Binance revoked all API keys associated with SignalPlus tonight.
This wasn’t because something went wrong at Binance. The third-party options platform itself reported a “potential security issue.” Binance acted decisively: revoke all the keys first, then ask users to check their positions and open orders themselves.
Anyone who uses third-party tools should take a moment to check their own list of authorized apps.
SignalPlus isn’t some small-time operation: it has a Hong Kong-based team, was founded in 2021, has raised a total of $73 million, and just completed a $50 million Series B in 2026. Its website lists ISO 27001, SOC 2, and A+ penetration-testing credentials. Even with all those certifications, a “potential security issue” can still arise. That shows certifications prove that processes have been followed—not that there are no vulnerabilities today.
More importantly, consider what an API key allows. It’s one of the most underestimated forms of authorization in this industry: many people enabled trading permissions to run a strategy, and even turned on withdrawals while they were at it, then never checked again. The strategy stopped long ago, but the key is still active.
Three things you can do right now: First, log in to the exchange and check your positions and unfilled orders—don’t rely only on the third-party interface. Second, don’t reconnect to SignalPlus until it confirms the issue has been fixed. Third, always enable IP whitelisting for new keys and grant only the minimum permissions needed.
CZ put it more bluntly: if you’ve used it on other exchanges, revoke access there now too.
The $6.3 billion incident taught us that “internal permissions can be pried open layer by layer.” This time, the reminder is about the door on the outside.
This wasn’t because something went wrong at Binance. The third-party options platform itself reported a “potential security issue.” Binance acted decisively: revoke all the keys first, then ask users to check their positions and open orders themselves.
Anyone who uses third-party tools should take a moment to check their own list of authorized apps.
SignalPlus isn’t some small-time operation: it has a Hong Kong-based team, was founded in 2021, has raised a total of $73 million, and just completed a $50 million Series B in 2026. Its website lists ISO 27001, SOC 2, and A+ penetration-testing credentials. Even with all those certifications, a “potential security issue” can still arise. That shows certifications prove that processes have been followed—not that there are no vulnerabilities today.
More importantly, consider what an API key allows. It’s one of the most underestimated forms of authorization in this industry: many people enabled trading permissions to run a strategy, and even turned on withdrawals while they were at it, then never checked again. The strategy stopped long ago, but the key is still active.
Three things you can do right now: First, log in to the exchange and check your positions and unfilled orders—don’t rely only on the third-party interface. Second, don’t reconnect to SignalPlus until it confirms the issue has been fixed. Third, always enable IP whitelisting for new keys and grant only the minimum permissions needed.
CZ put it more bluntly: if you’ve used it on other exchanges, revoke access there now too.
The $6.3 billion incident taught us that “internal permissions can be pried open layer by layer.” This time, the reminder is about the door on the outside.
