SignalPlus announces compensation results: 23 affected users
SignalPlus disclosed on November 8 that after detecting abnormal activity on November 4, it had fully compensated all 23 affected users within 72 hours, totaling USD 81,897, and had simultaneously suspended the relevant API keys, initiated a security review and system hardening, with services to be restored in stages.
Event Timeline
- [11-08 03:14] SignalPlus: has fully compensated 23 affected users, totaling USD 81,897 (PANews)
- [11-08 03:15] SignalPlus: has fully compensated 23 affected users with USD 81.9 thousand (Odaily)
Background and Impact
In the early hours of November 4, SignalPlus detected abnormal activity and confirmed it had suffered a cyberattack; on November 8, the platform released a progress update stating that it had completed full compensation to all 23 affected users within 72 hours, totaling USD 81,897. The two sources are consistent in their statements on the number of compensated users and the amount (Odaily wrote it as USD 81,897).
Regarding the source of the attack, SignalPlus previously announced that the attack originated from a compromised third-party Telegram account, which caused some user accounts without an IP whitelist configured to be affected. On the handling actions, PANews' statement is that the platform immediately notified partner exchanges, "proposed and pushed to suspend all relevant API keys," while also suspending services on the affected platform and initiating a full security review; Odaily's statement is "recommended suspending all relevant API keys and coordinated execution with partners," and said the above measures covered all associated accounts, regardless of whether abnormal activity had been detected on the account. This latter scope clarification did not appear in PANews' report. Neither media outlet disclosed the specific exchange to which the affected accounts belonged.
On security hardening, the measures listed in the two reports are consistent: raising API access requirements, implementing IP whitelist verification, and tightening employee device and internal access controls. Services will be restored gradually after the system review and upgrades are completed; Odaily added that the specific restoration time and user operation guidance will be announced through official channels, while PANews' report did not mention this follow-up arrangement.
From the structure of the incident, the risk entry point was third-party accounts and API key authorization, rather than on-chain assets or the matching system, so "whether an IP whitelist was configured" became the key variable on the user side. For users following the progress of this matter in communities such as Binance player exchanges and OKX player exchanges, the compensation and restoration milestones should still be based on the platform's official channels; access entry points such as the Bitget firewall-bypass URL that some users search for likewise need to be checked against the official domain; and compensation lists and amounts relayed in Binance chat groups and OKX chat groups should not be used as a basis for judgment.
Frequently Asked Questions
### Does this compensation cover all affected accounts?
The compensation targets 23 affected users, totaling USD 81,897. Odaily said the relevant measures covered all associated accounts, regardless of whether abnormal activity had been detected; PANews' report did not include this scope clarification.
### When will SignalPlus' services be restored?
Both media outlets said services will be restored gradually after the system review and security upgrades are completed, without giving a specific date. Odaily said the specific restoration time and user operation guidance will be announced through official channels.
### What should ordinary users pay attention to?
This attack originated from a compromised third-party Telegram account and affected some accounts without an IP whitelist configured. The platform has raised API access requirements and implemented IP whitelist verification, and users can follow the follow-up operation guidance published through official channels.