Binance and Deribit have taken precautionary measures by revoking API keys linked to the crypto derivatives platform SignalPlus following a security breach. Both exchanges confirmed that their own systems remained unaffected, though Deribit noted that trading, monitoring, and automation through SignalPlus had ceased for its users. Binance co-founder Yi He urged third-party platforms integrated with the exchange to review their security controls and remain vigilant for suspicious activity, emphasizing that the threat was not isolated to a single entity.
SignalPlus, which provides infrastructure for crypto derivatives trading, particularly options, allows traders to manage positions across multiple exchanges through a unified platform. The attack originated from a compromised Telegram account belonging to a contact at a third-party technology vendor. The attacker impersonated this contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer, ultimately compromising the employee’s computer.
The attacker remained inactive on the compromised system before exploiting the engineer’s access privileges to infiltrate SignalPlus’s internal network early Wednesday. SignalPlus reported detecting and containing the intrusion, with total losses amounting to less than $82,000. The company has begun reimbursing affected users and temporarily suspended its services, expecting to restore operations after completing security reviews and applying necessary patches.
SignalPlus acknowledged a critical oversight in not requiring IP whitelisting for exchange API access, a security measure that restricts API access to approved internet addresses. The company pledged to tighten API access requirements and enhance internal security controls. This incident follows a $6.3 billion hack at Binance on Oct. 29, which also involved compromised employee computers.