Binance and Deribit revoke API keys after security breach

Major cryptocurrency exchanges Binance and Deribit have taken immediate action to protect users after a security breach targeting the SignalPlus platform. The exchanges confirmed today that they have revoked all existing API keys connected to the service. This decision follows reports of a sophisticated attack where malicious actors used fake Microsoft Teams meeting invitations to gain unauthorized access to user accounts.

The attack vector involved sending seemingly legitimate meeting requests that contained harmful software. Once a user engaged with the link, the perpetrators were able to compromise the API keys stored on the individual's machine. Because these keys allow for automated trading, the attackers were theoretically capable of executing unauthorized transactions on behalf of the victims.

Security teams at both exchanges identified the pattern quickly and moved to disable access to prevent further losses. By revoking the keys, the platforms have effectively severed the link between the compromised SignalPlus accounts and the exchange wallets. Users are now being instructed to generate new API keys if they wish to continue using automated trading tools, provided they have fully secured their local environments first.

This incident serves as a reminder of the dangers associated with third party integrations in the crypto space. Even when a service is well known, the security of the end user is often the weakest link. Phishing attempts delivered through professional communication tools like Teams can be highly effective, as they appear to originate from trusted sources or standard business workflows.

Both Binance and Deribit are currently conducting a forensic review of the activity to determine the extent of the damage. They have stated that they are working with cybersecurity experts to improve detection methods for similar attacks in the future. Affected users are being notified directly through official channels and are encouraged to check their transaction history for any irregularities.

In the wake of this breach, traders are urged to review their security protocols. It is recommended that users disable any unused API keys and ensure that they are not granting excessive permissions to external software. Maintaining strict control over account access is essential for any trader operating in the 2026 market environment where attackers are becoming increasingly creative with their methods.