Binance and Deribit revoked API keys tied to SignalPlus as a precaution after a security breach, with both exchanges reporting their own systems as unaffected.

Users should log directly into their Binance accounts to review positions and unfilled orders, and avoid re-linking API keys until SignalPlus confirms full resolution.

Binance founder Changpeng Zhao advised users to revoke all SignalPlus-related API keys across other exchanges as a precaution.

The breaches underscore a broader need for tighter security controls, stronger phishing/impersonation defenses, and more robust incident response across exchanges and trading infrastructure.

Yi He of Binance highlighted that 57 suspected North Korea–linked cyber threats were detected in 2026, including fraudulent job interviews, malware, and credential theft attempts.

An IP whitelist should remain enabled to restrict connections to approved addresses until the integration is fully resolved.

SignalPlus said the attack originated from a compromised Telegram account of a third‑party vendor contact who impersonated that person to send a fake Microsoft Teams invitation to a SignalPlus engineer.

The attacker lay dormant on a compromised machine before using the engineer’s access to breach SignalPlus’s internal network; the intrusion was detected and contained, with losses under $82,000 and reimbursements underway for affected users.

Context places the incidents within a broader Binance crisis, including a separate North Korea–linked heist that prompted liquidity movements and recovery efforts.

The FBI attributed a $6.3 billion hack to North Korea, with ongoing recovery efforts such as asset replenishment, service restoration, phased withdrawals, and a forthcoming zero-knowledge proof for asset verification.

SignalPlus’s incident follows Binance’s Oct. 29 breach, though Binance says there is no established connection between the two events.

The Oct. 29 disclosure described a $6.34 billion breach that involved compromised employee computers via fake job interviews and breaches in wallet infrastructure.