3Commas Had a Security Incident. Here's How to Evaluate Trading Bot Security.
A visible security investigation on 3commas.io raises the question every trader should be asking: how do you evaluate trading bot security before you connect your exchange API keys?
The 3commas.io homepage currently displays a security investigation notice. The page references "third-party API data disclosure" and states the company "immediately launched an internal investigation."
That is the full extent of what is publicly visible. No scope. No data volume. No timeline. No statement on affected users. Anyone who tells you they know more than that is speculating.
What we know is enough to ask a more useful question: when you hand your exchange API keys to a trading bot platform, what are you actually handing over, and how do you evaluate whether the platform deserves that trust?
This is a security-evaluation guide. The 3Commas incident is context, not the main event.
What Trading Bot Security Actually Means
A trading bot platform needs API access to your exchange account. That access comes through API keys — credentials that grant the platform the ability to read your balance, execute trades, and in some cases withdraw funds. The security of those keys is the security of your capital.
There are three surfaces that matter:
- API key permissions — what the key is authorized to do
- Key storage architecture — where the key lives when the platform isn't actively using it
- Incident response posture — what happens when something goes wrong
Every trading bot platform — 3Commas, Cryptohopper, any of them — sits on top of these three surfaces. The 3Commas security incident is a reminder that this architecture carries real exposure, not a theoretical one.
The 3Commas Security Incident: What Is Publicly Visible
The 3commas.io homepage contains a reference to an internal security investigation. The page states there was "third-party API data disclosure" and that the company "immediately launched an internal investigation."
No further detail is available on the page itself. 3Commas has not publicly disclosed the scope of the disclosure, the number of affected users, the timeframe, or the specific data involved. The page does not specify whether the disclosure involved API keys, user account data, or other information.
This is what the page says. We state it because it is verifiable. We do not extrapolate beyond it.
What the notice does signal — regardless of scope — is that a platform handling exchange API keys for 500,000+ traders experienced a data disclosure event serious enough to warrant a public investigation notice. For any trader evaluating bot security, that is the context to weigh.
How to Evaluate Trading Bot API Security Before You Connect
1. API Key Permissions: Read-Only vs. Trade vs. Withdrawal
When you create an API key on your exchange, you configure permissions. Most exchanges offer three levels:
- Read-only — view balances, order history, and market data. Cannot place or cancel orders.
- Trade — place and cancel orders. Cannot withdraw funds.
- Withdrawal — move funds out of the account.
A trading bot needs Trade permission to function. It does not need Withdrawal permission. If a platform requests or requires withdrawal-enabled API keys, that is a red flag. No automated trading strategy requires the bot to move funds to an external address.
What to check: When you connect an exchange to a trading bot, does the platform tell you exactly which permissions it needs? Does it explicitly instruct you to disable withdrawal access? If the documentation glosses over permission configuration, the platform is not treating API key security as a first-class concern.
2. IP Whitelisting
Most exchanges support IP address restrictions on API keys. When enabled, the key will only function when requests originate from the whitelisted IP or IP range. This limits the blast radius of a key compromise — even if a key is stolen, it cannot be used from an unauthorized server.
What to check: Does the trading bot platform publish the IP addresses or ranges it uses to connect to exchanges? If so, you can whitelist those IPs on your exchange and reject everything else. If the platform does not document its connection IPs — or uses dynamic infrastructure that prevents whitelisting — your key is effectively unrestricted.
3. Exchange Connection Architecture: Where Do Your Keys Live?
This is the most consequential question, and the one most platforms are least transparent about.
When you paste an API key into a trading bot platform, it has to be stored somewhere. The architecture options span a spectrum:
- Keys stored in plaintext — the platform's database contains the raw API key and secret. Any database access — by an employee, an attacker, or a third-party data disclosure event — exposes the keys directly.
- Keys encrypted at rest — the database contains encrypted key material, and the decryption key is managed separately. Better, but the keys still exist in decryptable form on the platform's infrastructure.
- Keys stored client-side or in a sandboxed execution environment — the platform never holds the keys in a persistent backend. This is rare in cloud-based trading bot platforms because the bot needs to act when you are offline.
- Keys passed through a proxy or gateway with no persistent retention — the platform holds keys transiently to execute orders and discards them between sessions.
3Commas, like most cloud-hosted trading bot platforms, stores API keys server-side to enable 24/7 automated trading. This is architecturally necessary for the product to work. It is also the exact reason that a "third-party API data disclosure" on a platform handling 500,000+ users' keys is a meaningful event, even without knowing the scope.
What to check: Does the platform document its key storage architecture? Does it mention encryption at rest? Does it publish security certifications or audit results? If the platform is silent on how it stores the keys that control access to your exchange accounts, that silence is information.
4. Incident Response: How a Platform Behaves When Something Goes Wrong
Security incidents happen. The differentiator is not whether a platform has ever had one — it is how the platform responds.
A responsible incident response includes:
- Public disclosure — users are told what happened, even if the initial information is incomplete
- Specific guidance — affected users receive actionable instructions (rotate keys, revoke sessions, check for unauthorized trades)
- Timeline commitment — the platform commits to a follow-up disclosure once the investigation concludes
- Post-incident transparency — after the investigation, the platform publishes what it found and what it changed
The notice on 3commas.io states the company "immediately launched an internal investigation." That is an acknowledgment, not a full incident response. The measure of 3Commas's security posture will be what comes after the investigation — whether they disclose scope, whether they provide affected users with guidance, and whether they publish a post-mortem.
What to check: When you evaluate a trading bot platform, search for its incident history. Has the platform had a security event before? How did it handle it? Was the response transparent, or did users learn about the incident from third parties? A platform that has weathered an incident and improved is often more trustworthy than one that has never been tested.
5. Security Certifications and Audits
Formal security certifications are not a guarantee, but their absence is a signal. Look for:
- SOC 2 Type II — demonstrates ongoing adherence to security controls over a defined audit period
- ISO 27001 — information security management system certification
- Penetration test reports — regular third-party security testing, with summaries or attestations published publicly
Most crypto trading bot platforms do not hold these certifications. That is the current state of the industry. But a platform that has invested in a SOC 2 audit or publishes penetration test summaries is making a verifiable claim about its security practices. A platform that has not is asking you to take it on trust.
What to check: Search the platform's website, documentation, and trust center (if one exists) for security certifications. If none are listed, ask support directly. The response — or lack of one — tells you how the platform treats security as a priority.
6. Data Handling and Privacy
API keys are the most sensitive data point, but platforms also collect:
- Account credentials — email, password, 2FA configuration
- Trading history — every order, position, and balance the platform has ever executed or read
- Strategy configurations — the trading logic, parameters, and signals that constitute your intellectual property
- Personal information — name, billing details, KYC documents if applicable
A platform's privacy policy should specify what data is collected, how long it is retained, whether it is shared with third parties, and under what jurisdiction it is stored. If the platform's privacy policy is a generic template with no platform-specific detail, the platform has not thought carefully about the data it holds.
Red Flags to Watch For
When evaluating any trading bot platform — not just 3Commas — these are the signals that should give you pause:
- Requests for withdrawal-enabled API keys. No trading bot needs this. If a platform asks for it, do not connect.
- No documentation on API key storage. If you cannot find information on how the platform stores keys, assume the answer is the one you would least prefer.
- No published incident history or security page. Every platform that operates at scale will face a security event eventually. A platform that does not acknowledge this reality has not prepared for it.
- Obfuscation of security practices. If you ask support about key storage and the response is a marketing deflection ("we take security very seriously") rather than a technical answer, the platform does not have a technical answer to give.
- No IP whitelisting guidance. If the platform does not document its connection IPs, you cannot restrict your key to those IPs, and every compromise vector is open.
What to Do If Your Trading Bot Platform Has a Security Incident
If a platform you use discloses a security event — whether it is 3Commas or any other platform — the response is the same:
-
Revoke your API keys immediately. Go to your exchange, find the API key connected to the platform, and delete it. This is not paranoid. This is the single most effective action you can take. A revoked key is useless to anyone who obtained it through a disclosure event.
-
Generate a new API key with minimum permissions. When you reconnect — if you reconnect — create a fresh key with Trade permission only. Disable withdrawal. Enable IP whitelisting if the platform documents its connection IPs.
-
Check your trade history for unauthorized activity. Compare your exchange's order history against what the platform shows. Any discrepancy — orders you did not place, positions you did not open — is a sign the compromised key was used.
-
Assess whether to remain on the platform. After an incident, the question is not just what happened but how the platform responded. Did they disclose quickly? Did they provide specific guidance? Did they commit to a post-mortem? A platform that handles an incident well is a different calculation than one that minimizes it.
-
Evaluate alternatives. The security incident on 3commas.io is reason enough to ask whether a secure trading bot alternative exists — one that documents its key storage architecture, publishes security certifications, and treats API key safety as a design constraint rather than a marketing afterthought.
The Broader Question
The 3Commas security incident — limited as the public information is — highlights a structural issue in the crypto trading bot space. Every cloud-hosted bot platform holds exchange API keys that grant trading access to user accounts. That is the architecture. The question is not whether a platform will face a security event. It is whether the platform has earned the access it requires.
If you hand over an API key with trade permissions to a platform that does not document its key storage, does not publish security certifications, does not describe its incident response process, and does not instruct you to disable withdrawal access — you are accepting an undefined risk. The 3Commas incident is a reminder that this risk is not theoretical.
Evaluate the architecture. Check the permissions. Read the incident history. And if the platform cannot answer basic questions about how it handles the credentials that control access to your exchange accounts, the absence of an answer is the answer.
You built it. We optimize it.