Is 3Commas Safe? What the 2022 API Key Leak Taught Traders

The most reassuring sentence in crypto automation is “your funds never leave your exchange account.” It is true for almost every serious bot platform. It is also the sentence that lets people stop asking questions, and in late 2022 that was expensive.

So is 3Commas safe? No platform that holds your exchange API keys is safe in an absolute sense, and 3Commas has one of the clearest public records to prove it: a phishing campaign in October 2022, then a disclosure of customer API keys, secrets and passphrases in December 2022 that the company itself confirmed. The honest answer today is narrower. Whether 3Commas is safe for you depends on what the key you hand over is allowed to do, how fast you can kill it, and how much of your capital sits behind it.

Is 3Commas safe? The short answer and why it is incomplete

Is 3Commas safe in 2026? Start with what the record shows, because most of what circulates online is either panic or marketing. 3Commas is an Estonia-linked trading bot platform that connects to exchanges such as Binance and KuCoin through API keys. In 2022 it had two public security incidents, and the company published its own account of both. Neither involved a withdrawal from a customer’s exchange account by the platform itself. Both still cost real people real money.

That distinction is the whole story. Asking “is 3Commas safe” as a yes-or-no question hides the useful part, which is the mechanism. A trade-only API key cannot withdraw funds, and that single design choice is why no one’s balance was simply emptied to an outside wallet. But a key that can place orders can still be abused to place bad ones, and that is exactly what happened.

A safety record is not a verdict on a company’s intentions. It is a map of where the failure modes live. Read it that way and the 2022 incidents teach more than any marketing page, including ours.

Safety in this business is a property of the setup, not of the logo.

What happened in October 2022?

According to the post-mortem 3Commas published on November 1, 2022, the company was alerted on October 20 that unauthorized trades were running through connected exchange accounts. The cause was not a break-in at 3Commas. Attackers had built cloned websites that imitated 3Commas and other crypto services under slightly different web addresses, then asked victims to re-enter their exchange API keys. Those keys were then used to trade through the 3Commas API connections.

The pattern of the trades is the instructive part. By 3Commas’s account, the attacker used several accounts to place roughly 20,000 trades, dumping valuable coins and buying thinly traded tokens, including DMG, MATH and MTA. In other words, the stolen keys were used the way a trade-only key can be abused: not to withdraw, but to force a victim’s account to sell good assets and buy illiquid ones the attacker already controlled.

The company reported that ten users had confirmed losses, less than 0.025% of its more than 100,000 active traders, and put the total claimed loss across exchanges at around $6 million. Those figures are the company’s own, published in its own post-mortem, and should be read as such. FTX agreed to a one-time compensation for its affected customers, and 3Commas stopped accepting new FTX connections that used raw keys.

Anyone asking is 3Commas safe should start from this mechanism. The lesson from October is not exotic. A human typed a valid key into a convincing fake page. No cryptography failed. The weakest part of any key-based system is the person holding the key.

What changed on December 28, 2022?

Two months later the story stopped being about phishing. On December 28, 2022, Binance’s chief executive Changpeng Zhao said publicly that he was reasonably sure of widespread API key leaks from 3Commas and told anyone who had ever entered an exchange key into the platform to disable it immediately. The Block reported the same day that a 3Commas spokesperson confirmed the data in the files posted by an anonymous account was real.

The company’s own notice, dated December 29, 2022 and updated as late as May 21, 2026, states that “some of 3Commas’ users’ API data (API keys, secrets and passphrases) have been disclosed by a third party.” It asked Binance, KuCoin and other supported exchanges to revoke every key connected to 3Commas, urged users to reissue their keys, and said it had engaged law enforcement.

What the notice does not say matters just as much. 3Commas has never established how the data was obtained. Its earlier communications pointed to phishing, malware or disruption activity. Its internal investigation, it says, found no proof of compromised servers or code and no evidence of employee involvement, although the person who posted the data claimed an employee sold it. The company reports that it removed infrastructure access for a small group of technical staff starting November 16, 2022.

Published loss estimates from outside analysts differ widely, and 3Commas has not issued a total for this second incident, so any single number you see quoted deserves suspicion. The verifiable core is smaller and stranger: a platform confirmed that secrets customers had trusted it to hold were out in the open, and the cause is still officially unexplained.

Is 3Commas safe after that disclosure? The disclosure alone cannot answer it, but an unexplained cause is a finding in itself.

What can a leaked trade-only API key actually do?

The answer decides how worried you should be, so it is worth being precise. A trade-only API key can read your balances and positions and can place or cancel orders. It cannot withdraw funds or transfer them to another address. That is the permission model behind the difference between custodial and non-custodial trading bots, and it is a real protection: the worst case is not an emptied account.

The diagram below shows where that line sits. Your money stays on the exchange side, the software acts through a key that can only trade, and the key can be revoked from the exchange at any time.

In words: the funds sit inside your exchange account, the bot reaches in through a narrow door that opens only for orders, and you hold the handle that closes it. That is a real boundary. It is not a guarantee, because the door that opens for orders is still a door.

The October 2022 trades show what an attacker can do through that door. Orders in an account can move value without any withdrawal if the attacker controls the other side of the trade, which is why thinly traded tokens were the tools of choice. With leveraged futures the stakes are higher still, because a hostile order can be sized against borrowed money. Trading leveraged perpetual futures can lose money, up to the whole balance in the account, even when every key is perfectly secure.

So the real question is not whether a key can withdraw. It is how quickly you would find out, and how fast you could shut it off. A trade-only API key on KuCoin is the minimum, not the finish line.

A trade-only key limits the damage; it does not remove the door.

Why does the non-custodial label not settle the question?

Is 3Commas safe because it is non-custodial? That reasoning fails, because the label answers one question, who holds the money, and the 2022 incidents were about a different one: who holds the keys. Nearly every serious bot platform now describes itself as non-custodial. If the label alone made a platform safe, 3Commas, which was non-custodial throughout, would have had no 2022.

The risk moves rather than disappears. With a custodial service, you worry about the company failing with your coins, as the collapse of FTX showed. With a non-custodial one, you worry about the keys sitting in the company’s database, and about every phishing page that imitates it. Both are real, and they fail in different ways.

That is also why the question “is 3Commas safe” cannot be answered by looking at the platform alone. The same platform is safer in the hands of a user who restricts the key to a fixed IP address, funds only a small account, and checks the address bar before typing anything. It is less safe for a user who pastes a key into any page that looks familiar, which is precisely what the October phishing relied on.

It also means a fair reading of the 2022 record applies to everyone in the category, not only one company. Any service that stores exchange keys is a target, and the question is how it limits the blast radius.

A label tells you where the money sits, not where the risk went.

Is 3Commas safe now? What it says it changed since the API key leak

Fairness cuts both ways, so here is the company’s side. In its phishing post-mortem, 3Commas said it was building stronger anti-phishing protocols and IP monitoring to detect impersonating sites, and that it would encourage exchanges to replace manual key entry with OAuth 2.0 connections. It said it implemented a “Sign Center” on November 16, 2022 to limit access to API keys further.

The 2025 and 2026 updates to its notice go further. The company reports stricter encryption, isolated key environments, rate limiting, behavioral analytics, real-time checks against exchange-side key restrictions, user alerts, revocation controls and external reviews by third-party security auditors. These are claims in a document the company wrote about itself. This article could not verify them independently, and the notice names no auditor or audit date, so treat them as intentions with some detail rather than as proof.

That is not a criticism. It is the standard to apply to everyone, including us. A security claim becomes evidence only when it is specific, dated, checkable and independently confirmed, and most claims in this industry never reach that bar.

Reading the later record with the same scepticism you would apply to a rival’s slogan is the only consistent policy.

Is 3Commas safe, and how do you judge any bot platform, including ours?

Begin with what you control. Create the key with trade permission only, never withdrawal, and restrict it to the platform’s published IP addresses wherever the exchange allows. The steps differ by exchange, which is why we wrote them out separately for KuCoin’s trade-only key setup and in our guide to automating Bybit and KuCoin futures without giving up custody. Then fund the connected account with an amount whose total loss you could absorb.

Next, look at how a platform behaves when something goes wrong, because that is where trust is actually tested. Did it publish a dated account of the incident? Did it say what it did not know, or did it deny until the evidence forced a retreat? In October 2022 3Commas said the keys had probably been phished; in December it confirmed the files were real. Both statements are on record, and a careful reader can weigh them.

Then check the claims against the usual scam signals. A platform that promises fixed returns, hides its company details or pushes urgency fails before security even comes up; the red flags of a crypto trading bot scam are worth keeping next to this checklist. And if a vendor shows you a performance curve, learn how to read a trading bot backtest before believing it.

Finally, apply the standard to us. AI Crypto Secrets uses the same basic model: you connect your own KuCoin or Bybit account with a trade-only key that has no withdrawal rights, and the company never holds your funds. That removes the custody risk. It does not remove the key risk this article has been about, nor the market risk of leveraged futures, where losses can reach the entire balance in the account. Nobody in this category, us included, is immune to what happened in 2022, and a vendor who claims otherwise is telling you what to check first.

The best security posture is a key you can kill in seconds and an account you can afford to lose.

Is 3Commas safe to leave connected if you no longer use it?

If you connected a key to 3Commas before the end of 2022 and never replaced it, the notice is unambiguous: reissue it. The same advice applies to any platform you have stopped using. Keys do not expire because you lost interest, and an old key that still has trade permission is a live door nobody is watching.

Log into your exchange, open the API management page and delete every key you do not recognise or no longer use. Check recent order history for trades you did not place. Turn on the exchange’s own alerts for new API activity if it offers them. None of this takes more than ten minutes, and it is the cheapest security upgrade available to a retail trader.

If you want to see how the mechanics work before choosing any platform, how crypto trading bots work from signal to order explains where the key sits in the chain. For a side-by-side look at the exchanges themselves, see our comparison of KuCoin vs Bybit for automated futures trading.

And if you read this far hoping for a clean verdict, here it is. Is 3Commas safe? The question is never settled by a company’s name, only by your own key hygiene, which no platform can do for you.

Sources for the facts above: the 3Commas October 2022 phishing post-mortem, the company’s notice on the API data disclosure incident, and The Block’s report of December 28, 2022.