Threat watch / Breach
SignalPlus: fake Teams invite compromises an engineer, Binance and Deribit revoke API keys
SignalPlus, a crypto options trading platform, says an attacker used a compromised Telegram account of a vendor contact to send an engineer a fake Microsoft Teams invitation. SignalPlus says it lost $81,897 and has fully compensated the 23 affected users. Binance and Deribit removed all API keys linked to SignalPlus as a precaution.
- Sector
- Finance
- Way in
- Phishing, social engineering
- Product or vendor
- None named
- How it happened
- The attacker compromised the Telegram account of a contact at a third-party vendor, impersonated that contact and sent a SignalPlus engineer a fake Microsoft Teams meeting invitation. The engineer's computer was compromised and the intruder stayed dormant. In the early hours of 4 November the attacker used the engineer's access to target the internal network, according to SignalPlus.[1][2] Checked 8 Nov 2026
- What was stolen
- $81,897 in user funds, according to SignalPlus's later update (first given as under $82,000). SignalPlus says the affected accounts had no IP whitelisting on their exchange API keys and takes responsibility for that oversight. How the funds were moved is not detailed in the sources.[1][2][3] Checked 8 Nov 2026
- Who was impacted
- 23 users, all fully compensated, according to SignalPlus. Their accounts had no IP whitelisting. Binance says its own systems are unaffected and user funds are safe; Deribit says it found no sign that its systems or data were affected. Trading, monitoring and automation through SignalPlus stopped, and SignalPlus plans to restore services in phases.[1][2][3] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Early hours: the attacker uses the engineer's access against SignalPlus's internal network. SignalPlus says it detected and blocked the attack. [1][2]
- Binance and Deribit remove all API keys linked to SignalPlus. SignalPlus confirms the attack on X, says losses are under $82,000 and that it will reimburse users. [1][2]
- SignalPlus says it fully compensated all 23 affected users within 72 hours, for a total of $81,897. It is adding stricter API access rules, IP whitelist checks and tighter controls on employee devices and internal access. Services will resume gradually after a system review. [3]