3Commas hit with second security breach in a year

In a recent blog post, 3Commas disclosed that their internal investigation had uncovered unauthorized access to customer account data

article-image

Fit Ztudio/Shutterstock, modified by Blockworks

share

Trading platform 3Commas has once again come into the spotlight following the disclosure of a security breach on Sunday, affecting a number of user accounts. 

According to the release, the platform received reports from customers about unauthorized trades occurring shortly after their passwords had been reset. 

Following an internal investigation, 3Commas revealed in a blog post that there had been unauthorized access to customer account data. 

The breach is being touted as a limited one, with unauthorized trades being carried out predominantly on accounts of users who had not enabled two-factor authentication (2FA), 3Commas said.

API secret data and account passwords are said not among the compromised information. Blockworks has reached out to learn more.

In response, 3Commas said it has modified its password reset process. The platform claims to have now instituted a policy where all API connections are disabled following a password reset — intended to act as an added security layer. 

Following the incident, the company attempted to reassure its user base that it will continue to “operate in a state of heightened alert.”

The breach on Sunday is reminiscent of an earlier incident in December, where a significant leak led to the API keys of approximately 100,000 3Commas customers being posted publicly by malevolent actors. 

That incident triggered a review of the platform’s security framework, with the company seeking expertise from cybersecurity professionals.

A third related incident in October 2022 prompted former FTX CEO Sam Bankman-Fried, currently on trial for alleged fraud and money laundering charges, to reimburse $6 million to customers affected by a phishing attack.

Multiple security lapses within a year underscore the challenges faced by the trading platform in an ongoing bear market marked by increasing cyber threats.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates (19).png

Research

Suilend has grown into the top money market and liquid staking provider on Sui. STEAMM, Suilend’s Superfluid AMM, presents a compelling avenue for growing market share within Sui’s DEX landscape and revenue generation for the protocol. Suilend’s multi-product suite position it well for owning market share across key verticals. While current metrics across the Sui ecosystem are likely inflated due to Sui Foundation incentive programs, SEND trades at amongst the lowest multiples in the lend/borrow sector, suggesting that a bull case for continued growth in the ecosystem may be mispriced.

article-image

Single-player and mobile games can still offer robust in-game economies for players

article-image

Polygon and GSR partnered on Katana, angling for a “unified DeFi engine” to concentrate liquidity, recycle yield to users and showcase the AggLayer.

article-image

Decentralized money was a “very unpopular goal” when concepts were proposed in the ’90s, said Nick Szabo

article-image

Cove aims to deliver “risk-adjusted yield” through curated DeFi vaults

article-image

The best capital markets are open to the most people — and crypto capital markets are open to everyone

article-image

Post-conference musings on Firedancer, Kraken, Solana Mobile and Trump