Binance and Deribit remove all SignalPlus API keys: what traders should check

What happened. At 10:51 UTC on November 5, Binance said on X that it had "proactively removed all API keys linked to SignalPlus" as an immediate precaution. The trigger: SignalPlus itself reported a potential security issue. Reuters reports that Deribit also removed all SignalPlus keys and, after an investigation, found no sign its systems or data were affected.

What Binance says. The exchange's own systems are unaffected and user funds are safe. SignalPlus users should log in to Binance directly, review positions and open orders, and not reconnect keys until SignalPlus confirms the issue is fully resolved. For new keys, Binance recommends IP whitelisting.

What CZ and Yi He say. Binance founder Changpeng Zhao wrote: "If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys." He advised against storing API keys with third parties at all. Binance co-founder Yi He urged all connected platforms to review their security and watch for suspicious activity.

Why it matters. An API key gives an outside service access to your account: to see balances and place orders. Even without withdrawal rights, someone else's hands on the key can mean bad trades. This comes a week after the $6.3 billion Binance hack on October 29, but it is a separate case: the exchange says its systems are fine. This is our view.

What we don't know. What exactly happened at SignalPlus. Whether any keys actually leaked. Whether users saw unauthorized trades or losses. When the service can be reconnected.

Hechos confirmados

• On November 5, 2026 Binance removed all API keys linked to SignalPlus after SignalPlus reported a potential security issue.^[1][3]
• Binance said its systems were unaffected and user funds remain safe.^[1][3]
• Binance advised reviewing positions and orders directly, not reconnecting until SignalPlus confirms a fix, and enabling IP whitelisting.^[1][4]
• Deribit also removed all SignalPlus keys and found no sign its systems or data were affected.^[3]
• CZ urged users to revoke SignalPlus keys on every other exchange and not to store API keys with third parties.^[2][4]

Implicaciones

• ConfirmadoSignalPlus connections to Binance and Deribit no longer work for now.
• Nuestra lecturaAnyone who linked SignalPlus to other exchanges is safer revoking those keys themselves. This is our view, based on CZ's advice.

Todavía no se sabe

• What exactly happened at SignalPlus
• Whether there were unauthorized trades or losses
• When SignalPlus will say the issue is fixed

A quién afecta

Global. Anyone who linked SignalPlus or another trading tool to an exchange with API keys

Fuentes

1. Binance: Binance on X: SignalPlus API keys removed 5 de noviembre de 2026 · oficial
2. Changpeng Zhao (X): CZ: revoke SignalPlus API keys on other exchanges 5 de noviembre de 2026 · oficial
3. Reuters via CNA: Binance, Deribit remove SignalPlus API keys after security issue 5 de noviembre de 2026 · medios
4. CoinDesk: Binance cuts SignalPlus access after security warning, urges users to check accounts 5 de noviembre de 2026 · medios