A fake meeting invitation gave an attacker access to a SignalPlus employee’s computer, the company said. SignalPlus, a trading service that connects customers to exchanges through API keys, reported losses of less than $82, 000 and promised to reimburse affected users.
- SignalPlus said it detected suspicious activity early on Nov. 4 and contained what it found.
- Binance and Deribit revoked SignalPlus-linked API keys as a precaution.
- SignalPlus acknowledged it had not made IP whitelisting mandatory.
- Customers could still use the exchanges’ official platforms. SignalPlus has not disclosed the permissions on the affected keys.
How the attack reached SignalPlus
SignalPlus said the attacker used a compromised Telegram account belonging to a contact at a third-party technology vendor to pose as that contact. The attacker then sent a SignalPlus engineer a fake Microsoft Teams meeting invitation.
The social-engineering attack compromised the engineer’s computer, SignalPlus said. The attacker stayed dormant before using the employee’s access privileges to target the company’s internal network in the early hours of Nov. 4.
SignalPlus said it detected suspicious activity early that day, contained what it found, and closed identified vulnerabilities. Its investigation was still underway. The company has not said whether the attacker accessed or altered other data, or disclosed the specific vulnerabilities it found.
Exchange keys revoked as a precaution
On Thursday, Binance and Deribit said they had revoked API keys linked to SignalPlus. They did not specify the calendar date of those statements. The precaution interrupted SignalPlus-based trading, monitoring, and automation for affected exchange connections.
An API key is a software credential that lets an outside service interact with an exchange account. Revoking a key cuts off that connection, but does not by itself mean the customer’s exchange account or assets have been compromised. SignalPlus has not disclosed the permissions on the affected keys, including whether they allowed trading or withdrawals.
Binance said its systems were unaffected and customer funds remained safe. Deribit said its investigation found no indication that its systems or data had been affected. Those statements cover the exchanges’ own systems. They do not establish that no individual customer account was affected through a third-party connection.
SignalPlus said the precaution applied to all users, including those whose accounts had not been identified as affected. Customers could still view and manage accounts, positions, and open orders through the exchanges’ official platforms. Binance advised users to review positions and open orders directly on the exchange, wait for SignalPlus to confirm the issue was resolved before reconnecting, and enable IP whitelisting for API access.
The security gap SignalPlus acknowledged
SignalPlus said a small number of accounts without IP whitelisting were affected, but did not explain whether that meant the accounts were accessed, exposed to risk, or affected in another way. IP whitelisting limits an API key to use from specified internet addresses. It can restrict where a stolen credential works, but SignalPlus’s disclosure does not show that the lack of this safeguard alone caused the breach.
“We take responsibility for this oversight, ” SignalPlus said of its failure to require IP whitelisting.
The company said it plans to tighten API access requirements, improve security on development devices, strengthen internal access controls and key management, and share more threat intelligence with security firms and technology partners.
SignalPlus put all services into maintenance mode while it reviewed security and coordinated the removal of exchange connections. In its Nov. 5 statement, which did not specify a year, the company said it expected to restore services in phases over the next few days. That was an expectation at the time, dependent on completing its review, applying patches, and confirming it could safely resume operations. It was not confirmation that services had returned.
Reimbursement and unresolved questions
SignalPlus reported losses of less than $82, 000 and promised to reimburse affected users. The company said case-by-case reimbursements had begun when it issued its Nov. 5 statement and asked users who believed they had suffered losses to contact it for verification. It did not explain how it calculated the reported figure or how losses were distributed.
The company has not said how many accounts were affected, how the vendor contact’s Telegram account was compromised, or what evidence it will require to verify reimbursement claims. It has also not detailed the extent of the attacker’s access. A relatively small reported loss is welcome, but those questions remain unanswered.
Binance co-founder Yi He urged third-party platforms integrated with Binance to review their security controls, watch for suspicious activity, and report concerns promptly. The warning points to a risk of connected services: even when an exchange reports no breach, a third party with access to customer workflows can become a point of exposure. Binance flow signals can also draw attention to exchange activity, though market flows and platform security are separate issues.
Key questions and answers
-
How much did SignalPlus report in losses?
Less than $82, 000. The company did not provide a breakdown or explain how it calculated the total.
-
Were Binance or Deribit reported to be breached?
No. Binance said its systems were unaffected, while Deribit said it found no indication that its systems or data had been affected.
-
What could the revoked API keys do?
SignalPlus has not disclosed their permissions, including whether they allowed trading or withdrawals.
-
How many accounts were affected, and what data was accessed?
SignalPlus has not disclosed the number of affected accounts or publicly established whether the attacker accessed or altered other data. Its investigation was ongoing.
-
When would SignalPlus restore its services?
In its Nov. 5 statement, the company expected a phased return over the next few days, subject to security checks and patches. It did not confirm that services had been restored.
