3Commas is an automated cryptocurrency trading platform that connects to cryptocurrency exchange accounts through API credentials and provides automated trading tools, including DCA bots, grid bots, options tools, smart trading features and integrations with third-party trading signals. This page is a safety profile — not a fraud report and not a product recommendation. It documents API-related risks, the 2022 API key incident, the previous conflict of interest on this page and the key security considerations associated with third-party trading automation.
What is 3Commas?
3Commas is a cryptocurrency trading automation platform that allows users to connect supported exchange accounts and use automated or manually controlled trading tools.
Unlike a custodial trading platform, automated activity can take place through a user’s connected exchange account. This makes API permissions, credential security and the behaviour of automated tools important parts of the overall risk profile.
How the 3Commas API Model Works
3Commas connects to supported cryptocurrency exchanges through API credentials. Depending on the permissions granted to the API key, the platform may be able to read account information and execute trades on the connected exchange account.
Automated bots act according to predefined parameters, signals or other configured conditions. Once automated execution is enabled, trades may be opened or closed without separate manual approval for each transaction.
This model means that users remain exposed not only to ordinary market risk but also to risks associated with API credentials, software configuration, third-party integrations, automated execution and external trading signals.
Automated Trading and Execution Risks
3Commas provides multiple forms of trading automation. The specific strategy is less important from a safety perspective than the fact that connected automation can place or manage orders through an exchange account when configured conditions are met.
- Configuration risk: incorrect trading parameters may result in orders being executed in ways the user did not intend.
- Credential risk: compromised API credentials may expose the connected exchange account to unauthorised trading activity.
- Automation risk: software can continue executing instructions during rapid market changes without human review.
- Third-party dependency risk: exchange outages, API failures or external signal problems may affect automated execution.
- Market risk: automation does not prevent losses caused by adverse market movements.
Supported Exchange Connections
3Commas is designed to connect with multiple cryptocurrency exchanges. Available features and API capabilities may differ between exchanges and may change over time.
The existence of an exchange integration should not be interpreted as an endorsement of 3Commas by that exchange. Users should independently review the permissions assigned to every API connection and remove access that is no longer required.
Third-Party Signal Risks
3Commas can execute automated trades based on signals or instructions supplied by third-party services. The quality, methodology, identity, incentives and historical reliability of those signal providers may vary and should be evaluated separately from the security of the 3Commas platform itself.
When automated execution is enabled, an inaccurate, compromised or poorly configured external signal may cause trades to be placed without separate manual confirmation.
A functioning integration between 3Commas and a signal provider does not establish that the underlying signal is accurate, independent or appropriate for a particular user.
API Key Risk and How to Reduce It
3Commas states that it uses AES-256 encryption and does not store withdrawal-enabled API keys. ScammerWatch has not independently audited these claims. The 2022 incident demonstrated that API-connected trading accounts can still be exposed when API credentials are compromised.
- Use API credentials with only the permissions required for the intended function.
- Do not enable withdrawal permissions for a trading API key unless there is a specific and independently justified reason to do so.
- Enable IP whitelisting on the connected exchange where available.
- Use a dedicated API key rather than reusing the same credentials across multiple services.
- Revoke API access immediately if compromise or unauthorised activity is suspected.
- Regularly review active API connections on the exchange account.
2022 API Key Incident
In late 2022, a significant number of 3Commas users reported unauthorised trades on exchange accounts connected through 3Commas API credentials. Affected users reported substantial financial losses associated with those unauthorised trades.
3Commas initially attributed reported cases to phishing or credential compromise affecting individual users. The company subsequently confirmed that some users’ API data, including API keys, secrets and passphrases, had been disclosed to a third party and stated that it was investigating how the data had been obtained.
The incident is directly relevant to the safety profile of API-connected trading services. Regardless of the precise route through which credentials are compromised, unauthorised access to a trading-enabled API key may allow trades to be executed through the connected exchange account.
3Commas has stated that additional security measures were implemented following the incident. ScammerWatch has not independently audited or verified the effectiveness of those measures.
Why the 2022 Incident Matters
The incident illustrates a structural risk that applies to API-connected trading tools generally: granting a third-party service trading permissions creates an additional security dependency between the user and the exchange account.
Even where withdrawals are disabled, an attacker with access to trading-enabled API credentials may still be able to place unauthorised orders, alter positions or cause financial losses through trading activity.
Conflict of Interest — Previous Version of This Page
The previous version of this page on ScammerWatch simultaneously listed 3Commas as an “approved bot” and contained affiliate referral links to 3Commas. This created a direct conflict of interest because ScammerWatch had a financial incentive connected to registrations generated through those links.
ScammerWatch’s current methodology does not endorse or recommend trading platforms and does not use affiliate referral links for registrations, deposits or trading activity. The previous affiliate links and recommendation elements have been removed from this page.
This page now documents 3Commas as a trading tool with identifiable API, automation and security risks, including a documented historical API-key incident. It is not a recommendation to register for or use the service.
If you used 3Commas based on a previous recommendation on ScammerWatch and experienced unauthorised trades or fund loss, you can submit relevant evidence through the Report a Scam form.
Security Considerations Before Connecting Any Trading Bot
- Review the exact API permissions requested by the service.
- Avoid enabling withdrawal permissions when they are not required.
- Use exchange security controls such as two-factor authentication and IP restrictions where available.
- Monitor connected applications and revoke unused API credentials.
- Treat external trading signals as separate third-party risk.
- Do not assume that automation reduces market or execution risk.
FAQ
Is this page a recommendation for 3Commas?
No. This page is an independent safety profile. ScammerWatch does not recommend registering for 3Commas or using any particular automated trading configuration, exchange integration or signal provider.
What access can a trading API key provide?
The exact access depends on the permissions enabled when the key is created. A trading-enabled API key may allow a connected third-party application to read account data and execute orders. Withdrawal permissions should remain disabled unless they are specifically required and independently justified.
What happened in the 2022 3Commas API incident?
Users reported unauthorised trading activity on exchange accounts connected through 3Commas API credentials. 3Commas later confirmed that some user API data had been disclosed to a third party. The incident demonstrated the potential impact of compromised API credentials on connected exchange accounts.
Do automated trading tools remove trading risk?
No. Automated trading introduces additional execution and configuration risks and remains exposed to ordinary market losses. Automation can execute instructions faster and more consistently, but it cannot guarantee a particular financial outcome.
Are third-party trading signals part of the same risk assessment?
Not necessarily. A signal provider is a separate third party whose methodology, incentives and reliability should be assessed independently from the security of the software used to execute those signals.
No Financial Advice
This page is provided for informational and safety-research purposes only. ScammerWatch does not recommend 3Commas or any specific bot configuration, signal provider, trading strategy or exchange integration.
Automated trading does not remove the possibility of financial loss. DCA, grid, futures, margin and other automated trading strategies may expose users to substantial losses depending on market conditions, leverage, configuration and execution.
If you have experienced unauthorised trades, API compromise or fund loss connected to 3Commas or another trading automation service, you can submit evidence through the Report a Scam form.
Author
