Sainteur · Highly Regarded Market News

Crypto

Binance and Deribit cut SignalPlus API keys after security report

Changpeng Zhao told SignalPlus users on other exchanges to revoke their keys too. Both exchanges say their own systems weren't hit.

By ·

Why it matters: Anyone running SignalPlus strategies on Binance or Deribit has lost that automation until SignalPlus gives the all-clear and they reconnect with new keys.

For information only, not investment advice.

Binance said Thursday it had removed all API keys linked to SignalPlus as an immediate precaution after the third-party trading platform reported a potential security issue.[^1] "Binance's own systems are unaffected. User funds remain safe," the exchange said.[^1]

Options exchange Deribit took the same step. It said it revoked all customer API keys connected to SignalPlus after SignalPlus informed it of a potential security concern.[^3] After an investigation, it found no indication its systems or data were affected.[^5]

SignalPlus is a Hong Kong-based platform that provides trading tools for crypto options and derivatives and connects to several exchanges, including Binance.[^4] API keys let third-party apps place trades on a user's exchange account; cutting them off stops automated strategies running through SignalPlus until users set up new keys.[^4]

Deribit told traders that SignalPlus-driven trading, monitoring and automation on its platform has stopped, and that they should check open orders, positions and recent account activity on Deribit itself.[^3] "If you intend to reconnect to SignalPlus, wait for official communication from their team before proceeding," Deribit said.[^3]

Binance urged SignalPlus users to log into Binance directly to review positions and open orders, wait until SignalPlus confirms the issue is fully resolved before reconnecting, and enable IP whitelisting.[^4] Binance also called on third-party platforms integrated with it to review security controls and contact it if they spot concerns.[^4]

Binance founder Changpeng Zhao told users who use SignalPlus on any other exchange to revoke their API keys. "It is generally recommend that you do not store your API keys with any 3rd party platform," he wrote, adding that Deribit also reported the issue.[^2]

Sources

  1. Binance removes SignalPlus-linked API keys, X @binance
  2. CZ urges SignalPlus users to revoke API keys, X @cz_binance
  3. Deribit revokes SignalPlus-connected API keys, X @DeribitOfficial
  4. Binance Cuts Off SignalPlus API Keys Over 'Potential Security Issue' at Trading Platform, Decrypt
  5. Binance, Deribit remove SignalPlus API keys after security issue, CNA

Tags: exchanges