Image Credit: deribit.com
- Binance and Deribit revoked SignalPlus-linked API keys on Nov. 5 following an incident.
- SignalPlus estimated its losses at less than $82,000 and began reimbursing affected users.
- SignalPlus plans to tighten API access requirements and mandate IP whitelisting for connections.
Binance and Deribit revoked SignalPlus-linked API keys on Nov. 5, interrupting trading connections after the crypto derivatives platform reported a security incident. Binance’s systems were unaffected, and user funds remained safe, while Deribit reported no indication that its systems or data had been affected.
Revocations Stop Connected Trading Tools
Application Programming Interface (API) keys let outside software access exchange accounts under permissions granted by customers, including viewing balances and placing trades. Revoking those credentials cuts off the software’s access, so customers using SignalPlus must manage their accounts through the exchanges directly.
Deribit warned that trading, monitoring, and automation through SignalPlus had stopped working. Binance instructed affected customers to review their positions and open orders on its own platform and wait for SignalPlus to confirm full resolution before reconnecting.
The removal applied as a precaution across connected accounts. SignalPlus stated that a disabled key did not necessarily mean that the associated account or assets had been compromised.
SignalPlus Reports Losses Below $82,000
SignalPlus cleared that the attack began through a compromised Telegram account belonging to a contact at a technology vendor. The attacker impersonated that contact and sent an engineer a fake Microsoft Teams meeting invitation, compromising the employee’s computer.
The company revealed that the attacker later used the engineer’s access privileges to target its internal network early on Nov. 4. SignalPlus found that it contained the intrusion, estimated losses at less than $82,000, and began reimbursing affected users, with a commitment to cover their losses in full.
SignalPlus Plans Mandatory IP Whitelisting
SignalPlus acknowledged that it had not required IP whitelisting for exchange API connections. This safeguard restricts a key’s use to approved internet addresses, limiting where someone holding the credential can access an account. The company revealed a small number of accounts without whitelisting were impacted.
The company would tighten API access requirements, strengthen security on development devices and improve internal access controls and key management. Binance separately recommended enabling IP whitelisting before reconnecting any keys.
SignalPlus suspended services during its security review. In its Nov. 5 statement, it expected a phased return over the following few days after completing checks and applying necessary patches.
