# SignalPlus API compromise: SignalPlus says a fake Teams invite led to a network intrusion; Binance and Deribit revoked its API keys
Source page: https://vaultx.llc/hacks/signalplus-api-hack-november-2026 · VaultX incident report by Sentinel · first published 2026-11-05, updated 2026-11-05
- Date: 2026-11-04
- Reported loss: $82K (SignalPlus reportedly said total losses were less than $82,000; this is a ceiling, not an exact figure. SignalPlus said affected users would be fully reimbursed.)
- Attribution: unknown. SignalPlus described the entry point as a compromised third-party Telegram account used to send a fake Microsoft Teams invite; no attacker was publicly identified in the reports reviewed.
- Status: contained
- Severity: 30/100
- Response score: 75/100 (Disclosure, exchange precautions, admission of the IP whitelisting gap and a reimbursement pledge were reported quickly, but attacker details, forensic depth and the final reimbursement status were not confirmed in the sources.)
According to SignalPlus, an attacker took over a third-party Telegram account, impersonated a vendor contact, and sent a fake Microsoft Teams meeting invite to a SignalPlus engineer, which reportedly compromised the engineer's computer. The intrusion reportedly reached SignalPlus's internal network on November 4, 2026. Binance and Deribit revoked all API keys linked to SignalPlus on November 5 as a precaution, and SignalPlus reportedly put losses below $82,000 and promised full reimbursement.

**What happened**
According to SignalPlus, the incident began in the early hours of November 4, 2026, and was publicly reported on November 5, 2026, after Binance and Deribit revoked all API keys linked to SignalPlus as a precaution.
SignalPlus said the attack started when an attacker gained control of a third-party Telegram account belonging to a vendor contact. The attacker reportedly impersonated that contact and sent a fake Microsoft Teams meeting invite to a SignalPlus engineer. According to SignalPlus, the attacker stayed dormant for a period before using the engineer's privileges to move into its internal network on November 4.
SignalPlus said it detected and contained the intrusion, that total losses were less than $82,000, and that it had begun or would begin full reimbursement of affected users. It also said it would temporarily suspend services or terminal access and tighten API controls. SignalPlus acknowledged that it had not required IP whitelisting for exchange API access and called this an oversight.
On November 5, Binance said its own systems were unaffected and user funds remained safe. Deribit said it found no evidence that its systems or data were affected, but said trading, monitoring and automation through SignalPlus stopped working for some customers. Binance advised users to log in directly, review positions and open orders, and avoid reconnecting keys until the issue was resolved.

**How it worked**
The reporting describes a social-engineering and endpoint-compromise chain rather than a direct exploit of Binance or Deribit. A third-party contact's Telegram account was hijacked and used to deliver a fake Microsoft Teams invite, which reportedly led to compromise of an engineer's machine. The attacker then used the engineer's privileges to reach SignalPlus's internal network.
SignalPlus said its exchange API access did not require IP whitelisting. According to the reports, this meant API access could be used from the compromised workstation or account context. Exchanges then revoked SignalPlus's keys to stop further misuse.

**Where the money went**
No verified report found of how funds moved, of any mixer, bridge or exchange use, or of any freezes or recoveries. SignalPlus reportedly said losses were under $82,000 and that affected users would be reimbursed.

**The response**
According to the reports, SignalPlus detected and contained the intrusion, disclosed the Telegram-account and fake-Teams-invite vector, acknowledged the missing IP whitelisting, said it would suspend services or terminal access and tighten API controls, and said it would fully reimburse affected users. Binance and Deribit revoked its API keys as a precaution.

**Impact**
Automated trading, monitoring and customer connections tied to SignalPlus's exchange API access were disrupted on affected exchanges, according to the reports. Users were told to check positions and orders directly. The reports do not provide a verified price reaction or a verified count of affected users, and the reported loss is small relative to the wider market.

**Timeline**
- 2026-11-04 According to SignalPlus, the intrusion began in the early hours; the attacker reportedly used the engineer's privileges to enter SignalPlus's internal network.
- 2026-11-05 Binance and Deribit revoked all API keys linked to SignalPlus as a precaution. Binance said its systems were unaffected; Deribit said it found no evidence its systems or data were affected.
- 2026-11-05 Binance advised users to check positions and open orders and to avoid reconnecting keys until the issue was resolved. Reports of the incident were published.

**How to protect yourself**
- Use IP whitelisting on every exchange API key so a stolen key cannot be used from an unknown machine.
- Treat unexpected meeting invites, even from known contacts, as suspicious. Confirm them through a separate, trusted channel before opening links or installing software.
- Limit API key permissions to trading or reading as needed, and avoid withdrawal permissions on third-party tools.
- Check your positions, open orders and API connections after any vendor security notice, and reconnect only once the provider confirms the issue is resolved.
- Vendors with privileged access to exchanges should audit third-party contacts, endpoint security and internal network segmentation.

**Still unknown**
- The exact amount lost. The reported figure is a ceiling of under $82,000.
- Whether any funds were stolen by a specific actor, and whether they were moved, traced, frozen or recovered.
- The identity of the attacker or any law-enforcement involvement. No regulator or police action was confirmed in the reports reviewed.
- Whether SignalPlus's reimbursement has been completed, and how many users were affected.
- The precise timing of the dormant period and the full forensic scope of the internal intrusion.
- Whether any assets or blockchains were involved. The reports do not identify tokens or chains.
- Inconsistency in the research: some cited URLs use slugs referring to a '$6.34B' or '$6.4B' hack, which conflicts with the under-$82,000 figure. No source in the research explains this, so it was not used.

**Sources**
- Reuters: Binance removes all SignalPlus API keys after security issue https://www.reuters.com/technology/binance-removes-all-signalplus-api-keys-after-security-issue-2026-11-05/
- LCX: Binance, Deribit revoke SignalPlus API keys after fake Teams invite attack https://lcx.com/en/cryptonews/binance-deribit-revoke-signalplus-api-keys-after-fake-teams-invite-attack
- ChainCatcher: SignalPlus compensation and suspension coverage https://www.chaincatcher.com/en/article/2302092
- Unchained: Binance pulls every SignalPlus API key, tells users to check positions and orders https://unchainedcrypto.com/binance-pulls-every-signalplus-api-key-tells-users-to-check-their-positions-and-orders/
- WHBL: Binance removes all SignalPlus API keys after security issue https://whbl.com/2026/11/05/binance-removes-all-signalplus-api-keys-after-security-issue/
- CoinDesk: Binance cuts SignalPlus access after security warning, urges users to check accounts https://www.coindesk.com/tech/2026/11/05/binance-cuts-signalplus-access-after-security-warning-urges-users-to-check-accounts
- PANews coverage of the SignalPlus incident https://panews.io/articles/01a1ac07-b647-7232-bd73-952857f0ba64
- Cointelegraph: Binance, Deribit revoke SignalPlus API after fake Teams attack https://cointelegraph.com/news/binance-deribit-revoke-signalplus-api-fake-teams-attack
- Bitcoin.com: Binance revokes SignalPlus API access https://news.bitcoin.com/security/binance-revokes-signalplus-api-access-days-after-6-34b-hack/
- Crypto-Economy: Binance revokes SignalPlus API keys https://crypto-economy.com/binance-revokes-signalplus-api-keys/
- Crypto.news: Binance revokes SignalPlus API keys after potential security issue https://crypto.news/binance-revokes-signalplus-api-keys-after-potential-security-issue/
- Cointelegraph: Binance, Deribit revoke SignalPlus API keys after fake Teams attack (alternate link) https://cointelegraph.com/news/binance-deribit-revoke-signalplus-api-fake-teams-attack

---
VaultX: free crypto news and intelligence, https://vaultx.llc