Binance revoked all API Keys linked to the third-party platform SignalPlus in one go last night. The cause wasn’t on Binance’s end: SignalPlus reported a potential security issue.
The official account said it was taking “timely preventive measures,” followed by two reassurances: Binance’s own systems were unaffected, and users’ funds were safe. The same post also reminded anyone who had used SignalPlus to log directly into their account and check their positions and open orders, rather than wait for the third party to come back online.
CZ put it more bluntly: if you’ve also used SignalPlus on other trading platforms, revoke all your API Keys now. In general, he doesn’t recommend storing API Keys on any third-party platform. Yi added another point: all third-party platforms integrated with Binance should review their security controls, monitor for anomalies, and contact Binance immediately if they find a problem. This isn’t aimed at any one company.
Binance can revoke only the keys it recognizes on its own platform. For the authorization granted elsewhere, you’ll have to revoke it yourself.
There’s another development on the timeline. The hot-wallet incident happened on October 29; today is day eight. The official account has issued eight recovery updates. The latest says that, starting at 12:00 on November 5 (UTC+8), withdrawals of 69 assets across six chains will be reopened, still in batches. Binance is wrapping up its own incident, while the point of risk has shifted—from the platform’s hot wallet to users’ authorization pages.
An API Key isn’t the same as a password. If a password leaks, changing it once is enough. A key is a long-term delegation granted to a particular server. It can read your positions and place orders; if withdrawal permission is enabled, it can also move the funds in your account. A third-party strategy tool needs trading permissions to place trades for you, which makes its server the boundary of your account. If that server is compromised, the result is the same as if your own account were compromised.
A hot-wallet breach makes the news. Funds drained by a tool you authorized years ago often appear as nothing more than a quiet line in your ledger.
There’s no middle ground with a key: it’s either in your hands or on a machine you trust.
#中本聪国际社区Baoluo币商资本 #Binance launches Binance Intelligence
The official account said it was taking “timely preventive measures,” followed by two reassurances: Binance’s own systems were unaffected, and users’ funds were safe. The same post also reminded anyone who had used SignalPlus to log directly into their account and check their positions and open orders, rather than wait for the third party to come back online.
CZ put it more bluntly: if you’ve also used SignalPlus on other trading platforms, revoke all your API Keys now. In general, he doesn’t recommend storing API Keys on any third-party platform. Yi added another point: all third-party platforms integrated with Binance should review their security controls, monitor for anomalies, and contact Binance immediately if they find a problem. This isn’t aimed at any one company.
Binance can revoke only the keys it recognizes on its own platform. For the authorization granted elsewhere, you’ll have to revoke it yourself.
There’s another development on the timeline. The hot-wallet incident happened on October 29; today is day eight. The official account has issued eight recovery updates. The latest says that, starting at 12:00 on November 5 (UTC+8), withdrawals of 69 assets across six chains will be reopened, still in batches. Binance is wrapping up its own incident, while the point of risk has shifted—from the platform’s hot wallet to users’ authorization pages.
An API Key isn’t the same as a password. If a password leaks, changing it once is enough. A key is a long-term delegation granted to a particular server. It can read your positions and place orders; if withdrawal permission is enabled, it can also move the funds in your account. A third-party strategy tool needs trading permissions to place trades for you, which makes its server the boundary of your account. If that server is compromised, the result is the same as if your own account were compromised.
A hot-wallet breach makes the news. Funds drained by a tool you authorized years ago often appear as nothing more than a quiet line in your ledger.
There’s no middle ground with a key: it’s either in your hands or on a machine you trust.
#中本聪国际社区Baoluo币商资本 #Binance launches Binance Intelligence