Binance revoked all SignalPlus API keys—a week after the $6.34 billion hack, and this time the problem wasn’t Binance.
The facts: On Thursday, Nov. 5, Binance and Deribit revoked all API keys connected to SignalPlus, a third-party options trading platform, after SignalPlus reported a potential security issue. Binance confirmed that its own systems were unaffected and user funds were safe. SignalPlus said in a Nov. 5 statement that losses were below $82,000: the attack began in the early hours of Nov. 4 through a compromised third-party account, affecting a small number of accounts without IP whitelisting—and SignalPlus acknowledged that IP whitelisting had not been required. Its service is now under maintenance, with a gradual recovery expected over the next few days. CZ even asked users to revoke their SignalPlus keys on other exchanges, too.
My take: this is a stark reminder about API keys—the keys we entrust to third-party platforms can become an entry point, even when the exchange itself is secure. What makes this important isn’t the relatively small amount involved, but the pattern: a basic security measure (IP whitelisting) wasn’t required, during the same week the market was already fragile.
What I’m watching: confirmation from SignalPlus that the issue has been resolved before anyone reconnects, and whether other exchanges review their third-party integrations as well.
If you use third-party trading tools, is IP whitelisting enabled on all your API keys?
This is my analysis, not financial advice—always DYOR.
#KeamananCrypto #APIKey
The facts: On Thursday, Nov. 5, Binance and Deribit revoked all API keys connected to SignalPlus, a third-party options trading platform, after SignalPlus reported a potential security issue. Binance confirmed that its own systems were unaffected and user funds were safe. SignalPlus said in a Nov. 5 statement that losses were below $82,000: the attack began in the early hours of Nov. 4 through a compromised third-party account, affecting a small number of accounts without IP whitelisting—and SignalPlus acknowledged that IP whitelisting had not been required. Its service is now under maintenance, with a gradual recovery expected over the next few days. CZ even asked users to revoke their SignalPlus keys on other exchanges, too.
My take: this is a stark reminder about API keys—the keys we entrust to third-party platforms can become an entry point, even when the exchange itself is secure. What makes this important isn’t the relatively small amount involved, but the pattern: a basic security measure (IP whitelisting) wasn’t required, during the same week the market was already fragile.
What I’m watching: confirmation from SignalPlus that the issue has been resolved before anyone reconnects, and whether other exchanges review their third-party integrations as well.
If you use third-party trading tools, is IP whitelisting enabled on all your API keys?
This is my analysis, not financial advice—always DYOR.
#KeamananCrypto #APIKey