SignalPlus reports under $82,000 in losses after API-linked hack

SignalPlus said in an incident statement dated Nov. 5 that a small number of accounts without IP whitelisting were affected. It detected suspicious activity early on Nov. 4 and contained the intrusion before asking exchange partners to disable connected customer credentials. Reimbursements were already underway on a case-by-case basis; users who believe they lost funds were asked to contact the company for verification.

The company said an attacker used a compromised Telegram account belonging to a contact at a third-party technology vendor to approach a SignalPlus engineer with a fake Teams invitation. The social engineering attempt compromised the engineer’s computer. The attacker later used the employee’s access privileges to target SignalPlus’s internal network, where the company said it blocked the activity and closed identified vulnerabilities.

SignalPlus suspended all services for a security review and to coordinate the removal of exchange API connections. Binance and Deribit said Thursday they had revoked keys linked to the platform as a precaution. Binance said its systems were unaffected and customer funds remained safe. Deribit said it found no indication that its systems or data had been affected.

The exchanges remained accessible through their official platforms, where customers could view and manage accounts, positions and open orders. Binance advised users to review activity directly on the exchange, wait for SignalPlus to confirm the issue was resolved before reconnecting, and enable IP whitelisting. Deribit said trading, monitoring and automation through SignalPlus had stopped working after the revocations. SignalPlus stressed that disabling an API key did not mean the connected account’s information or assets had been compromised; the precaution covered all users.

SignalPlus acknowledged that it had not required IP whitelisting for exchange API keys, calling the omission a safeguard gap. “We take responsibility for this oversight,” the company said. Planned changes include stricter API access requirements, stronger security for development devices, improved internal access controls and revised key management. It also said it would expand threat-intelligence sharing with exchanges, technology partners and security firms.

The company expects to restore services in phases over the next few days, after a full review, necessary patches and confirmation that operations can resume safely. Updates and customer instructions will appear on official channels; the investigation is ongoing. Binance co-founder Yi He separately urged third-party platforms integrated with Binance to review security controls, monitor suspicious activity and report concerns promptly.