SignalPlus has disclosed losses of less than $82,000 from a cyberattack involving a fake Microsoft Teams invitation, after Binance and Deribit revoked API keys connected to the derivatives trading platform.
Summary
- Less than $82,000 was lost, with SignalPlus promising full reimbursement for all affected users.
- A compromised vendor contact’s Telegram account was used to send an engineer a fake meeting invitation.
- Binance and Deribit revoked SignalPlus-linked API keys, saying their own systems were unaffected.
- SignalPlus acknowledged missing mandatory IP whitelisting and suspended services while reviewing its security.
According to SignalPlus’s Nov. 5 incident statement, the attack affected a small number of accounts without IP whitelisting. The company said it detected suspicious activity early on Nov. 4 and contained the intrusion before contacting its exchange partners to disable connected customer credentials.
Reimbursements had already begun on a case-by-case basis when the statement was published. Users who believe they suffered losses were asked to contact the company so it could verify their claims and begin the repayment process.
SignalPlus traces attack to a fake Teams invitation
The company’s investigation traced the initial compromise to a Telegram account belonging to a contact at one of its third-party technology vendors.
Using the compromised account, the attacker impersonated the contact and approached a SignalPlus engineer with a fake Microsoft Teams meeting invitation. SignalPlus said the social engineering attack compromised the engineer’s computer, where the intruder then remained dormant.
In the early hours of Nov. 4, the attacker began using the employee’s access privileges to target the company’s internal network. After detecting the activity, the team blocked the attack and closed the vulnerabilities it had identified, according to the statement.
SignalPlus subsequently placed all services into maintenance mode while its staff reviewed security and coordinated the removal of exchange API connections.
The platform provides infrastructure for cryptocurrency options and derivatives trading, allowing professional and institutional customers to manage activity across exchanges through one interface.
Exchange access remains available during the suspension
Binance and Deribit said Thursday that they had revoked API keys linked to SignalPlus as a precaution. Binance said its systems were unaffected and customer funds remained safe, while Deribit said its investigation found no indication that its systems or data had been affected.
As previously reported by crypto.news, Binance’s initial API key removal was accompanied by instructions for customers to review positions and open orders directly through the exchange.
Binance advised users to wait until SignalPlus confirms that the issue has been fully resolved before reconnecting their accounts. It recommended enabling IP whitelisting when setting up API access.
Deribit warned that trading, monitoring, and automation through SignalPlus had stopped working for its customers following the revocations.
In its own statement, SignalPlus clarified that disabling an API key does not mean the associated account information or assets were compromised. The precaution applied to all users, including customers whose accounts were not identified as affected.
Customers can still use the exchanges’ official platforms to view and manage their accounts, positions and open orders while SignalPlus remains suspended, the company said.
SignalPlus accepts responsibility for missing API safeguard
SignalPlus acknowledged that it had not made IP whitelisting mandatory for exchange API key access, describing the omission as a gap in its safeguards.
IP whitelisting limits access to specified internet addresses. For an exchange connection, the control restricts where an API key can be used.
“We take responsibility for this oversight,” the company said.
Its planned changes include tighter API access requirements, stronger security for development devices, improved internal access controls and changes to key management. SignalPlus said it would deepen threat intelligence sharing with exchanges, technology partners and security firms.
Binance co-founder Yi He separately urged third-party platforms integrated with the exchange to review security controls, watch for suspicious activity and report concerns immediately.
Services will return in phases after security checks
SignalPlus said it expects to bring services fully back online over the next few days, with restoration taking place in phases after a full review, necessary patches, and confirmation that operations can resume safely.
Progress updates and instructions for customers will be issued through its official channels. The company said its investigation remains ongoing and that it would continue gathering user feedback during the process.
The disclosure follows Binance’s separate Oct. 29 theft involving $6.34 billion in cryptocurrency. In its Nov. 3 postmortem, the exchange described how attackers used fraudulent recruitment interviews, malicious development software, and a compromised internal AI tool to reach its wallet infrastructure.
According to that investigation, stolen deployment credentials eventually allowed the attackers to run a malicious script that accessed wallet signing operations.
