Binance revokes SignalPlus API key over "potential security
On November 5, 2026, Binance revoked the API keys associated with crypto trading platform SignalPlus, citing a potential security issue, and said its own systems and user funds were unaffected. Whether Deribit took the same action at the same time is disputed by the two sources. The incident comes a week after Binance lost $6.4 billion in a hack.
Event Timeline
- [11-05 12:23] Binance Cuts Off SignalPlus API Keys Over 'Potential Security Issue' at Trading Platform (Decrypt)
- [11-05 13:33] Binance and Deribit Revoke SignalPlus API Keys Over Potential Security Issue (CoinGape)
Background and Impact
On November 5, 2026, the API keys of crypto trading platform SignalPlus were revoked. According to Decrypt's report at 12:23 that day, Binance cut off the API keys associated with the platform on the grounds that SignalPlus had a "potential security issue," and said its own systems and user funds were unaffected. CoinGape's report at 13:33 the same day covered a broader scope: both Binance and Deribit had revoked API keys related to SignalPlus, with the two exchanges saying the move was a precautionary measure to protect users from possible unauthorized account activity.
The two sources diverge on who took the action. Decrypt's report mentions only one exchange, Binance, as taking action; CoinGape's headline and body explicitly include Deribit, saying the two exchanges revoked in parallel. There is currently no independent statement from Deribit in the public materials to check against, so it is impossible to confirm whether Deribit actually took part in this revocation, nor to determine whether the two outlets simply had different scope of information or whether the facts themselves differ. In addition, CoinGape mentioned that Binance advised customers not to reconnect API keys until further notice, but the original report is truncated at that point, and the specific conditions after "until" are not disclosed.
The incident comes at a time when Binance is under pressure. According to Decrypt, just a week earlier Binance lost $6.4 billion in a hack that was attributed to North Korea. Against this backdrop, the exchange's precautionary cut-off of API authorizations for third-party trading platforms is a handling action on interface risk. It should be distinguished that Binance stressed the affected scope was limited to API keys related to SignalPlus, and its own systems and user funds were not among them; the available materials do not state whether SignalPlus user assets were damaged.
Mechanically, API keys are the credentials by which third-party trading platforms and quantitative tools connect to exchange accounts; once a risk is determined, revoking the keys can block unauthorized calls without freezing the account. For traders using SignalPlus or other third-party tools, the key point right now is to wait for follow-up statements from the exchanges and the platform, and not to immediately rebuild authorizations with equivalent permissions after the keys fail. Whether users open accounts through the Binance registration app download entry, or via OKX registration app download, HTX registration app download, Gate.io registration app download, or Bitget registration app download, they should keep minimum permissions for third-party tools and regularly check the authorization list. The subsequent development depends on two things: whether Deribit gives an official confirmation, and SignalPlus's explanation of the nature of the security issue.
FAQ
### Will this revocation affect my account and funds on Binance or Deribit?
According to Binance, its own systems and user funds were unaffected, and what was revoked were the API keys associated with SignalPlus. The available materials do not mention the status of Deribit user assets, nor whether SignalPlus user assets were damaged; further disclosure is needed.
### Did Deribit actually participate in the revocation?
The two sources disagree. Decrypt's report mentions only Binance, while CoinGape says both Binance and Deribit revoked. There is no independent statement from Deribit in the public materials, so it is temporarily impossible to verify which side is accurate.
### What should users of third-party trading tools do now?
Binance advised customers not to reconnect API keys until the conditions are met, but the materials do not disclose the specific conditions. Users can wait for statements from the exchanges and SignalPlus, avoid immediately rebuilding authorizations with equivalent permissions after the keys fail, and check the scope of existing API authorizations.