Binance and Deribit revoked API keys connected to crypto derivatives platform SignalPlus on Thursday after attackers compromised an engineer's computer via a fake Microsoft Teams invitation, resulting in losses under $82,000. SignalPlus has suspended services and pledged full reimbursement.
Key Takeaways
- Binance and Deribit revoked SignalPlus API keys Thursday after a social-engineering breach compromised an engineer's computer via fake Teams invite.
- Losses totaled under $82,000; SignalPlus pledged full reimbursement and suspended services pending security review.
- Attack originated from compromised Telegram account of a third-party vendor contact; SignalPlus admitted lack of IP whitelisting for API access.
- Incident follows Binance's $6.3B hack disclosure on Oct. 29, also involving compromised employee credentials.
- Binance detected 57 suspected North Korea-linked cyber threats in 2026; Fed and OCC are querying banks on Binance hack exposure.
Executive Intelligence Brief
Attack Vector and Containment
The breach originated from a compromised Telegram account belonging to a contact at a third-party technology vendor. The attacker impersonated the contact and sent a fraudulent Microsoft Teams meeting invitation to a SignalPlus engineer, compromising the employee's computer. The intruder remained dormant before using the engineer's access privileges to target SignalPlus's internal network early Wednesday.
SignalPlus said it detected and contained the intrusion, with total losses of less than $82,000. The company has begun fully reimbursing affected users and temporarily suspended its services, expecting to restore operations over the next few days after completing security reviews and applying patches.
Exchange Precautions and Systemic Warning
Both Binance and Deribit confirmed their own systems were unaffected by the breach. Deribit warned that trading, monitoring, and automation through SignalPlus had stopped working for its customers. Binance co-founder Yi He urged third-party platforms integrated with the exchange to review their security controls and monitor for suspicious activity, warning that the threat extended beyond any single company.
Security Oversight Acknowledged
SignalPlus acknowledged it had not required IP whitelisting — a security measure restricting API access to pre-approved internet addresses — for exchange API access. 'We take responsibility for this oversight,' the company said, adding it would tighten API access requirements and strengthen internal security controls.
Context: Escalating Threat Landscape
The SignalPlus incident comes days after Binance disclosed details of a $6.3 billion hack on Oct. 29, which also involved compromised employee computers. In that attack, threat actors posing as recruiters tricked an engineer into downloading a malicious file disguised as a coding assignment, eventually breaching the exchange's wallet infrastructure. Binance said Tuesday it had detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages, and credential-theft attempts.
Regulatory Scrutiny and Forward Outlook
The string of high-profile breaches has drawn regulatory attention. The Federal Reserve and Office of the Comptroller of the Currency are querying U.S. banks on their exposure to the Binance hack, testing the post-April crypto supervision framework. SignalPlus expects to resume services within days, while exchanges and third-party providers face pressure to harden supply-chain defenses against increasingly sophisticated social-engineering campaigns.
