SignalPlus said attackers compromised an engineer’s computer in a breach that resulted in losses of less than $82,000, which the crypto trading platform pledged to reimburse in full.

Exchanges Binance and Deribit said Thursday they had revoked API keys connected to crypto derivatives trading platform SignalPlus as a precaution following a security breach. Both exchanges said their own systems were unaffected, while Deribit warned that trading, monitoring and automation through SignalPlus had stopped working for its customers.

Binance co-founder Yi He also urged third-party platforms integrated with the exchange to review their security controls and monitor for suspicious activity, warning that the threat extended beyond any single company.

SignalPlus provides trading infrastructure for crypto derivatives, particularly options, allowing professional and institutional traders to manage positions across multiple exchanges through a single platform.

According to the company on X, the attack originated from a compromised Telegram account belonging to a contact at a third-party technology vendor. The attacker impersonated the contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer, compromising the employee’s computer.

The attacker remained dormant on the compromised computer before using the engineer’s access privileges to target SignalPlus’s internal network early Wednesday, the company said.

SignalPlus said it detected and contained the intrusion, with total losses of less than $82,000, and had begun fully reimbursing affected users. The company temporarily suspended its services and expects to restore operations over the next few days after completing security reviews and applying patches.

SignalPlus also acknowledged that it had not required IP whitelisting for exchange API access.

Source link