SignalPlus Says Third-Party Telegram Account Compromise Led to Attack; Losses Under $82,000 to Be Fully Reimbursed
SignalPlus Says Third-Party Telegram Account Compromise Led to Attack; Losses Under $82,000 to Be Fully Reimbursed
SignalPlus, a crypto derivatives trading platform, said an attacker gained access through a compromised third-party Telegram account in the early hours of November 4. The incident affected a small number of accounts that had not enabled an IP whitelist, according to the platform.
In its November 5 update, SignalPlus estimated total losses at less than $82,000 and said affected users would receive full reimbursement. The company also said it had contained the intrusion, suspended its terminal as a precaution, and worked with centralized exchange partners to revoke associated API keys.
The incident highlights a risk for traders who connect exchange accounts to outside tools: an exchange account can remain secure at the platform level while a connected service or its credentials become a point of exposure.
What Happened at SignalPlus?
SignalPlus attributed the attack to the compromise of a third-party Telegram account. It said the affected group consisted of a limited number of users whose accounts did not have IP whitelisting enabled.
The available account of the incident does not establish exactly how the compromised Telegram account was used or identify every action taken by the attacker. It also does not specify the reimbursement process or timeline.
As part of its response, SignalPlus said it:
- Contained the intrusion after detecting it.
- Coordinated with centralized exchange partners to revoke linked API keys.
- Temporarily suspended terminal services.
- Planned to fully reimburse affected users.
- Expected services to resume fully within the following few days, with updates and instructions to be shared through official channels.
Users should treat the restoration estimate as a target rather than a guarantee and wait for a confirmed update before reconnecting any exchange account.
Binance Revoked Associated API Keys
Binance also said it had proactively revoked all API keys associated with SignalPlus after learning of the potential security issue. The exchange stated that its own systems were not affected and that user funds were safe.
Binance advised SignalPlus users to log in to their Binance accounts directly and review both open positions and outstanding orders. It also warned users not to reconnect API keys until SignalPlus confirms that the issue has been fully resolved.
For derivatives traders, this review matters even when access has already been revoked. Existing orders and positions may still need attention: revoking an API key prevents further use of that key, but users should not assume it automatically closes positions or cancels every existing order.
Why API Permissions Matter
API keys allow trading tools to interact with an exchange account without requiring a user to repeatedly enter their login credentials. Depending on the permissions granted, a connected application may be able to read account information, place trades, or perform other supported actions.
That convenience creates a separate security responsibility. A user who trusts an exchange must also assess each service connected to it and limit what that service can do.
An IP whitelist adds a restriction by allowing a key to be used only from approved network addresses. This can reduce exposure if credentials are stolen, although it is not a substitute for careful permissions management or ongoing account monitoring.
Exchange API capabilities and security settings vary. Users can consult the Binance API documentation and their exchange’s current account settings before creating or modifying a key.
Steps for Affected Users
If you connected SignalPlus to an exchange, consider the following precautions:
- Access the exchange directly. Use the exchange’s official app or a saved address rather than a link in an unexpected message.
- Review positions and open orders. Check for activity you do not recognize and assess whether existing derivatives exposure still matches your intentions.
- Inspect connected API keys. Confirm the status of keys associated with SignalPlus and remove any that are no longer needed.
- Wait for official restoration guidance. Do not create or reconnect a key simply because a message claims service has resumed.
- Use the narrowest permissions practical. When reconnecting a tool, enable only the access needed for its intended function and use an IP whitelist where supported.
- Watch for impersonation attempts. Attackers may use a security incident as a pretext for fake support or reimbursement messages. Never share passwords, API secrets, or recovery phrases in response.
If you find suspicious activity, contact your exchange through its official support channels and preserve relevant account records.
A Broader Lesson for Crypto Security
The SignalPlus incident illustrates how a compromise outside an exchange can affect users who rely on connected trading infrastructure. Account security therefore extends beyond protecting an exchange password: it also includes reviewing integrations, limiting API permissions, and monitoring positions.
For assets held outside an exchange, a hardware wallet such as OneKey can help users protect private keys in self-custody. It does not, however, secure an exchange API key or prevent unauthorized trading through a connected service. Those risks require separate controls at the exchange and application levels.
