SignalPlus access revoked: don’t mistake disconnection for closing positions
If you’ve used SignalPlus, first check your positions, open orders, and recent trades directly on the exchange. Don’t rely only on a third-party terminal. Revoking API access cuts off access; it does not mean your positions have been handled, nor does it mean every linked account has suffered a loss.
On November 5, Binance announced that it had proactively removed all associated API keys and said its own systems were unaffected by the incident. SignalPlus disclosed the same day that it had detected an attack in the early hours of November 4, suspended its services, and coordinated with exchanges to disable the keys.
According to SignalPlus’s preliminary investigation, the attackers gained entry through a vendor contact’s compromised Telegram account. They used a fake Microsoft Teams meeting invitation to compromise an engineer’s computer, then exploited the engineer’s access privileges to enter the internal network. The company also acknowledged that it had not previously required IP whitelisting for API access—that is, restricting connections to preset network addresses. These findings and the effectiveness of the remediation still need further verification.
For people using automation, there’s another risk: if the connection stops, the processes that rely on it to monitor and rebalance positions may stop too. Check everything item by item through the exchange’s official channels rather than rushing to reconnect. Binance recommends waiting until SignalPlus confirms the issue is resolved before reconnecting, and enabling IP whitelisting. My assessment is that adding a whitelist alone is not enough to prove the entire system is secure.
Over the next two or three days, focus on the scope of the impact, phased restoration announcements, and requirements for reauthorizing access. This is an observation window, not a promise about when services will be restored. Lower the risk assessment only after the remediation scope is clearly explained, the exchange confirms access can be restored, and account checks show no irregularities. If unusual trades continue after access has been revoked, or the scope of the impact expands, raise your level of caution.
#SignalPlus #资产安全 #API
If you’ve used SignalPlus, first check your positions, open orders, and recent trades directly on the exchange. Don’t rely only on a third-party terminal. Revoking API access cuts off access; it does not mean your positions have been handled, nor does it mean every linked account has suffered a loss.
On November 5, Binance announced that it had proactively removed all associated API keys and said its own systems were unaffected by the incident. SignalPlus disclosed the same day that it had detected an attack in the early hours of November 4, suspended its services, and coordinated with exchanges to disable the keys.
According to SignalPlus’s preliminary investigation, the attackers gained entry through a vendor contact’s compromised Telegram account. They used a fake Microsoft Teams meeting invitation to compromise an engineer’s computer, then exploited the engineer’s access privileges to enter the internal network. The company also acknowledged that it had not previously required IP whitelisting for API access—that is, restricting connections to preset network addresses. These findings and the effectiveness of the remediation still need further verification.
For people using automation, there’s another risk: if the connection stops, the processes that rely on it to monitor and rebalance positions may stop too. Check everything item by item through the exchange’s official channels rather than rushing to reconnect. Binance recommends waiting until SignalPlus confirms the issue is resolved before reconnecting, and enabling IP whitelisting. My assessment is that adding a whitelist alone is not enough to prove the entire system is secure.
Over the next two or three days, focus on the scope of the impact, phased restoration announcements, and requirements for reauthorizing access. This is an observation window, not a promise about when services will be restored. Lower the risk assessment only after the remediation scope is clearly explained, the exchange confirms access can be restored, and account checks show no irregularities. If unusual trades continue after access has been revoked, or the scope of the impact expands, raise your level of caution.
#SignalPlus #资产安全 #API