The 3Commas Hack Explained: Leaked Exchange API Keys

Video transcript

In late 2022, 3Commas users saw trades they never placed. After two months of denials, the trading bot platform confirmed that leaked files of users' API keys were genuine.

On October twentieth, 3Commas blamed fake websites for unauthorized trades. On December tenth, it denied any database breach. On December twenty eighth, its CEO confirmed the leaked files were real.

Its FAQ says at least one hundred thousand Binance and KuCoin keys and secrets were exposed. 3Commas says it does not know how attackers got in.

Keys with trading rights let attackers drain balances with counter-trades. To the exchanges, those orders came from valid keys, and a stored key stays valid until someone revokes it.

Reported losses vary. An investor group claimed about twenty two million dollars, per Decrypt. ZachXBT verified fourteen point eight million across forty four victims. 3Commas says it will publish the amount after its investigation.

For teams that store keys: does each key do only its job, limited to known IP addresses? Can you revoke them in minutes? Who can read the key store? Would you notice unusual trades?

Guardian's API Pentest tests what each key can reach. It covers key scoping, endpoint authorization, abuse resistance, surface discovery, authentication and automation triggers.

Read the full article for the timeline and sources, or talk to Guardian about testing what your API keys can reach.

3Commas is a crypto trading bot platform. Users connect their exchange accounts to it with API keys, and 3Commas stores the keys and secrets.

In late 2022, users began reporting trades they had not placed. For two months, 3Commas said its systems had not been breached.

Then, on December 28, it confirmed that leaked files of its users' API data were real. Here is what the company and reputable outlets published, and what the case shows about stored keys.

What Happened

On October 20, 2022, 3Commas was alerted to unauthorized trades placed with exchange API keys. It said the theft happened outside its system, through fake 3Commas websites.

By December, affected users were organizing on Telegram. Their shared document listed unauthorized trades on Binance, Coinbase Pro and KuCoin, Decrypt reported.

On December 10, 3Commas said there had been "no breach of security encryption mechanisms or databases."

It said phishing was "at least in some part a contributory factor." For other cases, it called clipboard malware "the most likely scenario."

On December 11, it called reports of a leak "false rumors shared by bad faith actors using falsified evidence," according to Cointelegraph.

On December 28, attackers posted sample files of 3Commas users' API keys on Pastebin, according to 3Commas. Binance CEO Changpeng Zhao wrote that he was "reasonably sure there are wide spread API key leaks from 3Commas."

The same day, CEO Yuriy Sorokin wrote: "We saw the hacker's message and can confirm that the data in the files is true."

3Commas asked Binance, KuCoin and other supported exchanges to revoke all keys connected to it.

How the Attack Worked

3Commas's own notices set out what leaked. Its December 29 notice says users' "API keys, secrets and passphrases" were disclosed by a third party.

Its FAQ says "at least 100k Binance and Kucoin API keys and secrets" were exposed. Based on the attackers' samples, it believes the intrusion took place in October or November.

How the data was taken

3Commas says criminals "somehow obtained access to part of our database." It says it does not know how they got through, and hired a cyber security expert to find out.

The leaker alleged that an employee sold the data. 3Commas says its internal investigation "found no evidence" that any employee was involved.

What a key could do

A key with trading rights can place orders on the exchange account it belongs to.

In its December 10 update, 3Commas described malicious orders placed on users' exchange accounts "to drain the user's balance with counter-trades."

To the exchange, those orders came from a valid key. Zhao told one user the trades were made "using API keys you created," Cointelegraph reported.

Timeline and Loss

Who reported which loss

• About $22M: claimed by a group of investors organizing on Telegram, per Decrypt (December 23, 2022).
• Over $20M: victim group leader Edmundo Pena's tally, to CoinDesk (December 29, 2022).
• $14.8M across 44 victims: verified by ZachXBT as of December 20, per Decrypt.
• 3Commas: its FAQ says it will publish the amount once its investigation is complete.

The dispute

Before the confirmation, users disputed the phishing explanation. ZachXBT wrote that "it's clear this is not phishing and API keys were stolen," Decrypt reported.

After December 28, victims demanded refunds and an apology, Cointelegraph reported. 3Commas's FAQ says it cannot address compensation until the investigation concludes.

What It Shows

A stored API key is a standing credential. It stays valid until someone revokes it, wherever it is used from.

A platform that stores keys concentrates that risk. Here, 3Commas says at least 100,000 Binance and KuCoin keys and secrets were exposed at once.

Revoking the keys took the exchanges' help. 3Commas asked them to revoke all connected keys, and told users to reissue their own.

Its FAQ lists two fixes: an isolated key store it calls Sign Center, and expanded IP whitelisting.

Questions for teams that issue or store keys

• Can each key do only its job, with withdrawals off and read-only truly read-only?
• Is each key bound to known IP addresses?
• Do keys expire, and can you revoke all of them in minutes?
• Who and what can read the key store, and is that access logged?
• Would you notice a key used from a new place, or for unusual trades?

For the wider practice, see our guide to secrets management for crypto companies.

In the Ledger 2020 data breach, Ledger says access "through an API Key" exposed part of its e-commerce and marketing database.

How API Pentest Tests This

Guardian's API Pentest starts from the same premise: "API keys are long-lived and trusted on every call."

Guardian tests "what each key can reach and what happens when one is used from somewhere new." The service page lists six areas:

• Key scoping: permission granularity, true read-only, IP allowlisting, expiry and instant revocation.
• Endpoint authorization: per-object checks, tenant isolation, mass-assignment and trust in client-controlled parameters.
• Abuse resistance: rate limits, quotas and replay protection, and whether they hold per key.
• Surface discovery: undocumented, deprecated and staging endpoints still reachable in production.
• Authentication: JWT validation, OAuth, session and refresh tokens, 2FA, and recovery paths that bypass them.
• Automation triggers: endpoints that fire relayers, bots or onchain transactions.

It covers REST, GraphQL, gRPC and custom protocols, and tests every endpoint at each privilege level.

The page cites 3Commas: "The keys stayed valid, and the trades they placed were authorized." For where API work fits in a wider assessment, read Web3 penetration testing explained.

Frequently Asked Questions

Was 3Commas hacked?

3Commas confirmed on December 28, 2022 that leaked files of its users' API keys were genuine. It says criminals "somehow obtained access to part of our database" and that it does not know how.

How much was lost in the 3Commas hack?

3Commas says it will publish the amount once its investigation is complete. An investor group on Telegram claimed about $22 million, per Decrypt. ZachXBT verified $14.8 million across 44 victims as of December 20, 2022.

Did a 3Commas employee leak the keys?

The leaker alleged that an employee sold the data. 3Commas said its internal investigation found no evidence that any employee was involved in attacks against the API data.

What does an API pentest test?

Guardian's API Pentest tests what each key can reach and what happens when one is used from somewhere new: key scoping, endpoint authorization, abuse resistance, surface discovery, authentication and automation triggers.

Sources

• 3Commas: Notice on API data disclosure incident (December 29, 2022)
• 3Commas: API leak FAQ for customers (January 2023)
• 3Commas: Update on investigation into API keys and attacks on exchanges (December 10, 2022)
• 3Commas: Security Alert October 20th (October 21 and 23, 2022)
• Decrypt: 3Commas API Dispute Highlights Risks of Algorithmic Trading (December 23, 2022)
• Cointelegraph: 3Commas CEO confirms API key leak following warning from CZ (December 28, 2022)
• Cointelegraph: 3Commas API leak victims demand refunds and apology for 'gaslighting' (December 29, 2022)
• CoinDesk: FBI Investigating 3Commas Data Breach (December 29, 2022)
• Ledger: Addressing the July 2020 e-commerce and marketing data breach (July 29, 2020)