After SignalPlus reported a potential security issue, Binance disabled all API keys connected to the platform and urged users to check their open positions and orders.
According to a statement reported by CoinDesk, the exchange cut off SignalPlus, a third-party trading platform, from accessing Binance accounts as a precaution. Users who trade through SignalPlus were asked to log in to their accounts directly through Binance and review their existing trades.
The exchange also said that API keys should not be reconnected until SignalPlus confirms that the issue has been resolved.
Trading risks can arise even when withdrawals are disabled
SignalPlus provides tools and analytics for digital asset options trading. API keys allow external applications like this to connect to an exchange account and place orders without requiring the user to log in each time.
If this access is compromised, unauthorized trading may be possible even when withdrawal permissions are disabled. This trading access is why Binance asked users to check their open positions and pending orders.
Binance says its own systems were not affected
Binance said that its own systems were not affected by the incident and that customer funds are safe. It recommended that users enable an IP allowlist, which limits API access to previously approved IP addresses. It also urged other connected platforms to review their security controls.
CZ also warns users about other exchanges
Binance co-founder Changpeng Zhao (CZ) recommended that users revoke the API keys they gave SignalPlus on other exchanges as well. Zhao said Deribit had also reported the issue and warned against storing API keys on third-party platforms.
Not investment advice.