusually sensitive period for Binance, although the exchange has stressed that the latest issue originated with a third-party platform rather than its own infrastructure.
What Should Investors Watch Next?
The key disclosure will come from SignalPlus itself. Users still lack details on what triggered the alert, whether API credentials were accessed, how many customers may have been affected and whether any unauthorized orders were executed.
Binance and Deribit’s precautionary action limits further access through existing keys, but it does not establish that those credentials were compromised.
Investor Takeaway
For now, this is a third-party credential-security incident rather than another confirmed exchange breach. The distinction could change if SignalPlus identifies stolen API keys or unauthorized trading, making its root-cause findings the next material development.