Crypto
Binance Cuts SignalPlus API Access and Gnosis Pay Reports a Breach as Third-Party Risk Draws Scrutiny
Image: Icons8_team via Pixabay
No fund losses have been reported in either incident, but both follow Binance's record hack and point to exposure through API keys and legacy systems.
By Noris Ortiz ·
Two security incidents this week involving third-party crypto services have put the focus on the tools that connect traders and cardholders to the industry's main platforms, with neither company so far reporting lost customer funds [1][2][3].
On Thursday, November 5, Binance said it had removed all API keys linked to SignalPlus, a Hong Kong-based platform that provides tools for crypto options and derivatives trading. Binance called the step an immediate precautionary measure after SignalPlus reported a potential security issue, Decrypt reported [2]. Binance said its own systems were unaffected and user funds remained safe. Automated strategies that run through SignalPlus stop working until users create new API keys [2].
Binance gave traders a short checklist. They should log in to Binance directly to review positions and open orders, wait for SignalPlus to confirm the issue is resolved before reconnecting, and consider IP whitelisting, which limits a key to approved addresses. It also asked other connected platforms to review their security controls [1][2]. Changpeng Zhao, Binance's co-founder, went further on X, telling users who connect SignalPlus to other exchanges to revoke those keys. He said the derivatives exchange Deribit had also reported the issue and taken similar action, and advised traders not to store API keys with third-party platforms, CoinDesk reported [1].
What actually went wrong at SignalPlus has not been disclosed. Neither CoinDesk nor Decrypt reported details of the issue, affected accounts, losses or a timeline for restoring access, and neither included a statement from SignalPlus [1][2]. CoinDesk explained why such events matter: API keys let outside software trade on an account without a login each time, so a compromised key can be used for unauthorized trades even when withdrawals are switched off [1].
Separately, Gnosis Pay disclosed this week that it detected unauthorized access to the legacy system behind its Gnosis Pay-branded debit cards on November 3. The Block reported that certain customer information was exposed, although the company's disclosure did not specify which data types or how many customers were involved [3]. Gnosis said customer funds were not affected and that its enterprise platform, which powers white-label card programs, was not touched. It contained the incident within two hours, replaced the compromised credentials and fixed the underlying vulnerability. Until the affected system is retired on December 20, online card payments require 3D Secure verification [3].
The Block placed the Gnosis Pay breach in a run of recent incidents at crypto card and payments providers. It cited an attacker's access to an internal dashboard of Based's Visa card program on October 5, a vulnerability in August that allowed unauthorized withdrawals from some Rain Solana card balances, and a September data theft at Revolut involving a fraudulent government-domain request [3].
The incidents arrive while the industry is still dealing with the October 29 Binance hack. Decrypt reported that Binance says the attack began with a fake recruiter persuading an engineer to download a malware-laced coding assignment, and that the exchange has replenished about 98% of the stolen assets from its own funds and has begun reopening withdrawals in phases [2]. CoinDesk described the hack as the largest on record, with roughly half of the funds later frozen by Tether, Circle and others [1].
For markets, the episodes matter mostly for trust and operations. Automated and cross-exchange traders rely on API connections, and an interruption can halt strategies even if no money is taken.
What to watch next: a public explanation from SignalPlus, whether other exchanges follow Binance and Deribit in cutting access, which data Gnosis Pay says was exposed, and further reopening of Binance withdrawals.
Sources:
[1] CoinDesk, "Binance cuts SignalPlus access after security warning, urges users to check accounts", November 5, 2026. https://www.coindesk.com/tech/2026/11/05/binance-cuts-signalplus-access-after-security-warning-urges-users-to-check-accounts
[2] Decrypt, "Binance Cuts Off SignalPlus API Keys Over 'Potential Security Issue' at Trading Platform", November 5, 2026. https://decrypt.co/382599/binance-cuts-off-signalplus-api-keys-over-potential-security-issue-at-trading-platform
[3] The Block, "Gnosis Pay data breach exposes customer info; funds unaffected", November 6, 2026. https://theblock.co/news/defi/2026-11-06-gnosis-pay-data-breach-legacy-debit-card-system-435934
This article was produced with AI assistance. It is for informational purposes only and is not financial advice. StockVolt and its authors may hold positions in securities mentioned.