Decrypt8 minutes agoCrypto2 min read

Binance Cuts Off SignalPlus API Keys Over 'Potential Security Issue' at Trading Platform

Exchange takes precautionary measures after third-party platform reports potential vulnerability

Quick Look

Binance has revoked all API keys associated with the trading platform SignalPlus as a precautionary measure following a reported security issue.
The exchange confirmed its own systems remain secure and user funds are unaffected.

AI-generated summary

Why It Matters

Binance recently experienced a major security breach involving stolen credentials and malware, leading to significant asset loss. The exchange is currently in the process of replenishing affected user funds.

Font size

Binance has removed all API keys linked to SignalPlus, a third-party crypto trading platform, after SignalPlus reported a "potential security issue," the exchange said on Thursday.

"Binance's own systems are unaffected. User funds remain safe," the exchange said, describing the move as an "immediate precautionary measure."

API keys let third-party apps and trading tools connect to a user's exchange account and place trades on their behalf. Removing them cuts off that connection, meaning any automated strategies running on Binance through SignalPlus will stop until users set up new keys.

Binance urged SignalPlus users to log into their accounts directly to review their positions and open orders. It recommended that they wait until SignalPlus confirms the issue is fully resolved before reconnecting, and that they always enable IP whitelisting, which restricts an API key to approved internet addresses.

The exchange also called on all third-party platforms integrated with Binance to review their security controls, watch for unusual activity and contact it immediately if they spot any concerns.

SignalPlus, a Hong Kong-based platform that provides trading tools for crypto options and derivatives, connects to several exchanges, including Binance.

Binance's hack and recovery

The incident comes a week after Binance was hit by the largest hack in crypto history, in which attackers drained about $6.4 billion from its hot wallets on October 29. The FBI has attributed the theft to North Korean hackers it calls TraderTraitor, a claim Pyongyang has denied.

Binance has said the attack began when a fake recruiter persuaded one of its engineers to download a malware-laced coding assignment, and that the attackers then used stolen credentials to reach an internal wallet signing service.

Binance said on Wednesday that it has replenished about 98% of the stolen assets from its own funds, and is still buying the rest, mostly less liquid tokens, through market and over-the-counter channels. It has also taken a new proof-of-reserves snapshot covering 44 tokens, up from 10, which users will be able to verify once its zero-knowledge proof is generated in about 50 to 60 hours.