Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

Deribit

Security incidents tagged Deribit. Newest first.

1 Deribit incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
1
Live
1
Patched
0
Days without an incident
0
Longest quiet run: 3 days (Nov 6–Nov 8)
All tags →

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

  • HighPartly patched

    SignalPlus breached via fake Teams invite; Binance and Deribit revoke linked API keys

    Crypto options/derivatives terminal SignalPlus disclosed on Nov 5 2026 that attackers compromised an engineer through a fake Microsoft Teams invitation sent from a third-party vendor contact's hijacked Telegram account, then used that foothold against SignalPlus's internal network in the early hours of Nov 4. SignalPlus says total losses are under US$82,000, it is reimbursing affected users in full, and it has paused terminal services while it reviews security. As a precaution Binance and Deribit revoked all API keys linked to SignalPlus; both say their own systems were unaffected. SignalPlus acknowledges it had not made IP whitelisting mandatory for exchange API access. Users should manage positions on the exchanges directly and wait for SignalPlus before reconnecting API keys.

    SignalPlus (crypto options / derivatives trading terminal)Since Nov 4, 2026

Posts 3

  • SignalPlus breached via fake Teams invite; Binance and Deribit revoke linked API keys
    SignalPlus
    @SignalPlus_Web3

    TL;DR: In the early hours of Nov 4, SignalPlus was targeted in an attack that began with a compromised third-party Telegram account, affecting a small number of accounts without IP whitelisting. We detected and contained the intrusion quickly. As a precaution, we immediately worked with our CEX partners to revoke all SignalPlus-linked API keys and temporarily paused our terminal services. Total losses are under US$82k, and all affected users will be reimbursed in full. We expect to bring services fully back online over the next few days. Updates and user instructions will be shared through our official channels.

  • SignalPlus breached via fake Teams invite; Binance and Deribit revoke linked API keys
    CZ
    @cz_binance

    If you use SignalPlus for any other exchange platform, it's time to revoke all your API keys. It is generally recommend that you do not store your API keys with any 3rd party platform. (Deribit also/first reported this.)

  • SignalPlus breached via fake Teams invite; Binance and Deribit revoke linked API keys
    Binance
    @binance

    Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure. Binance's own systems are unaffected. User funds remain safe. If you used SignalPlus, please

Sponsored

Buy sponsor slot · $149/mo