SECURITY ALERT

The exchanges were not breached.

The keys to them were.

Binance and Deribit have revoked every customer API key linked to SignalPlus, a third-party trading terminal, after SignalPlus reported a breach that it says began with a fake Microsoft Teams invite and cost users less than $82,000, according to posts from Binance, Deribit and SignalPlus.

An API key is a password for software. It lets a tool like SignalPlus place trades on a user’s exchange account without the user logging in.

Both exchanges say their own systems were not affected.

SignalPlus has not named the attacker. No security firm or authority has attributed the incident.

The timeline

Early on 4 Nov, SignalPlus says, it detected unusual activity on its internal network and blocked it.

At 10:51 UTC on 5 Nov, Binance said it had removed all API keys linked to SignalPlus as a precaution and that user funds were safe.

At 11:05 UTC, former Binance chief executive Changpeng Zhao told SignalPlus users on other exchanges to revoke their keys there too. He said Deribit had reported the issue first.

At 12:21 UTC, Deribit said it had revoked the keys and that any trading, monitoring or automation running through SignalPlus had stopped.

At 13:28 UTC, SignalPlus published its account.

Why did users hear it from the exchanges first?

How it happened

According to SignalPlus, an attacker took over the Telegram account of a contact at one of its technology vendors.

Posing as that contact, the attacker sent a SignalPlus engineer a fake Microsoft Teams meeting invitation. The engineer’s computer was compromised.

The attacker then waited. In the early hours of 4 Nov, it used the engineer’s access to move into the internal network, SignalPlus says.

The damage landed on a small number of accounts that had no IP whitelisting, a setting that only lets a key work from approved internet addresses. SignalPlus admits it had not made that setting mandatory and says it takes responsibility.

It has not named the vendor. What did the attacker reach before it was blocked?

The response

SignalPlus says losses are below $82,000, by its own assessment so far. It says it has started repaying affected users case by case and will repay all of them in full.

Its services are paused and will return in phases over the next few days. Users can still see their positions and orders directly on the exchanges.

The method echoes a fake job interview in Binance’s post-mortem on the Binance theft last week. There is no public evidence linking the two incidents.

Protect yourself

  • If you connected SignalPlus to any exchange, check that the key is gone, and delete it yourself if it is not.
  • Log in directly to each exchange and review open orders, positions and recent withdrawals.
  • When you reconnect any tool, turn on IP whitelisting and switch off withdrawal permission on the key.
  • Treat unexpected meeting links as hostile, even from contacts you know, and confirm them through a second channel.

One engineer clicked a meeting link. How many trading tools still hand out keys without an IP lock?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.