Binance and cryptocurrency derivatives exchange Deribit have removed application programming interface keys linked to third-party trading platform SignalPlus after a potential security issue was reported, a precaution that may interrupt automated trading connections.
In a November 5 statement from Binance’s verified account, the exchange said its own systems were unaffected. It instructed SignalPlus users to log in directly to examine open orders and positions and to wait for confirmation of remediation before connecting new API credentials.
API Credentials Link Exchange Accounts to Trading Software
An API key allows an approved application to query account data or place orders according to permissions granted by the account owner. Depending on the platform, separate permissions may allow viewing, trading, transfers or changes to account settings.
Removing a key breaks that application’s access to the exchange. It does not necessarily close positions already open on the venue or undo trades placed earlier.
That is why Binance asked affected users to review existing orders and exposures manually. Traders depending on automated risk management may need alternative monitoring while the connection remains disabled.
Exchanges Describe Precaution, Not Confirmed Internal Breach
Binance emphasized that its own infrastructure was not affected. Deribit likewise said its investigation had found no evidence that its internal systems or data were compromised.
Those statements relate to the exchanges’ investigations and do not conclusively establish the cause or impact of the underlying SignalPlus alert. The available announcements do not provide a verified count of compromised customer accounts or a final technical root-cause report.
Different trading venues may handle access keys, permissions and reactivation differently, so affected customers should follow the instructions for their specific account.
What Users Should Do With Third-Party Trading Keys
Customers should log in through their exchange’s official website or application, examine active API connections and revoke credentials no longer required. They should review recent orders, open positions and account activity for signs of unauthorized use.
Where supported, limiting a key to a fixed set of trusted IP addresses can constrain unauthorized access. Binance specifically recommended IP whitelisting before users reconnect SignalPlus.
Users should avoid giving withdrawal permissions to an automation tool unless that capability is essential. Some venues distinguish trading from transfers, while others bundle permissions differently; settings need to be checked rather than assumed.
Coinbase’s exchange API documentation provides one example of separate view, trade, transfer and manage permissions, but Binance and Deribit configurations are not necessarily identical.
Security Issue Highlights Third-Party Exposure
Third-party trading platforms can introduce additional credential-handling risks even when the underlying exchange infrastructure is functioning normally. Attackers who obtain trading authority may be able to execute unfavorable orders without possessing withdrawal permissions.
BlockBriefing has previously examined Binance’s separate withdrawal-restoration program. That recovery relates to an earlier incident and should not be conflated with the SignalPlus alert.
The immediate test of the exchanges’ response will be whether users can safely restore connections after the third-party issue is resolved. Before rebuilding integrations, customers should confirm that old credentials have been revoked rather than merely disabled in a local trading interface. Security teams should examine audit logs and limit every new key to the minimum privileges required. Until a definitive technical report is available, descriptions of the issue should remain conditional.
