Binance and Deribit disabled the platform’s connections to customer accounts. SignalPlus says the intrusion began with a fake invitation sent to an engineer.

Binance cut its connections with crypto trading platform SignalPlus on Nov. 5 after a security warning. SignalPlus later said attackers had broken into its network after an engineer was tricked with a fake Microsoft Teams meeting invitation.

API keys let software access an exchange account within the permissions a user grants. In its advisory, Binance described the revocation as an immediate precaution and said its own systems were unaffected and user funds remained safe.

Deribit later issued its own notice. Deribit said it had revoked all customer API keys connected to SignalPlus, stopping trading, monitoring and automation through that connection. It said Deribit's systems and data were unaffected, and directed users to check their accounts on Deribit itself.

SignalPlus subsequently described an attack it had detected in the early hours of Nov. 4. In a statement, SignalPlus put losses below $82,000 in its assessment to date and said it had begun reimbursing affected users.

Binance told SignalPlus users to check both positions and open orders through its own platform. Binance recommended waiting until SignalPlus confirms full resolution before reconnecting API keys, and enabling IP whitelisting.

Deribit's guidance covered open orders, positions and recent account activity. @DeribitOfficial also recommended IP allowlisting and waiting for official communication from SignalPlus before reconnecting. Its notice described the interruption to functions through SignalPlus, while directing users to manage their accounts through the exchange.

Source link