Is 3Commas safe to connect?
Web trading terminal ยท Binance, Bybit, OKX, Bitget, Gate, Kraken, KuCoin, Coinbase, Hyperliquid. Checked 2026-10-25; every line links its source.
Worst case: 3Commas holds API keys that can trade on your exchange account. If they leak (as ~100,000 did in Dec 2022) or are phished, attackers can place orders that drain your balance even without withdrawal rights, and 3Commas' terms cap its liability at the subscription price you paid. A key with withdrawal enabled could be emptied outright.
Safe setup in 3 steps
- Open 3Commas only from 3commas.io (bookmark it) and turn on 2FA on both 3Commas and your exchange; never enter API keys on a site reached from ads, search results or DMs
- Create the exchange API key with trading permission only and withdrawals disabled, restricted to the 3Commas IP addresses shown under My Exchanges > Add exchange (use a dedicated sub-account where your exchange supports it), and use the key only for 3Commas
- Keep only the balance your bots need on that exchange account, and revoke the key at the exchange (not just in 3Commas) if you stop using it or suspect a leak
What it can do with your money
| Who holds the keys | The exchange holds your funds Your coins stay in your account on the exchange you connect (Binance, Kraken, Coinbase, etc.). 3Commas holds the API keys and secrets that let its bots place orders on that account, stored in its 'Sign Center', which it describes as 'a secure API key storage isolated at both infrastructure and access levels'. 3Commas says it 'provides software only' and 'has zero access to withdraw or transfer fiat or cryptocurrencies'. The Dec 2022 leak showed those stored keys are a target. source |
|---|---|
| Can funds be sent out to any address? | No. Only if the key is set up as 3Commas' docs say: 3Commas guides tell you to 'provide TRADING access only and DISABLE the withdrawal option', and Kraken's 3Commas page says withdrawal permission is not required. A key with withdrawal enabled could move funds if leaked. Even a trade-only key can place bad orders on your balance, which is how the 2022 thefts worked (per Bitsgap and Coin Bureau). source |
| What a leaked API key can do | 3Commas' key guide says to give TRADING access only and disable withdrawals. It lists per-exchange permissions: Binance (Spot & Margin Trading and Futures, restrict to trusted IPs), OKX (Trade), Bybit (Read-Write plus Unified Trading), Kraken, KuCoin (Spot Trading), Gate (Read and Write), Bitget (Read-write), Coinbase (Trade). It recommends using the whitelisted 3Commas IP addresses shown under My Exchanges > Add exchange (Gate keys without IP binding last only 90 days, and the guide tells KuCoin users to set IP restriction to 'No'). Another 3Commas help page says to use API keys only for 3Commas and not link the same exchange account to another trading service. Its security page says 'The IP whitelist can be used to restrict the API key to certain IP addresses'. Hyperliquid keys expire about six months after connecting. source |
Official links
- Website:
3commas.io - App:
https://play.google.com/store/apps/details?id=io.threecommas.client.global
Where we confirmed these
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2023-01-09 | Proposed US class action (Freeman et al. v. 3Commas Technologies OU, No. 4:23-cv-00101) alleges 3Commas did not encrypt stored API data, that the breach exposed at least 100,000 consumers and led to nearly $22 million in theft. These are allegations, not findings. | alleged nearly $22M | No ruling or settlement reported on the source page | source |
| 2022-12-28 | API data leak: an anonymous poster published a sample of ~100,000 API keys. After first denying a leak and pointing to phishing, 3Commas confirmed on 2022-12-28 that 'the data in the files is true' and asked Binance, KuCoin and other exchanges to revoke all keys connected to 3Commas. Binance's CEO had urged users to disable keys. The FBI was reported to be investigating. 3Commas says it found no evidence of an insider, and the attackers claimed an employee sold the data. | Traders reported ~$22M stolen (Decrypt); ZachXBT verified 44 victims / $14.8M (Decrypt); HAPI counted 86 victims / $27.3M (ForkLog) | 3Commas urged all users to reissue keys and promised no reimbursement until its investigation ended; HAPI says all exchanges have since disabled 3Commas keys. We found no source for any 3Commas compensation. | source |
| 2022-10-20 | Phishing: lookalike sites captured users' exchange API keys, which were used to place ~20,000 unauthorized trades (DMG and other tokens) on several exchanges. 3Commas said its own systems were not breached at the time; the Dec 2022 leak later contradicted that. | ~$6M claimed across exchanges; 10 confirmed 3Commas users (per 3Commas) | FTX agreed a one-time ~$6M payout (Blockworks); 3Commas reported cloned sites for takedown | source |