3Commas hit with second security breach in a year

In a recent blog post, 3Commas disclosed that their internal investigation had uncovered unauthorized access to customer account data


Fit Ztudio/Shutterstock, modified by Blockworks


Trading platform 3Commas has once again come into the spotlight following the disclosure of a security breach on Sunday, affecting a number of user accounts. 

According to the release, the platform received reports from customers about unauthorized trades occurring shortly after their passwords had been reset. 

Following an internal investigation, 3Commas revealed in a blog post that there had been unauthorized access to customer account data. 

The breach is being touted as a limited one, with unauthorized trades being carried out predominantly on accounts of users who had not enabled two-factor authentication (2FA), 3Commas said.

API secret data and account passwords are said not among the compromised information. Blockworks has reached out to learn more.

In response, 3Commas said it has modified its password reset process. The platform claims to have now instituted a policy where all API connections are disabled following a password reset — intended to act as an added security layer. 

Following the incident, the company attempted to reassure its user base that it will continue to “operate in a state of heightened alert.”

The breach on Sunday is reminiscent of an earlier incident in December, where a significant leak led to the API keys of approximately 100,000 3Commas customers being posted publicly by malevolent actors. 

That incident triggered a review of the platform’s security framework, with the company seeking expertise from cybersecurity professionals.

A third related incident in October 2022 prompted former FTX CEO Sam Bankman-Fried, currently on trial for alleged fraud and money laundering charges, to reimburse $6 million to customers affected by a phishing attack.

Multiple security lapses within a year underscore the challenges faced by the trading platform in an ongoing bear market marked by increasing cyber threats.

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

MON - WED, MARCH 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience:  Attend expert-led panel discussions and fireside chats  Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts   Grow your network […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Frax report cover.jpg


Frax saw continued development in its frxETH liquid staking derivative and Fraxlend money market throughout 2023. Frax V3 introduces an RWA strategy to drive utility to the protocol's cornerstone product, the FRAX stablecoin.


MicroStrategy discloses the purchase of 16,000 bitcoin throughout November


Digital asset firms face potential new regulatory landscape under Treasury’s proposed authority expansion


Uniswap Labs will be providing trading APIs to Talos investors through Fireblocks


DYDX supply will climb by up to 80% after the Friday unlock, but a couple factors make a massive sell-off appear unlikely


Switzerland-based Pando Asset, which has crypto products trading on the SIX Swiss Exchange, now looks to the US


Binance does not hold the required licenses to advertise and serve customers in the Philippines, the country’s securities regulator said