Crypto derivatives trading platform SignalPlus has suffered a security breach in which attackers compromised an engineer's computer via a fake Microsoft Teams meeting invitation; the company said the breach resulted in losses of less than $82,000, which it pledged to reimburse fully. Exchanges Binance and Deribit said Thursday they had revoked API keys connected to SignalPlus as a precaution, both stating their own systems were unaffected.
According to SignalPlus, the attack began when an attacker compromised a Telegram account belonging to a contact at a third-party technology vendor. The attacker impersonated the contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer, compromising the employee's computer. The attacker remained dormant on the machine before using the engineer's access privileges to target SignalPlus's internal network early Wednesday. The company said it detected and contained the intrusion, with total losses under $82,000, and had begun fully reimbursing affected users.
SignalPlus provides trading infrastructure for crypto derivatives, particularly options, allowing professional and institutional traders to manage positions across multiple exchanges through a single platform. The company temporarily suspended its services and expects to restore operations over the next few days after completing security reviews and applying patches.
SignalPlus acknowledged that it had not required IP whitelisting for exchange API access. "We take responsibility for this oversight," the company said, adding that it would tighten API access requirements and strengthen internal security controls. IP whitelisting restricts API access to a predefined list of approved internet addresses.
Binance co-founder Yi He urged third-party platforms integrated with the exchange to review their security controls and monitor for suspicious activity, warning that the threat extended beyond any single company. Deribit warned that trading, monitoring and automation through SignalPlus had stopped working for its customers.
The SignalPlus incident comes days after Binance disclosed details of a $6.3 billion hack on Oct. 29, which also involved compromised employee computers. Binance co-founder Yi He said Tuesday that the exchange had detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages and attempts to steal employee credentials.
Analysis
Why This Matters
- The breach highlights how social engineering remains a primary vector for compromising crypto platforms, targeting employees rather than code vulnerabilities.
- The coordinated response from Binance and Deribit, revoking API keys, shows the interconnected risk: a compromise at one service provider can affect multiple exchanges and their users.
- SignalPlus's admission of not using IP whitelisting and its pledge to reimburse affected users may affect trust in third-party trading infrastructure.
Background
Crypto trading platforms that connect to multiple exchanges via APIs are attractive targets for attackers seeking access to trading systems. Social engineering attacks, such as fake job offers or meeting invitations, have become common in the industry, as seen in the recent $6.3 billion Binance hack where attackers posed as recruiters. SignalPlus is a derivatives trading platform used by professionals and institutions.
Key Perspectives
SignalPlus: said the attack was detected and contained, with losses under $82,000, and blamed a compromised Telegram account and a fake Teams invitation. The company took responsibility for not requiring IP whitelisting and said it would tighten security controls.
Binance: revoked API keys connected to SignalPlus as a precaution and said its own systems were unaffected. Co-founder Yi He warned other third-party platforms to review security controls, noting the threat extends beyond a single company.
Deribit: revoked API keys and confirmed its own systems were unaffected, but said trading, monitoring and automation through SignalPlus had stopped working for its customers.
What to Watch
- SignalPlus's restoration of services over the next few days and whether any further vulnerabilities are discovered.
- Whether other exchanges or platforms take similar steps to revoke API keys or tighten security in response.
- Any future disclosures linking this attack to known threat groups, given Yi He's mention of North Korea-linked threats.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedSignalPlus said the breach caused losses of less than $82,000.Cointelegraph.com News: “SignalPlus said attackers compromised an engineer’s computer in a breach that resulted in losses of less than $82,000”
- SupportedA fake Microsoft Teams invitation compromised a SignalPlus engineer’s computer.Cointelegraph.com News: “The attacker impersonated the contact and sent a fake Microsoft Teams meeting invitation to a SignalPlus engineer, compromising the employee’s computer.”
- SupportedBinance and Deribit said Thursday they had revoked API keys connected to SignalPlus as a precaution.Cointelegraph.com News: “Exchanges Binance and Deribit said Thursday they had revoked API keys connected to crypto derivatives trading platform SignalPlus as a precaution following a security breach.”
- SupportedBinance and Deribit said their own systems were unaffected.Cointelegraph.com News: “Both exchanges said their own systems were unaffected”
- SupportedSignalPlus pledged to reimburse affected users in full.Cointelegraph.com News: “which the crypto trading platform pledged to reimburse in full.”
- SupportedSignalPlus said the attack originated with a compromised Telegram account belonging to a contact at a third-party technology vendor.Cointelegraph.com News: “According to the company on X, the attack originated from a compromised Telegram account belonging to a contact at a third-party technology vendor.”
- SupportedThe attacker remained dormant on the compromised computer before targeting SignalPlus’s internal network early Wednesday using the engineer’s access privileges.Cointelegraph.com News: “The attacker remained dormant on the compromised computer before using the engineer’s access privileges to target SignalPlus’s internal network early Wednesday, the company said.”
- SupportedSignalPlus acknowledged it had not required IP whitelisting for exchange API access.Cointelegraph.com News: “SignalPlus also acknowledged that it had not required IP whitelisting for exchange API access.”
- SupportedSignalPlus said, “We take responsibility for this oversight,” and said it would tighten API access requirements and strengthen internal security controls.Cointelegraph.com News: ““We take responsibility for this oversight,” the company said, adding that it would tighten API access requirements and strengthen internal security controls.”
- SupportedBinance co-founder Yi He urged third-party platforms integrated with Binance to review security controls and monitor suspicious activity, warning the threat extended beyond one company.Cointelegraph.com News: “Binance co-founder Yi He also urged third-party platforms integrated with the exchange to review their security controls and monitor for suspicious activity, warning that the threat extended beyond any single company.”
- SupportedBinance disclosed details of a $6.3 billion hack on Oct. 29 that involved compromised employee computers.Cointelegraph.com News: “The SignalPlus incident comes days after Binance disclosed details of a $6.3 billion hack on Oct. 29, which also involved compromised employee computers.”
- SupportedYi He said Tuesday that Binance had detected and prevented 57 suspected North Korea-linked cyber threats in 2026.Cointelegraph.com News: “Binance co-founder Yi He said Tuesday that the exchange had detected and prevented 57 suspected North Korea-linked cyber threats in 2026”
