Binance has revoked all API keys connected to third-party trading platform SignalPlus after the company reported a potential security issue, prompting founder Changpeng Zhao to warn traders using the service on other exchanges to take similar precautions.
Summary
- Binance has revoked all API keys connected to SignalPlus after the third party trading platform reported a potential security issue, while assuring users that its own systems and funds remain safe.
- Binance founder Changpeng Zhao urged traders who use SignalPlus on other cryptocurrency exchanges to revoke their API keys and warned against storing exchange credentials with third party services.
- Affected Binance customers have been advised to review their trading positions and open orders directly through their accounts and wait for SignalPlus to resolve the issue before reconnecting.
- Binance recommended enabling IP whitelisting for future API connections and asked third party integration partners to review their security controls and monitor for suspicious activity.
According to a November 5 announcement, Binance removed the affected API connections as an immediate precaution after learning about the security concerns raised by SignalPlus.
The exchange said its internal systems were unaffected and assured customers that their funds remained safe. The decision applies specifically to API keys linked to SignalPlus, which allows traders to connect their exchange accounts to external trading tools.
Binance founder Changpeng Zhao, commonly known as CZ, subsequently advised users who had connected SignalPlus to other cryptocurrency exchanges to revoke their API keys as well.
“If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys,” Zhao wrote on X.
He further cautioned against storing exchange API credentials with outside service providers and mentioned that cryptocurrency derivatives exchange Deribit had reported the issue earlier.
Binance asks SignalPlus users to review positions and open orders
Following the removal of the API connections, Binance instructed affected customers to log into their exchange accounts directly and check their trading positions and outstanding orders.
The precaution is particularly relevant for traders who previously relied on SignalPlus to manage transactions through Binance’s trading infrastructure.
API keys allow external applications to communicate with an exchange account without requiring users to log in manually for every transaction. Depending on the permissions granted, these connections can provide access to account information, order placement and other trading functions.
For trading platforms such as SignalPlus, the integration allows customers to manage exchange activity through a separate interface.
Binance recommended that customers wait until SignalPlus confirms the security issue has been fully resolved before connecting their accounts to the service again.
The exchange specifically advised users to enable IP whitelisting when creating new API connections. The feature restricts access to approved IP addresses and can prevent credentials from being used through unauthorized network locations.
Binance co-founder Yi He echoed the exchange’s warning, urging third-party platforms connected to Binance to review their security controls, monitor unusual activity and immediately report any concerns.
“This is not a challenge for any single company,” Yi He wrote on X, clarifying that the warning was directed at third-party integration partners generally and not just SignalPlus.
crypto.news reached out to Binance for comments, but had not heard back as of publication time.
SignalPlus warning follows Binance’s $6.34 billion security breach
The latest security warning arrives just a week after Binance suffered a separate attack on October 29 that affected approximately $6.34 billion in cryptocurrency.
As previously reported by crypto.news, Binance’s November 3 investigation found that attackers used fraudulent recruitment interviews, malicious software and compromised internal AI tools to gain access to its wallet infrastructure.
The attackers obtained access to internal transaction-signing systems and used unauthorized wallet operations to transfer cryptocurrency across several blockchains.
Part of the attack involved Ethereum’s EIP-7702 authorization mechanism, which allowed a malicious smart contract to execute transactions on behalf of a Binance hot wallet.
Binance subsequently rebuilt affected systems, replaced compromised devices and disabled credentials associated with employees targeted during the attack.
The company said approximately $2.85 billion in affected assets had been frozen or intercepted through cooperation with blockchain investigators, law enforcement agencies and industry partners.
Its recovery efforts have continued alongside the technical investigation, with Binance committing to absorb the losses using its own resources.
By November 4, the exchange had replenished approximately 98% of the affected cryptocurrency holdings, while purchases of the remaining less-liquid tokens continued.
Binance has been restoring withdrawal services in stages following additional security checks, including reopening access for dozens of tokens across Ethereum and Solana.
