Sebastian Sinclair

Trading platform 3Commas has once again come into the spotlight following the disclosure of a security breach on Sunday, affecting a number of user accounts.&nbsp;



According to the release, the platform received reports from customers about unauthorized trades occurring shortly after their passwords had been reset.&nbsp;



Following an internal investigation, 3Commas revealed in a <a href="https://3commas.io/blog/important-security-update-notice-of-incident">blog post</a> that there had been unauthorized access to customer account data.&nbsp;



The breach is being touted as a limited one, with unauthorized trades being carried out predominantly on accounts of users who had not enabled two-factor authentication (2FA), 3Commas said.



API secret data and account passwords are said not among the compromised information. Blockworks has reached out to learn more.



In response, 3Commas said it has modified its password reset process. The platform claims to have now instituted a policy where all API connections are disabled following a password reset — intended to act as an added security layer.&nbsp;



Following the incident, the company attempted to reassure its user base that it will continue to “operate in a state of heightened alert.”



The breach on Sunday is reminiscent of an earlier incident in December, where a significant leak led to the API keys of approximately 100,000 3Commas customers being posted publicly by malevolent actors.&nbsp;



That incident triggered a <a href="https://3commas.io/blog/api-security-incident-faq">review</a> of the platform&#8217;s security framework, with the company seeking expertise from cybersecurity professionals.



A third related incident in October 2022 prompted former FTX CEO Sam Bankman-Fried, currently on trial for alleged fraud and money laundering charges, to reimburse <a href="https://blockworks.co/news/ftx-to-reimburse-6m-to-3commas-phishing-attack-victims">$6 million</a> to customers affected by a phishing attack.



Multiple security lapses within a year underscore the challenges faced by the trading platform in an ongoing bear market marked by <a href="https://blockworks.co/news/upbit-aptos-withdrawals-security">increasing cyber threats</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

3Commas hit with second security breach in a year

Bessie Liu

Caution is advised for crypto traders using automated trading bot platform 3Commas after reports indicate millions of dollars has been stolen from exchange accounts.



Binance CEO Changpeng Zhao (CZ) tweeted Wednesday that he was “reasonably sure” that application programming interface (API) keys tied to 3Commas users had been shared online.&nbsp;



“If you have ever put an API key in 3Commas (from any exchange), please disable it immediately,” Zhao tweeted, following up an earlier <a href="https://twitter.com/tier10k/status/1608186096411725826" target="_blank" rel="noreferrer noopener">warning</a> from industry watcher tier10k.



3Commas users seeking to automate plays across multiple exchanges and markets can link their trading accounts via specially-generated API keys and secret combinations. These allow the 3Commas bot engine to execute trades on users’ behalf, making their security paramount.



API keys and secret combinations linked to Binance and KuCoin exchange accounts of 3Commas users were said to have been leaked. This was later confirmed by Yuriy Sorokin, co-founder of 3Commas in a <a href="https://twitter.com/YS_3Commas/status/1608202390121111552" target="_blank" rel="noreferrer noopener">tweet</a>:



“We saw the hacker’s message and can confirm that the data in the files is true,” Sorokin said. “As an immediate action, we have asked that Binance, KuCoin, and other supported exchanges revoke all the keys that were connected to 3Commas.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">3. Only a small number of technical employees had access to the infrastructure and we have taken action since November 19 to remove their access.&mdash; Yuriy Sorokin (@YS_3Commas) <a href="https://twitter.com/YS_3Commas/status/1608202556945178630?ref_src=twsrc%5Etfw">December 28, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Confirmation of the leak comes after months of speculation over 3Commas security, alongside targeted phishing campaigns on the platform’s users.&nbsp;



Three FTX users utilizing the platform were phished in October; bad actors had mimicked its interface on malicious sites intended to trick traders into giving up their API keys and combinations.



Now-disgraced FTX founder Sam Bankman-Fried then <a href="https://blockworks.co/news/ftx-to-reimburse-6m-to-3commas-phishing-attack-victims" target="_blank" rel="noreferrer noopener">offered $6 million to compensate the victims</a>, although doing so would be a one-off. 3Commas had so far denied any API leaks had taken place.



<h3 class="wp-block-heading">More than $15 million may have been stolen from 3Commas users to date</h3>



By Dec. 8, Twitter personality CoinMamba had complained of losing funds on Binance via an exploited 3Commas API. Binance later suspended their account. 



Both Binance and 3Commas declined to reimburse the user, claiming it was impossible to verify whether the API key had been stolen.



At around the same time, screenshots of leaked 3Commas API keys were circulating across social media. Sorokin claimed in a <a href="https://3commas.io/blog/fake-screenshot-cloudflare-logs" target="_blank" rel="noreferrer noopener">blog post</a> that the screenshots were fake, and urged any affected users to file police reports.



“&#8230; We have implemented new security measures and will not stop there; we are launching a full investigation involving law enforcement,” <a href="https://twitter.com/YS_3Commas/status/1608202610972184577" target="_blank" rel="noreferrer noopener">tweeted</a> Sorokin on Wednesday. 



“We are sorry that this has gotten so far and will continue to be transparent in our communications around the situation.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Also there is no way for us to know if API keys were leaked by Binance itself. As I mentioned before, you should reset all API keys to prevent this from happening. Also seize the funds from exploiter and return the funds to users.&mdash; CoinMamba (@coinmamba) <a href="https://twitter.com/coinmamba/status/1601194247625248769?ref_src=twsrc%5Etfw">December 9, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The cat is now squarely out of the bag, but the total value of lost crypto — as well as the number of victims — is still unclear. 



On-chain researcher ZachXBT last week said they&#8217;d confirmed 44 <a href="https://twitter.com/zachxbt/status/1605235174970916864" target="_blank" rel="noreferrer noopener">instances</a> with combined losses of $14.8 million. &#8220;These are just ones where identity and account ownership were verified. The real number of victims is certainly higher,&#8221; they tweeted.



David Canellis contributed reporting.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.