3Commas Hack

Loss unconfirmed Not disclosed
Multi Chain
Exchange API credential exposure

What happened

On December 28, 2022, 3Commas acknowledged exposure of approximately 100,000 customer exchange API keys and secrets. Its subsequent FAQ placed the suspected database intrusion in October or November and explicitly withdrew earlier assumptions that the attacks had not originated in its infrastructure.

Technical root cause

The database exposure was acknowledged, but 3Commas did not establish how the attackers crossed its controls. Earlier phishing explanations cannot be treated as a separately proven cause.

How it happened

  1. Attackers obtained API credentials from part of 3Commas's database, according to the company's investigation.
  2. Sample credentials were published on December 28, exposing Binance and KuCoin connections.
  3. 3Commas asked exchanges to revoke keys, launched a new investigation and contacted law enforcement.
  4. It described isolated credential storage and expanded IP whitelisting as subsequent safeguards.

Protocol details

Classification CeFi / Frontend & Infrastructure
Protocol Type Exploit/Other
Protocol links Website @3commas_io

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes