SignalPlus reports full reimbursement to 23 users after engineer compromise
SignalPlus confirms an engineer compromise via a fake Teams invitation from a hijacked vendor Telegram account. Affected accounts lacked IP allowlisting. SignalPlus says it reimbursed all 23 affected users a total of $81,897 within 72 hours of detection. Partner exchanges suspended linked API keys. Services await a phased restart after review and upgrades.
- Disclosed
- Nov 5, 2026
- Updated Nov 8, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Exchange accounts whose API keys were shared with SignalPlus; Binance confirms revocation, other exchanges need individual checks
- SignalPlus · Binance · API credentials
- In the wild
- Yes
- SignalPlus confirms intrusion and losses and reports full reimbursement.
What happened
SignalPlus’s November 5 statement supersedes the earlier uncertainty about whether an attack occurred. It describes a vendor contact’s hijacked Telegram account, an impersonated Teams meeting invitation that compromised an engineer’s computer, and later use of that engineer’s privileges against the internal network on November 4. The vendor acknowledges it had not made exchange API IP allowlisting mandatory. Confirmed intrusion and user losses raise the rating to L4; credential permissions and final forensic findings remain unpublished.
On November 5 SignalPlus estimated total losses below $82,000 and said it had begun case-by-case reimbursement. Its November 8 report gives the subsequent amount and payment status below. Its summary identifies a small number of affected accounts without IP allowlisting. Precautionary disabling covered all users and does not prove every account’s data or assets were compromised.
Binance’s earlier notice says its own systems are unaffected and funds remain safe in this integration response. That statement does not negate SignalPlus’s later loss assessment or reverse the separate October 29 Binance wallet incident. SignalPlus says all partner exchanges disabled its linked API keys; users should still verify their own accounts, positions and open orders directly. Service recovery remains conditional on review, patches and safe phased reopening. No cause or actor link to the October 29 Binance incident is established.
Coincall downstream guidance, verified November 6: Its November 5 notice independently gives the precautions above for Coincall integrations. This adds actionable exchange-specific guidance; it neither proves Coincall was breached nor establishes automatic key removal, additional losses or completed SignalPlus recovery.
On November 8 SignalPlus reported that it contacted users to verify affected cases and reimbursed all 23 users it identified, totaling $81,897, within 72 hours of detection on November 4. The company also gave $81,897 as the total affected amount. It did not disclose individual payments or provide an independent audit. SignalPlus asks users who suspect additional impact to contact official support for a transaction review.
SignalPlus says it is tightening API access requirements, adding IP allowlist verification and strengthening employee device and internal access controls. It will announce the schedule and user instructions for phased restoration after system review and upgrades. Public copy of the SignalPlus update.
Crime-scene timeline
Nov 4, 2026
SignalPlus detects internal-network attack
Its later statement says an attacker used a compromised engineer’s access in the early hours, after a fake Teams invitation sent through a hijacked vendor contact’s Telegram account. No timezone is specified.
Nov 5, 10:51 UTC
Binance removes every SignalPlus-linked API key
Its original notice identifies a reported potential issue, says Binance systems are unaffected and funds remain safe, and asks users to inspect positions and orders directly before any reconnection.
Nov 5, 11:05 UTC
CZ advises revoking SignalPlus keys on other exchanges
The original follow-up extends the precaution to other exchange integrations. It does not prove those exchanges already revoked keys or suffered a breach.
Nov 5, 13:04 UTC
Coincall publishes its own SignalPlus precautions
Coincall asks current and former integration users to revoke linked keys, inspect trading activity and enable 2FA/IP allowlisting. It reports no information indicating its infrastructure was compromised; this is not a loss or automatic key-removal confirmation.
Nov 5, 13:28 UTC
SignalPlus confirms losses, containment and reimbursement progress
The vendor estimates losses below $82,000, says affected accounts lacked IP allowlisting, all partner-exchange keys were disabled and services paused. Full reimbursements have begun case by case; complete repayment and service recovery are not yet established.
Nov 8, 03:02 UTC
SignalPlus reports full reimbursement to 23 users
It says it paid $81,897 in total within 72 hours of detection on November 4. Security reviews and upgrades continue ahead of a phased restart.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Binance original SignalPlus precautionary noticePrimaryFull public original read in the browser. Confirms all SignalPlus-linked Binance API keys removed, own systems unaffected and funds safe; advises direct position/order review, waiting for resolution and IP whitelisting. The public copy gives 10:51 UTC.
- CZ original cross-exchange precautionPrimaryOriginal advises revoking SignalPlus-linked keys used on other exchanges and mentions an earlier Deribit report. That mention alone does not independently establish Deribit's exact actions or incident scope.
- SignalPlus full original incident responsePrimaryConfirms vendor-contact impersonation, engineer endpoint compromise, internal intrusion, global key disabling and suspension; estimates losses below $82,000 and says case-by-case full reimbursements began. Review and patches precede phased restoration.
- SignalPlus original scope and recovery summaryPrimaryA small number of accounts without IP allowlisting were affected. Full restoration is expected over the next few days, not already complete. The public copy gives 13:28 UTC.
- Coincall official SignalPlus advisory, public article APIPrimaryNovember 5 advisory covers current/historical integrations, user revocation, order review, 2FA, IP restrictions and waiting before reconnection; no information indicating Coincall infrastructure compromise. Public API supplied the full article while HTML access failed.
- SignalPlus reimbursement and hardening updatePrimaryReports completed reimbursement, the affected amount and user count, official support for transaction review, and controls planned before service restoration.