CZ Urges Traders to Revoke SignalPlus API Keys as Binance Removes Access

BSCN·2026-11-05 11:31:55 UTC

Binance founder Changpeng Zhao (CZ) urged traders to revoke SignalPlus API keys on all exchanges after Binance removed linked keys over a potential security issue reported by SignalPlus.

Changpeng Zhao (CZ) (@cz_binance), the founder of @Binance, has urged traders who use @SignalPlus_Web3 to revoke their API keys on any exchange they trade with, after a potential security issue was reported at the third-party trading platform.

"If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys," Zhao wrote on X. He added that it is generally recommended not to store API keys with any third-party platform. Zhao noted that Deribit also reported the issue first.

Binance and Deribit Remove SignalPlus Access

According to a Binance announcement, the exchange took precautionary measures and proactively removed all API keys associated with SignalPlus after the platform reported a potential security issue. Binance said its own systems were not affected and that user funds are safe.

@DeribitOfficial took similar action. Deribit told users it had removed SignalPlus-linked API keys from affected accounts as a precaution, and said its investigation had so far found no sign that its systems or data were affected. Trading, monitoring and automation run through SignalPlus have been halted.

What Traders Are Advised to Do

Binance advised SignalPlus users to log in directly to their Binance accounts to check positions and open orders. It recommended not re-binding any API keys until SignalPlus confirms the issue is fully resolved, and urged users to enable the IP whitelist feature. Deribit similarly advised users to review open orders, positions and recent account activity, and to create new keys with IP whitelisting and two-factor authentication once SignalPlus confirms connections can be restored.

Binance co-founder Yi He also encouraged all third-party platforms integrated with Binance to review their own security controls and monitor for anomalous activity, saying this is not a challenge any single company can handle alone.

Traders who connected SignalPlus to other venues should check those accounts and revoke the relevant keys, as CZ advised. An API key lets software interact with an account within the permissions the user grants, so removing it cuts off that access while the security concern is assessed. The full scope of the SignalPlus issue has not been detailed in the reports reviewed.