Crypto derivatives platform SignalPlus suffered a breach resulting in confirmed losses under $82,000, which the company pledged to reimburse in full. The attack originated from a compromised employee computer after a social engineering campaign targeting a third-party vendor contact.
The attacker impersonated a contact via compromised Telegram, sending a fake Microsoft Teams meeting invitation to a SignalPlus engineer. Early Wednesday, the attacker used the engineer's access to infiltrate SignalPlus's internal network. The company detected and contained the intrusion immediately.
Binance and Deribit revoked API keys connected to SignalPlus as a precautionary measure Thursday. Both exchanges confirmed their own systems remained unaffected. Deribit notified customers that trading, monitoring and automation functions through SignalPlus had ceased. SignalPlus suspended services and expects to restore operations after completing security reviews and applying patches.
SignalPlus acknowledged it had not mandated IP whitelisting for exchange API access—a protocol that restricts API connections to a predefined list of approved internet addresses. The company committed to tightening API access requirements and strengthening internal security controls.
The breach echoes a broader pattern in crypto. Binance disclosed a $6.3 billion hack on Oct. 29 in which attackers posing as recruiters tricked an engineer into downloading malware disguised as a coding assignment. The attack led to unauthorized access to Binance's wallet infrastructure.
Binance co-founder Yi He urged third-party platforms integrated with the exchange to review their security controls, noting the threats extend across the ecosystem. Binance detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages and credential theft attempts.
