Binance has taken swift action to protect its users by removing all API keys linked to SignalPlus, a prominent third-party crypto trading platform, following what the exchange described as a "potential security issue" reported by the partner service.
The proactive measure, announced by the world’s largest cryptocurrency exchange on Thursday, is designed to sever any automated communication between the external trading platform and user accounts on Binance. According to official statements from the exchange, Binance’s internal architecture and systems remain entirely unaffected by the incident, and user funds are completely safe.
"Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure," Binance said in a public statement released on social media. "Binance’s own systems are unaffected. User funds remain safe."
API keys play a vital role in modern crypto trading by allowing third-party applications, automated bots, and specialized portfolio management tools to securely connect to an exchange account on behalf of the user. These cryptographic keys grant external software the authorization to execute trades, manage positions, and monitor market movements without requiring the user to continually log into the main exchange interface. By proactively revoking these keys, Binance has effectively severed that connection. Consequently, any automated trading strategies, algorithmic bots, or risk-management tools running on Binance through the SignalPlus interface will immediately halt operations until affected users generate and authorize new API keys.
In light of the sudden disconnection, Binance has issued explicit guidance for traders who utilize the Hong Kong-based platform. The exchange urged all affected SignalPlus users to log directly into their Binance accounts to manually review their active positions, open orders, and portfolio balances. Furthermore, Binance recommended that traders wait until SignalPlus officially confirms that the underlying security issue has been thoroughly investigated and fully resolved before attempting to reconnect any new API keys.
To bolster account safety moving forward, Binance reiterated the importance of implementing robust security practices, specifically encouraging users to enable IP whitelisting. This security feature restricts the usage of a specific API key to a designated list of approved internet protocol addresses, ensuring that even if a key is somehow compromised, unauthorized actors cannot easily access or manipulate the account from unverified locations.
Beyond individual account safety, the exchange also broadened its security advisory to the wider ecosystem. Binance called upon all third-party platforms, developers, and service providers integrated with its infrastructure to conduct comprehensive audits of their security controls. The exchange urged these external partners to remain highly vigilant, actively monitor their systems for any signs of unusual or anomalous activity, and immediately contact Binance’s security team if they discover any potential vulnerabilities or concerns.
SignalPlus is a well-known, Hong Kong-based digital asset platform that specializes in providing advanced trading tools, analytics, and execution services for cryptocurrency options and derivatives. Because derivatives trading often requires sophisticated risk management and high-speed execution, platforms like SignalPlus integrate deeply with major centralized exchanges, including Binance, via API connections to facilitate complex multi-leg trading strategies for institutional and retail traders alike.
Binance’s Hack and Recovery
This latest precautionary security measure unfolds against a remarkably tense backdrop for Binance, arriving just one week after the exchange suffered the largest and most devastating hack in the history of the cryptocurrency industry. On October 29, malicious actors successfully penetrated the exchange’s defenses and drained approximately $6.4 billion worth of digital assets directly from its hot wallets.
The massive breach prompted an international investigation involving cybersecurity experts and law enforcement agencies. Shortly after the attack, the United States Federal Bureau of Investigation publicly attributed the multi-billion-dollar theft to a notorious state-sponsored hacking collective known as TraderTraitor, which US intelligence agencies have linked to North Korea. The government in Pyongyang has since vehemently denied any involvement in the incident, dismissing the FBI’s findings as a political provocation designed to defame the regime.
Detailing the mechanics of the devastating breach, Binance disclosed that the cyberattack originated through a targeted social engineering campaign. According to the exchange, a malicious actor posing as a fake recruiter successfully manipulated one of Binance’s software engineers into downloading a compromised coding assignment embedded with sophisticated malware. Once inside the corporate network, the attackers leveraged stolen credentials to navigate internal systems until they gained access to an internal wallet signing service, allowing them to authorize massive unauthorized withdrawals.
Despite the unprecedented scale of the financial blow, Binance has moved aggressively to stabilize its operations and make its user base whole. On Wednesday, the exchange announced that it had successfully replenished approximately 98 percent of the stolen assets using its own corporate reserves and treasury funds. Executives noted that the exchange is actively working to acquire the remaining portion of the stolen funds—predominantly composed of less liquid, lower-cap tokens—through coordinated open-market purchases and over-the-counter channels.
In an effort to maintain radical transparency and restore market confidence following the crisis, Binance has initiated a comprehensive new proof-of-reserves snapshot. This updated audit covers 44 distinct tokens, a substantial expansion from the 10 tokens previously covered. The exchange stated that users will soon be able to independently verify these reserves once the complex cryptographic zero-knowledge proofs are fully generated, a process expected to take between 50 and 60 hours.
Simultaneously, the exchange is methodically restoring its full suite of platform services after a week of restricted functionality. On Thursday, Binance officially commenced the phased reopening of withdrawal services for a broader range of digital assets. The rollout is being prioritized based on user demand metrics gathered over the preceding week of suspension, ensuring that the most heavily traded and requested assets return to full liquidity first. Meanwhile, deposit channels across the platform remain fully open and operational as the exchange continues its steady path toward complete operational normalization.
Web3 & Decentralized Web
Web3 & Decentralized Web
Web3 & Decentralized Web
