Binance and Deribit cut SignalPlus API access

Binance and Deribit removed API keys linked to SignalPlus on Nov. 5 after the trading platform reported a potential security issue, cutting off its ability to use those exchange connections. Binance said its systems were unaffected and user funds remained safe. In a statement on Binance Square, the exchange said it had removed the keys as an immediate precaution.

What does removing an API key do?

An API key is a credential that lets an outside service connect to an exchange account. SignalPlus provides digital asset options and derivatives trading infrastructure, according to Reuters’ report on the removals. When a user links an exchange account, the key lets that service carry out permitted actions through the exchange’s API, without the user logging in for each action.

Revoking the key breaks that connection. SignalPlus can no longer use that key to access the linked exchange account. Any trading activity that depends on the connection stops until a new key is linked. It is like cancelling a door pass: the holder loses access through that pass, while the account itself remains at the exchange.

What did Binance and Deribit say about their systems?

Binance said its own systems were not affected and user funds remained safe. It told SignalPlus users to log in to Binance directly to review their positions and open orders. It advised them to wait for SignalPlus to confirm the incident was resolved before linking API keys again, and to enable IP whitelisting, which limits key access to approved internet addresses.

Reuters reported that Deribit also removed all SignalPlus-linked keys. After an investigation, Deribit said it found no indication that its systems or data had been affected. Binance co-founder Changpeng Zhao urged users to revoke SignalPlus keys on other exchanges too.

What remains unclear about the security issue?

The exchange statements and Reuters report described the issue as potential, but did not explain what happened at SignalPlus. They did not specify how many accounts or keys were involved, or whether any user account was accessed or lost funds. Those details matter: removing a key cuts off an access route, but by itself does not establish whether it was misused before revocation.

For users, the immediate step Binance outlined is to inspect positions and open orders through the exchange directly. Reconnecting would restore SignalPlus’s API access, so Binance advised waiting for the platform to confirm that it had resolved the issue.

Sources and documents

• statement on Binance Square — binance.com
• Reuters’ report on the removals — streetinsider.com