First drained 3Commas-connected accounts
Users of 3Commas with exchange API keys report unauthorized trades; a self-reported $30,000 loss on a key that was only ever given to 3Commas. 3Commas attributes the wave to phishing.
Security incident timeline
The events that shaped bot-trading security - documented, dated, sourced. We factor vendor response quality into our safety scores.
CZ publicly warns against third-party bot platforms
Binance CEO tweets a warning about unexpected trading on accounts that shared API keys with third-party platforms including 3Commas and Skyrex; Skyrex confirms it was hacked. 3Commas publicly denies any leak.
Thanksgiving Coinbase Pro attacks
Multiple Coinbase Pro accounts connected to 3Commas suffer coordinated drain trades through illiquid pairs (JASMY-style pump-and-dump against attacker wallets). Documented single losses include $150k (1,300 unauthorized transactions) and ~$370k from a ~$500k account. Withdrawal rights were NOT required for the attack.
Leaked database: ~100,000 API keys published
An anonymous leaker publishes a claimed 100,000 API keys tied to 3Commas (Binance, Coinbase Pro, KuCoin, Kraken, OKX and others). 3Commas CEO confirms the breach; a Binance user reports 0.63 BTC lost via 67 unauthorized trades in 9 minutes. Victim groups estimate collective losses above $20 million.
KuCoin victim loses 99% of balance after "keys disabled" notice
A KuCoin user reports that both KuCoin and 3Commas notified him the leaked keys were disabled - ten days later ~99% of his balance was traded away overnight. Lesson: revoke keys yourself, immediately.
Aftermath: BlueVoyant audit, IP-whitelisted Fast Connect
3Commas engages cybersecurity firm BlueVoyant and rolls out OAuth/IP-whitelisted Fast Connect for major exchanges. Binance tightens API key policies in response, which self-hosted bot users with dynamic IPs report as disruptive.
Bybit hacked: ~$1.5B stolen - largest crypto heist on record
Attackers steal ~$1.5B in ETH/stETH from Bybit cold wallets via a compromised Safe{Wallet} signing interface, attributed to Lazarus Group. Exchange-level incident: bot users' funds sit on Bybit. Bybit covers all customer losses and restores withdrawals within days.
OKX pleads guilty, ~$500M penalties (unlicensed US money transmission)
OKX operators plead guilty to operating an unlicensed money-transmitting business that historically served US users; Reuters reports a ~$505M settlement. Compliance overhaul follows; bot product continues.
KuCoin operator barred from the US after CFTC order
After the January 2025 guilty plea (~$297M forfeiture for unlicensed money transmission serving US users) and KuCoin's own US IP restrictions (2025-01-16), a CFTC order formally bars the operator from the US. Austria separately banned new local business under MiCA (2026-02).
Bitget hacked: ~$390M stolen, withdrawals paused ~3 days
Attackers steal ~$350-390M from Bitget hot wallets (Forbes/Reuters/FT); North Korea (Lazarus) suspected per CNBC. Withdrawals paused and resumed 2026-09-28. Exchange-level incident: copy-trading and bot users' funds sit on-exchange.
What this means for you
Trade-only API keys are not safe on their own, exchange-side "key disabled" notices have lagged real revocation, and vendor denial during an incident is part of the damage. The mitigations that worked: immediate self-service key revocation, IP whitelisting, low balances, and custody models where keys never leave your control - run the checklist →