Key facts
- Binance described the API key removal as an immediate precautionary measure and said its own systems were unaffected.
- SignalPlus, based in Hong Kong, provides trading tools for crypto options and derivatives and connects to several exchanges including Binance.
- Binance told SignalPlus users to wait for the platform to confirm the issue is fully resolved before reconnecting.
- Binance recommended IP whitelisting, which restricts an API key to approved internet addresses.
- Binance asked all third-party platforms integrated with it to review security controls and report unusual activity.
- Binance said a new proof-of-reserves snapshot covers 44 tokens, up from 10, verifiable once its zero-knowledge proof is generated in about 50 to 60 hours.
Binance removed all API keys linked to SignalPlus on November 5 after the third-party crypto options trading platform reported a potential security issue, the exchange said. Binance called the step an immediate precautionary measure and said its own systems were unaffected and user funds remained safe.
API keys let third-party apps and trading tools connect to a user's exchange account and place trades on their behalf. Removing them cuts that connection, so automated strategies running on Binance through SignalPlus stop until users set up new keys. Binance urged SignalPlus users to log in directly to review positions and open orders, wait until SignalPlus confirms the issue is fully resolved before reconnecting, and enable IP whitelisting, which restricts a key to approved internet addresses. It also asked all third-party platforms integrated with Binance to review security controls and report unusual activity.
SignalPlus, based in Hong Kong, provides trading tools for crypto options and derivatives and connects to several exchanges, including Binance.
The step followed a week in which Binance was hit by what the report called the largest hack in crypto history. Attackers drained about $6.4 billion from its hot wallets on October 29, and the FBI attributed the theft to North Korean hackers it calls TraderTraitor, a claim Pyongyang denied. Binance said the attack began when a fake recruiter persuaded an engineer to download a malware-laced coding assignment, and attackers then used stolen credentials to reach an internal wallet signing service.
Binance said on November 4 that it had replenished about 98% of the stolen assets from its own funds and was still buying the rest, mostly less liquid tokens, through market and over-the-counter channels. It also took a new proof-of-reserves snapshot covering 44 tokens, up from 10, which users can verify once its zero-knowledge proof is generated in about 50 to 60 hours. On November 5 it began reopening withdrawals for more assets in phases, prioritizing tokens by user demand over the past week, while deposits remained open.