Major crypto exchanges Binance and Deribit simultaneously revoked all client API keys linked to the third-party trading platform SignalPlus after it warned of a potential security vulnerability. User funds were not affected, but traders who connected automation through SignalPlus were left without algorithmic management and must now independently check open positions and orders.
The platforms promptly cut off a potential path to other people's accounts, but orders previously managed by the algorithm were temporarily left unattended. Meanwhile, Binance is gradually resuming withdrawals after the security incident, so the exchange's clients should be prepared for delays.
Why the exchanges revoked SignalPlus keys
SignalPlus reported a possible security issue, and Binance, as a precautionary measure, deleted all API keys associated with the platform. An API key is a digital pass through which a third-party service gains access to an exchange account and trades on the client's behalf.
Binance emphasized that the company's own systems were not affected and user funds are safe. SignalPlus clients are advised to log into their accounts directly and check positions and open orders, and to re-link keys only after the platform confirms the issue has been fully resolved.
Deribit also revoked all client API keys connected to SignalPlus after the platform's own warning. The company clarified that the exchange's systems and data were not affected, but trading, monitoring, and automation through SignalPlus for these clients came to a complete halt.
Both platforms advise trusting keys only to verified services and enabling IP address whitelisting so that a key works only from pre-approved servers. In addition, Binance urged all third-party platforms connected to the exchange to review their security, monitor for unusual activity, and report any suspicions immediately.
Binance opens withdrawals for another batch of assets
Binance is restoring withdrawals for a new group of coins — this is already the eighth update on service restoration after the security incident. The process started on November 5 at 07:00 Moscow time, and deposits have continued to work throughout.
Withdrawals did not open simultaneously for all coins on the list: access is being restored gradually as security checks are completed. The company determined the order based on user demand over the past week, and each "asset — network" pair is being restored separately and with caution.
Before withdrawing, Binance advises checking the status of the relevant coin and network on the withdrawal page or the network status page. Due to the influx of requests, temporary delays are possible, and if a transaction did not go through, it should be retried a little later.
For clients, this means access to funds is returning, but not instantly: some funds may remain on the exchange for some time. The company promises to add new assets as they become ready and to report on progress in its official X account.
Consequences of the Binance hack
Binance's caution is understandable given how quickly stolen funds from the hack are moving. An almost fully automated system is laundering the stolen $6.36 billion and moving funds through new wallets and shared pools in a matter of minutes, so the chances of recovering them are shrinking.
The new SignalPlus incident comes at a time when trust in the exchange's security is already in question: a theory is gaining popularity online that the attack was carried out by Binance employees rather than hackers from the DPRK.
Cryptalist analysis: The synchronized revocation of API keys by two leading platforms demonstrates that the market is moving toward a "zero trust" model for third-party trading integrations — speed of response matters more than the convenience of automation. For institutional and algorithmic traders, this is a signal to reconsider the architecture of their connections in favor of isolated keys with IP restrictions and backup execution channels. In the short term, such incidents increase reputational pressure on Binance, but at the same time they are shaping an industry standard of stricter control over external services.