Binance and Deribit revoked SignalPlus API keys: what lies behind the security incident

The largest cryptocurrency exchanges Binance and Deribit promptly revoked API keys associated with the trading platform SignalPlus after the platform itself issued a warning about a potential security threat. The incident affects the institutional derivatives trading segment, where SignalPlus is a prominent provider of infrastructure solutions.

Both platforms confirmed that their own systems were not affected. Binance assured clients that funds are fully safe and recommended that users independently check their open positions and active orders. Former Binance head Changpeng Zhao, commenting on the situation, called for revoking SignalPlus keys on other exchanges as well — a preventive measure reflecting a cautious approach to risk management amid uncertainty.

What is known and what remains unclear

At present, the exact cause of the incident has not been disclosed, nor has the scale of potential damage. Revoking API keys is a standard protective procedure: such keys grant programs and trading bots access to an account and, if compromised, can open the way for attackers to carry out unauthorized operations. It is precisely the speed of exchanges' response in such scenarios that is critical.

The situation once again highlights a systemic problem: the deeper trading platforms integrate with exchanges via API, the wider the attack surface. For institutional participants, this is a signal to revisit their key-issuance policies — restricting access rights, implementing IP whitelisting, and regularly rotating credentials.

Cryptalist analysis: The coordinated response of Binance and Deribit demonstrates the maturity of operational risk management at the largest venues, yet the incident itself points to the persistent vulnerability of the "exchange — third-party service" chain. The derivatives market will need to closely monitor the disclosure of details: if the compromise of SignalPlus infrastructure is confirmed, this could increase pressure on trust in aggregators and push institutions toward more conservative integration models.