Binance removed all API keys linked to third-party trading platform SignalPlus on November 5, 2026, after SignalPlus reported a “potential security issue,” according to Decrypt’s original report, published that day at 20:23:24 UTC+8.
The exchange described the cutoff as an “immediate precautionary measure,” saying: “Binance’s own systems are unaffected. User funds remain safe.” Those assurances concern the SignalPlus issue; the report separately described Binance’s recovery from an earlier hack.
What the cutoff means for connected accounts
API keys allow third-party applications to connect to exchange accounts and place trades on users’ behalf. Revoking the SignalPlus-linked keys cuts that connection, stopping automated strategies running through SignalPlus on Binance until users establish new keys.
Binance urged affected users to access their exchange accounts directly and review positions and open orders. It recommended waiting until SignalPlus confirms the issue is fully resolved before reconnecting, and enabling IP whitelisting to restrict API access to approved internet addresses.
The exchange also asked all third-party platforms integrated with Binance to review security controls, monitor unusual activity and report concerns immediately.
SignalPlus is a Hong Kong-based provider of crypto options and derivatives trading tools that connects to several exchanges, including Binance. The report did not establish the scope of the potential security issue or quantify how many users or automated strategies were affected.
Separate recovery from the October 29 hack
The SignalPlus precaution came a week after an October 29 attack that, according to the report, drained about $6.4 billion from Binance’s hot wallets—the largest crypto hack in history. The FBI attributed that theft to North Korean hackers it calls TraderTraitor; Pyongyang denied the allegation.
Binance said that attack began when a fake recruiter persuaded an engineer to download a malware-laced coding assignment. According to the exchange, attackers then used stolen credentials to access an internal wallet signing service.
On November 4, Binance said it had replenished about 98% of the stolen assets using its own funds. It was still acquiring the remainder, mostly less liquid tokens, through market and over-the-counter channels.
The exchange also said it had taken a proof-of-reserves snapshot covering 44 tokens, up from 10. Users would be able to verify it once a zero-knowledge proof was generated, which was expected to take about 50 to 60 hours.
As of the November 5 report, service restoration remained underway. Binance had begun reopening withdrawals for additional assets in phases, prioritizing tokens according to user demand over the preceding week. Deposits remained open.
