Binance removed all access keys associated with the SignalPlus platform on November 5. The service itself reported a "potential security issue." The exchange called the key revocation an immediate precautionary measure.
SignalPlus is a Hong Kong-based platform for trading crypto options and derivatives. Through it, a trader manages positions on the exchange from a third-party interface.
This concerns access keys. An API key is a code by which a third-party service trades on your account without entering a password. If your trades are executed by an external service, their execution is now in question.
What has already stopped?
After the revocation, SignalPlus loses access to Binance users' accounts. All automated strategies running through it stop until new keys are issued.
- Exchange systems - unaffected, Binance stated
- Client funds - safe
- Third-party services - Binance suggested all connected parties check their security
What does Zhao say?
Changpeng Zhao, co-founder of Binance, wrote on X: if you use SignalPlus on any other venue, it's time to revoke all your keys. According to him, the exchange Deribit also reported the issue.
Key point: Zhao advises against storing access keys with third-party platforms at all.
What should the user do?
The instructions are simple.
- Check your account. Log in to Binance directly and review positions and open orders.
- Don't rush to reconnect. Wait until SignalPlus confirms the issue is resolved.
- Enable key binding to a list of allowed addresses.
The risk here is that a stolen key allows trades to be made on the account even with withdrawals disabled.
What's the background?
On October 29, about $6.3-6.4 billion was withdrawn from Binance hot wallets. This is the largest hack in crypto history. The FBI attributes the attack to the North Korean group TraderTraitor; Pyongyang rejects the accusations.
- About half of the stolen funds was frozen by Tether, Circle and other issuers
- Around 98% was replenished by the exchange from its own funds
- 44 tokens are covered by the new reserves snapshot versus 10 previously
- 50-60 hours is roughly how long the proof-of-reserves calculation will take, after which verification awaits
Withdrawals are being opened in stages, deposits are working. You can compare crypto terms at prop firms in the catalog.
Is a bot trading through an access key on your behalf?
Disconnecting keys hits hardest those whose trades are executed by a third-party service rather than by hand. In prop programs this is a separate clause in the rules. Some companies allow connecting external platforms and algorithms. Others consider this trading on someone else's signals and close the account. Each has its own list of available crypto instruments and its own leverage limits. Checking against your own style will take less time than reissuing keys.