Overview
- SignalPlus detected suspicious activity tied to a compromised vendor Telegram account and a fake Microsoft Teams invite that breached an engineer’s device and began Nov. 4 containment efforts.
- Binance and Deribit revoked all API keys linked to SignalPlus on Nov. 5 as an immediate precaution and said their own systems appear unaffected.
- SignalPlus reported losses under $82,000, has begun reimbursing affected users, suspended services for a security review, and plans phased restorations after fixes.
- Exchanges told customers to log into exchange accounts directly, inspect positions and open orders, revoke and recreate API keys with IP whitelisting, and wait for SignalPlus confirmation before reconnecting.
- The incident highlights the risk of third‑party integrations and follows Binance’s Oct. 29 hot‑wallet breach, which has made rapid key revocation and stricter access controls standard practice.