Binance and Deribit remove all SignalPlus API keys: what traders should check

What happened. At 10:51 UTC on November 5, Binance said on X that it had "proactively removed all API keys linked to SignalPlus" as an immediate precaution. The trigger: SignalPlus itself reported a potential security issue. Reuters reports that Deribit also removed all SignalPlus keys and, after an investigation, found no sign its systems or data were affected.

What Binance says. The exchange's own systems are unaffected and user funds are safe. SignalPlus users should log in to Binance directly, review positions and open orders, and not reconnect keys until SignalPlus confirms the issue is fully resolved. For new keys, Binance recommends IP whitelisting.

What CZ and Yi He say. Binance founder Changpeng Zhao wrote: "If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys." He advised against storing API keys with third parties at all. Binance co-founder Yi He urged all connected platforms to review their security and watch for suspicious activity.

Why it matters. An API key gives an outside service access to your account: to see balances and place orders. Even without withdrawal rights, someone else's hands on the key can mean bad trades. This comes a week after the $6.3 billion Binance hack on October 29, but it is a separate case: the exchange says its systems are fine. This is our view.

What we don't know. What exactly happened at SignalPlus. Whether any keys actually leaked. Whether users saw unauthorized trades or losses. When the service can be reconnected.

已确认的事实

• On November 5, 2026 Binance removed all API keys linked to SignalPlus after SignalPlus reported a potential security issue.^[1][3]
• Binance said its systems were unaffected and user funds remain safe.^[1][3]
• Binance advised reviewing positions and orders directly, not reconnecting until SignalPlus confirms a fix, and enabling IP whitelisting.^[1][4]
• Deribit also removed all SignalPlus keys and found no sign its systems or data were affected.^[3]
• CZ urged users to revoke SignalPlus keys on every other exchange and not to store API keys with third parties.^[2][4]

影响

• 已确认SignalPlus connections to Binance and Deribit no longer work for now.
• 我们的解读Anyone who linked SignalPlus to other exchanges is safer revoking those keys themselves. This is our view, based on CZ's advice.

仍未知

• What exactly happened at SignalPlus
• Whether there were unauthorized trades or losses
• When SignalPlus will say the issue is fixed

影响到谁

Global. Anyone who linked SignalPlus or another trading tool to an exchange with API keys

来源

1. Binance: Binance on X: SignalPlus API keys removed 2026年11月5日 · 官方
2. Changpeng Zhao (X): CZ: revoke SignalPlus API keys on other exchanges 2026年11月5日 · 官方
3. Reuters via CNA: Binance, Deribit remove SignalPlus API keys after security issue 2026年11月5日 · 媒体
4. CoinDesk: Binance cuts SignalPlus access after security warning, urges users to check accounts 2026年11月5日 · 媒体