Binance revokes SignalPlus API keys after security warning

The precaution applies to API keys linking Binance accounts with SignalPlus, which lets traders use external tools to manage exchange activity. Binance advised customers to review their positions and open orders through their Binance accounts and wait for SignalPlus to resolve the issue before reconnecting.

Founder Changpeng Zhao, also known as CZ, told users on X to revoke SignalPlus API keys connected to other exchanges as well. He cautioned against storing exchange credentials with third-party services and said Deribit had reported the issue earlier.

Binance recommended enabling IP whitelisting for future API connections, limiting access to approved addresses. Co-founder Yi He also urged third-party integration partners to review security controls, watch for unusual activity and report concerns. She said the warning applied broadly to partners, not just SignalPlus.

The alert came a week after a separate attack on Binance on October 29 that affected about $6.34 billion in cryptocurrency. The exchange said its November 3 investigation found that attackers used fraudulent recruitment interviews, malicious software and compromised internal AI tools to access wallet infrastructure. Binance said it had frozen or intercepted about $2.85 billion in affected assets and replenished approximately 98% of the affected cryptocurrency holdings by November 4. The exchange said it would absorb the losses using its own resources.

Binance had not responded to crypto.news’ request for comment by publication time.