Hacks & scams / Exchange breach
30severity
Exchange breachcontained
SignalPlus API compromise: SignalPlus says a fake Teams invite led to a network intrusion; Binance and Deribit revoked its API keys
2026-11-04 · updated 2026-11-05 20:45 UTC · by Sentinel, VaultX incident desk
Reported loss$82,000SignalPlus reportedly said total losses were less than $82,000; this is a ceiling, not an exact figure. SignalPlus said affected users would be fully reimbursed.
Attributionunknown. SignalPlus described the entry point as a compromised third-party Telegram account used to send a fake Microsoft Teams invite; no attacker was publicly identified in the reports reviewed.
Response score75/100Disclosure, exchange precautions, admission of the IP whitelisting gap and a reimbursement pledge were reported quickly, but attacker details, forensic depth and the final reimbursement status were not confirmed in the sources.
Severity30/100Reported losses are capped below $82,000, but the incident disrupted derivatives API access for some customers and highlights third-party access risk.
According to SignalPlus, an attacker took over a third-party Telegram account, impersonated a vendor contact, and sent a fake Microsoft Teams meeting invite to a SignalPlus engineer, which reportedly compromised the engineer's computer. The intrusion reportedly reached SignalPlus's internal network on November 4, 2026. Binance and Deribit revoked all API keys linked to SignalPlus on November 5 as a precaution, and SignalPlus reportedly put losses below $82,000 and promised full reimbursement.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
What happened
According to SignalPlus, the incident began in the early hours of November 4, 2026, and was publicly reported on November 5, 2026, after Binance and Deribit revoked all API keys linked to SignalPlus as a precaution.
SignalPlus said the attack started when an attacker gained control of a third-party Telegram account belonging to a vendor contact. The attacker reportedly impersonated that contact and sent a fake Microsoft Teams meeting invite to a SignalPlus engineer. According to SignalPlus, the attacker stayed dormant for a period before using the engineer's privileges to move into its internal network on November 4.
SignalPlus said it detected and contained the intrusion, that total losses were less than $82,000, and that it had begun or would begin full reimbursement of affected users. It also said it would temporarily suspend services or terminal access and tighten API controls. SignalPlus acknowledged that it had not required IP whitelisting for exchange API access and called this an oversight.
On November 5, Binance said its own systems were unaffected and user funds remained safe. Deribit said it found no evidence that its systems or data were affected, but said trading, monitoring and automation through SignalPlus stopped working for some customers. Binance advised users to log in directly, review positions and open orders, and avoid reconnecting keys until the issue was resolved.
How it worked
The reporting describes a social-engineering and endpoint-compromise chain rather than a direct exploit of Binance or Deribit. A third-party contact's Telegram account was hijacked and used to deliver a fake Microsoft Teams invite, which reportedly led to compromise of an engineer's machine. The attacker then used the engineer's privileges to reach SignalPlus's internal network.
SignalPlus said its exchange API access did not require IP whitelisting. According to the reports, this meant API access could be used from the compromised workstation or account context. Exchanges then revoked SignalPlus's keys to stop further misuse.
Timeline
- 2026-11-04According to SignalPlus, the intrusion began in the early hours; the attacker reportedly used the engineer's privileges to enter SignalPlus's internal network.
- 2026-11-05Binance and Deribit revoked all API keys linked to SignalPlus as a precaution. Binance said its systems were unaffected; Deribit said it found no evidence its systems or data were affected.
- 2026-11-05Binance advised users to check positions and open orders and to avoid reconnecting keys until the issue was resolved. Reports of the incident were published.
Where the money went
No verified report found of how funds moved, of any mixer, bridge or exchange use, or of any freezes or recoveries. SignalPlus reportedly said losses were under $82,000 and that affected users would be reimbursed.
The response
According to the reports, SignalPlus detected and contained the intrusion, disclosed the Telegram-account and fake-Teams-invite vector, acknowledged the missing IP whitelisting, said it would suspend services or terminal access and tighten API controls, and said it would fully reimburse affected users. Binance and Deribit revoked its API keys as a precaution.
Market and user impact
Automated trading, monitoring and customer connections tied to SignalPlus's exchange API access were disrupted on affected exchanges, according to the reports. Users were told to check positions and orders directly. The reports do not provide a verified price reaction or a verified count of affected users, and the reported loss is small relative to the wider market.
What people say
40% negative · 5% positive · the rest neutral · themes: API key revocation and trading disruption, security oversight (no IP whitelisting), social-engineering and phishing risk, promised reimbursement, exchange precautions and user-fund safety
How to protect yourself
- Use IP whitelisting on every exchange API key so a stolen key cannot be used from an unknown machine.
- Treat unexpected meeting invites, even from known contacts, as suspicious. Confirm them through a separate, trusted channel before opening links or installing software.
- Limit API key permissions to trading or reading as needed, and avoid withdrawal permissions on third-party tools.
- Check your positions, open orders and API connections after any vendor security notice, and reconnect only once the provider confirms the issue is resolved.
- Vendors with privileged access to exchanges should audit third-party contacts, endpoint security and internal network segmentation.
Check a walletScan a tokenStill unknown
- The exact amount lost. The reported figure is a ceiling of under $82,000.
- Whether any funds were stolen by a specific actor, and whether they were moved, traced, frozen or recovered.
- The identity of the attacker or any law-enforcement involvement. No regulator or police action was confirmed in the reports reviewed.
- Whether SignalPlus's reimbursement has been completed, and how many users were affected.
- The precise timing of the dormant period and the full forensic scope of the internal intrusion.
- Whether any assets or blockchains were involved. The reports do not identify tokens or chains.
- Inconsistency in the research: some cited URLs use slugs referring to a '$6.34B' or '$6.4B' hack, which conflicts with the under-$82,000 figure. No source in the research explains this, so it was not used.
Related on VaultX
Polymarket (international platform) third-party script exploit: Polymarket halts…Hack report · On 2026-10-29 Polymarket paused trading on its international platform after users reported drained…Binance multi-chain hack (TraderTraitor-linked): Binance loses a reported ~$6.3B across…Hack report · Binance disclosed a security incident on Oct. 29, 2026. Reports put the loss at about $6.3B, taken…Unnamed EU entity – centralized exchange account theft: Unnamed EU entity reportedly…Hack report · According to reporting based on on-chain analysis by ZachXBT, an unidentified EU-based entity lost…Pi Network review: CautionReview · Mobile-mining project with huge community but years of delays, KYC bottlenecks, and regulatory…Binance review: CautionReview · Huge, widely used exchange, but regulator actions, withdrawal complaints and a reported hack weigh…Bitcoin Slides Below $77,000 as Tech Sell-Off Spreads to CryptoNews · Bitcoin fell toward $77,000 on Oct. 30 as a tech-led sell-off hit stocks and crypto, with reports…Binance reports ~$6.3B hack; withdrawals resume in phases, $3.64B net outflowNews · Binance's hot wallets lost an estimated $6.3B, reportedly tied to North Korea. Withdrawals resumed…Binance reopens withdrawals in phases after hack-driven haltNews · Binance starts reopening withdrawals in phases after a multi-day halt linked to a reported $6.3B…CEX (centralized exchange)Glossary · A CEX is a company-run exchange such as Coinbase or Binance that holds your coins in an account.Self-custodyGlossary · Self-custody means you hold your own keys and therefore your own coins, instead of trusting an…Hot and cold walletsGlossary · A hot wallet is connected to the internet (an app or browser extension); a cold wallet keeps keys…
Sources
- Reuters: Binance removes all SignalPlus API keys after security issue
- LCX: Binance, Deribit revoke SignalPlus API keys after fake Teams invite attack
- ChainCatcher: SignalPlus compensation and suspension coverage
- Unchained: Binance pulls every SignalPlus API key, tells users to check positions and orders
- WHBL: Binance removes all SignalPlus API keys after security issue
- CoinDesk: Binance cuts SignalPlus access after security warning, urges users to check accounts
- PANews coverage of the SignalPlus incident
- Cointelegraph: Binance, Deribit revoke SignalPlus API after fake Teams attack
- Bitcoin.com: Binance revokes SignalPlus API access
- Crypto-Economy: Binance revokes SignalPlus API keys
- Crypto.news: Binance revokes SignalPlus API keys after potential security issue
- Cointelegraph: Binance, Deribit revoke SignalPlus API keys after fake Teams attack (alternate link)
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
Get new hack reports as they happen
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice. 
VaultX