Original report published November 5, 2026, at 20:23:24 UTC+8.
Binance removed all API keys connected to third-party trading platform SignalPlus after the platform reported a “potential security issue,” according to Decrypt’s November 5 report. Binance described the cutoff as an “immediate precautionary measure.”
“Binance’s own systems are unaffected. User funds remain safe,” the exchange said. That assurance was Binance’s statement, not an independent finding.
What the cutoff means for users
SignalPlus is a Hong Kong-based provider of crypto options and derivatives trading tools that connects to several exchanges, including Binance. API keys allow those tools to access exchange accounts and place trades on users’ behalf.
Revoking the keys cuts that connection. Automated strategies operating on Binance through SignalPlus therefore stop until users establish new keys.
Binance urged affected users to:
- Log into Binance directly and review their positions and open orders.
- Wait for SignalPlus to confirm that the issue is fully resolved before reconnecting.
- Enable IP whitelisting, which limits an API key’s use to approved internet addresses.
The exchange also asked other integrated third-party platforms to review their security controls, monitor unusual activity and report concerns immediately. The report did not establish the nature or extent of SignalPlus’s potential security issue.
A separate recovery effort at Binance
Decrypt placed the SignalPlus precaution against the backdrop of an October 29 attack that reportedly drained about $6.4 billion from Binance’s hot wallets, describing it as the largest hack in crypto history. The report did not establish a connection between the two incidents.
According to the report, the FBI attributed that theft to North Korean hackers it calls TraderTraitor; Pyongyang denied the allegation. Binance said a fake recruiter persuaded an engineer to download a malware-laced coding assignment, after which attackers used stolen credentials to access an internal wallet-signing service.
On November 4, Binance said it had replenished about 98% of the stolen assets using its own funds. It was still acquiring the remainder—mostly less liquid tokens—through market and over-the-counter purchases.
The exchange also said it had taken a proof-of-reserves snapshot covering 44 tokens, up from 10. User verification would become available after generation of its zero-knowledge proof, estimated to take 50–60 hours.
As of the November 5 report, Binance had begun reopening withdrawals in phases, prioritizing assets by user demand over the preceding week. Deposits remained open.