Binance and Deribit revoked API keys connected to SignalPlus over a potential security issue, according to WuBlockchain's November 5 report. At 11:05 UTC, Binance founder Changpeng Zhao urged SignalPlus users on other exchanges to revoke their API keys as well.
The immediate concern is access already granted to a third-party service. Zhao's warning extended beyond the two exchanges reportedly taking action, putting responsibility on users to remove SignalPlus connections elsewhere. The notices describe a potential security issue, rather than a confirmed account takeover or a quantified loss.
The warning extends beyond two exchanges
The reported exchange response and Zhao's instruction address different parts of the same problem. Binance and Deribit can revoke credentials accepted by their own systems. A user who connected SignalPlus to another exchange needs to address that separate connection.
Zhao's wording was direct: "If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys."
Users with several exchange accounts need to review SignalPlus access on each one. Revocation at one exchange is no reason to assume that another exchange has removed its own connection. The warning's cross-exchange scope makes checking each account necessary.
The response also creates an operational decision for traders using SignalPlus. Removing access means accepting an interruption to that connection while the security concern is addressed. Reconnecting immediately would defeat the purpose of the precaution. The instruction is to withdraw the service's authority to interact with accounts.
Trading permission carries its own exposure
Binance's published API security guidance explains that an API key lets software interact with an account within the permissions the user grants. It distinguishes access to balances and trading history from permission to place orders or withdraw assets.
Those distinctions affect the possible consequences of exposed credentials. Read access exposes account information. Trading access permits order placement and cancellation. Withdrawal access permits assets to leave the account.
A trader who disabled withdrawals therefore still has a reason to revoke a suspect connection. Unauthorized trading can damage a portfolio without an attacker withdrawing funds directly. Binance's guidance also warns that API activity may occur without the login alerts users normally associate with an account intrusion.
For SignalPlus users, the relevant question is which permissions the service held on each account. Waiting for a suspicious login notification would be a poor substitute for following the revocation warning.
Exposure varies with permission settings, which determine the actions available through a credential. The reported decision to revoke keys removes that access while the security concern is assessed.
Revocation and account controls address different problems
For an affected user, removing SignalPlus credentials comes before rebuilding an automated workflow. A reasonable follow-up is to review account activity for actions the user did not authorize and contact the exchange through its official support channel if something appears wrong.
Deribit's account security documentation describes controls that can help limit future exposure. Its API settings support IP restrictions, allowing access only from designated addresses. It also recommends setting the API wallet scope to read only to prevent that key from initiating withdrawals.
These controls serve different purposes. An IP restriction narrows the permitted origin of an API request. A withdrawal restriction narrows the actions available through the key. Neither changes the immediate instruction to revoke access implicated in a security warning.
Deribit separately documents two-factor authentication for account access and withdrawal protections, including delays for newly added addresses and secondary email approval. Those settings are useful account controls, but they do not make a third-party connection safe.
Its support guidance also warns that Deribit staff and community managers will not initiate private messages. Users responding to the SignalPlus warning should make account changes through the exchange itself. An unsolicited message proposing to repair the connection introduces another party into an already sensitive process.
Overview
The SignalPlus warning concerns delegated exchange access. WuBlockchain reported that Binance and Deribit revoked connected API keys, while Zhao explicitly urged users to revoke SignalPlus credentials on other exchanges.
For users with SignalPlus connections elsewhere, the instruction is to remove that access. Trading permissions deserve attention alongside withdrawal permissions because they can authorize account activity with financial consequences. Following Zhao's warning means revoking API keys across those other connected exchanges, even if doing so interrupts a trading workflow.
