Binance Pulls Every SignalPlus API Key, Tells Users to Check Their Positions and Orders

Binance removed every API key linked to SignalPlus on Thursday, Nov. 5, saying SignalPlus had flagged a possible security problem.

The exchange described the step as an immediate precaution. “Binance’s own systems are unaffected. User funds remain safe,” the company wrote in its post on X at 10:51 UTC.

API keys let an outside platform such as SignalPlus read account data and place trades for a user without that user logging in. With the keys gone, SignalPlus can no longer act on those Binance accounts until users create and bind new ones.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Binance asked anyone who used SignalPlus to log in to Binance directly and look over their positions and open orders. It advised against rebinding any API keys until SignalPlus confirms the issue is fully resolved, and it told users to always turn on IP whitelisting, which limits a key to a set list of internet addresses.

The exchange also asked every third-party platform connected to Binance to check its own security setup, watch for unusual activity and contact Binance right away if anything looks wrong.

Binance’s post did not say what the issue was, how many accounts were connected through SignalPlus, or whether any user lost funds, and none of the other sources Unchained reviewed established those points. SignalPlus had not published a statement on the incident in the sources Unchained reviewed as of publication.

Binance co-founder Changpeng Zhao told SignalPlus users to act on other exchanges too. “If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys,” Zhao wrote on X, adding that users generally should not store API keys with third-party platforms. He also wrote that derivatives exchange Deribit had reported the issue, in the words “Deribit also/first reported this.” A Crypto Times headline said Deribit also revoked SignalPlus keys. Unchained has not independently verified that claim.

An API key lives with the outside platform, not the exchange, so a problem at a connected tool can put user accounts at risk even when the exchange’s own systems are clean. That is why Binance’s guidance centers on what users can check themselves, their open orders and positions, and on IP whitelisting, which keeps a key from working outside approved addresses.

Related Listen: Binance Lost $6.3 Billion in 20 Minutes. Can Crypto Stop the Next One?

The post Binance Pulls Every SignalPlus API Key, Tells Users to Check Their Positions and Orders appeared first on Unchained.