A systemic flaw in Binance’s IP Whitelisting model: listenKeys bypass the protection entirely
Source Reddit NetSec
Description
A design flaw in Binance's API IP whitelisting allows the listenKey, used for WebSocket streams, to bypass IP restrictions entirely. While the API key itself is protected by IP whitelisting, the listenKey can be created without a secret or signature and is not subject to IP restrictions. If a listenKey leaks through logs, third-party tools, or browser extensions, it can be reused from any IP, exposing sensitive real-time trading data such as balances, open orders, and liquidation events. This issue does not lead to direct account takeover or fund theft but results in significant market intelligence leakage. Many users mistakenly rely on IP whitelisting as a final security barrier, unaware that listenKeys circumvent this protection. The flaw was responsibly disclosed but not remediated, leading to public disclosure. European organizations using Binance APIs or trading bots should be aware of this risk and take additional precautions.