SignalPlus: A Fake Teams Meeting Invite Led Binance and Deribit to Cut Off the Trading Tool's Keys

On the morning of 5 November 2026, traders who run automated strategies through a tool called SignalPlus found that their connections to two of the world's biggest crypto exchanges had stopped working. Binance and Deribit had switched off every link between their customers' accounts and the tool. Both exchanges say the problem was not on their side. Binance said its own systems were unaffected and user funds remained safe. Deribit said its systems and data were not affected.

SignalPlus is a Hong Kong-based company that sells trading software for crypto options. An option is a contract that lets a trader bet on where a price will go by a set date, the kind of instrument a share trader would know from the stock market. SignalPlus does not hold anyone's money. It connects to exchanges and places trades for its users. Besides Binance and Deribit, The Defiant lists Bybit, Gate.io and OKX as partners.

What an API key is

The connection works through an API key, a long password-like code that an exchange gives a customer so that another program can act on the account. The nearest comparison is a valet key for a car. It lets the valet drive the car but, in theory, not open the boot. A trader creates the key on the exchange and pastes it into SignalPlus. The tool can then place and cancel trades without the trader logging in each time.

The risk is plain. Whoever holds the key can use it, so a company that stores thousands of customers' keys becomes a target. Exchanges let customers limit a key to certain actions and, with a setting called IP whitelisting, to certain internet addresses only. A whitelisted key is like a valet key that only works if the car is parked outside one particular building.

What SignalPlus says happened

The account of the attack comes from SignalPlus itself. At 13:29 UTC on 5 November it posted a statement on X. No outside investigator has confirmed the method described below.

By SignalPlus's account, an attacker first took over the Telegram account of a contact at a third-party technology supplier. Posing as that contact, the attacker chatted with one of SignalPlus's engineers and sent a fake invitation to a Microsoft Teams video meeting. The invitation was the way in. The engineer's computer was compromised and the intruder went quiet. In the early hours of 4 November, the company says, the attacker used the access on that computer to attack SignalPlus's internal network. SignalPlus says it spotted the activity, blocked the attack and patched the weaknesses it found.

It then contacted the exchanges and, from the exchange side, all API keys linked to SignalPlus were disabled. Its own services went into what it calls closed maintenance. Users are told to check accounts, positions and open orders on the exchanges directly.

The $82,000 figure

SignalPlus says user losses were contained to no more than $82,000 and that it has started paying affected users back in full, case by case. It says the accounts hit were a small number that had not turned on IP whitelisting. That ceiling is the company's own count. In the coverage read for this article, no blockchain analyst or outside security firm has published a check of it, and neither exchange has reported a loss.

SignalPlus also says that having a key disabled does not mean an account was leaked or drained. The switch-off was a precaution for every user. In the same statement it admitted a weakness of its own: it had not made IP whitelisting a required condition for connecting an exchange key. It says it will tighten that rule and lock down its engineers' computers and internal access.

How the exchanges reacted

Binance posted that it had removed all keys linked to SignalPlus as an immediate precautionary measure after the platform reported a potential security issue. It told users to review positions and open orders on Binance, wait for confirmation of a full resolution before reconnecting, and turn on IP whitelisting. Yi He, Binance's co-founder, asked other platforms plugged into Binance to review their security controls and report anything unusual.

Deribit, a crypto derivatives exchange, said it revoked all customer keys connected to SignalPlus after SignalPlus told it of a potential security concern. Changpeng Zhao, Binance's founder, told people who use SignalPlus on any other exchange to revoke their keys, and advised against keeping keys with third-party platforms at all. Bitcoin.com reports that Binance says no connection has been established between this incident and its own October hack.

Latest check

This is a developing story. The last check was at about 16:40 UTC on 5 November 2026. SignalPlus says it expects to restore its services fully in the coming days and has given no date. No statement about SignalPlus keys from Bybit, OKX or Gate.io turned up in that check. Which other exchanges cut keys, how long the attacker was in the network, and whether the loss figure holds are all still unanswered.

©Logos: Binance, via Wikimedia Commons; Deribit, via GitHub