Binance announced on Thursday that it had removed every API key associated with the third‑party trading infrastructure provider SignalPlus. The move follows the discovery of a potential security vulnerability within SignalPlus that could have allowed unauthorized access to Binance accounts linked through the service. While Binance confirmed that its own platforms were unaffected and that customer assets remain secure, the exchange urged users to monitor their positions and refrain from re‑binding new keys until SignalPlus resolves the issue.

SignalPlus and its role in automated trading

SignalPlus offers analytics and execution tools for cryptocurrency derivatives, enabling traders to manage strategies across exchanges via API connections. By allowing third‑party applications to act on behalf of users without moving assets off‑exchange, the service streamlines automated trading but also introduces risk if API credentials are compromised.

Binance’s response and user guidance

In a public statement, Binance said the revocation was a proactive measure to prevent possible unauthorized activity. The exchange emphasized that no breach of its internal systems has been detected and that no financial losses have been reported. Affected users are instructed to log into their Binance accounts directly, review open orders and positions, and consider enabling IP whitelisting for any future API integrations. Binance also called on other third‑party platforms to audit their security controls and report any concerns promptly.

Broader implications for third‑party integrations

The incident highlights ongoing security challenges in the crypto ecosystem, where many traders rely on external tools for execution and analytics. Similar API‑related incidents have occurred previously, such as the 2022 exposure of credentials from the 3Commas platform, prompting multiple exchanges to revoke keys. Experts suggest that users should limit API permissions to only necessary functions and regularly rotate credentials to mitigate risk.

What to watch next

Observers will be monitoring SignalPlus for a detailed technical report on the vulnerability and any remediation steps. Binance’s next actions—whether to restore connections or impose additional safeguards—will also be closely followed, as will any regulatory commentary on third‑party API security in the broader cryptocurrency market.