Curriculum·R409 Grid, DCA, and Rule-Based Automation·about 42 min
The arithmetic the interfaces hide
By the end of this lesson you can
- →Separate realized cycle profit from the unrealised mark on accumulated inventory
- →Compute the true position of a grid at its lower bound
- →List the five quantities a bot interface typically does not display
- →Explain why the automation layer is an exposure the strategy arithmetic never contains
Senior · enrolled learners
This lesson opens with The 3Commas API key leak, 2022.
- What happened
- 3Commas is a bot platform that trades on a user's exchange account through an API key the user supplies. From October 2022 users reported unauthorized trades, initially in a thinly traded pair on FTX, and by November holders reported losses in the millions. On 10 December 2022 the company published an investigation update saying it had found no evidence of a compromise of its systems. On 28 December an anonymous account published a set of API keys and Binance's chief executive publicly warned that leaks appeared to be occurring. The company's chief executive then confirmed that a published set of about 100,000 keys had in fact been obtained from its service. Attackers used the keys to trade on victims' exchange accounts, and estimates of the total taken reached around $20M. The FBI was reported to be investigating.
- The decision point
- Every user had evaluated a strategy and none of them had priced the connection. A bot platform requires a standing permission over an exchange account, which per F109-02 is the same class of exposure as an unlimited token approval and per J311-04 sits at a layer the strategy arithmetic never reaches. The grid's expected return was computed on the trades. The loss came from the key.
- Recorded loss
- $20,000,000
What you will be able to answer
- →What does a bot interface usually display?
- →What is the true position at the lower bound?
- →What are the five hidden quantities?
- →What exposure sits outside the strategy arithmetic?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.bleepingcomputer.com/news/security/crypto-platform-3commas-admits-hackers-stole-api-keys/
- https://www.halborn.com/blog/post/explained-the-3commas-breach-december-2022
- https://cointelegraph.com/news/3commas-ceo-confirms-api-key-leak-following-warning-from-cz
- https://www.coindesk.com/tech/2022/12/28/anonymous-twitter-user-leaks-alleged-3commas-api-database
Confidence medium·Volatility medium·Reviewed 2026-08-07·Owner unassigned
Contested
Loss estimates for the 3Commas incident vary from a few million reported by individual users to around $20M in aggregate, and the platform's account of when it knew what was disputed at the time. The lesson relies on the confirmed fact that keys obtained from the service were published and used, which the company acknowledged.
This lesson names one platform because that incident is documented. Per P7 it is not a statement that other platforms are safer, and per F109-02 the exposure is a property of the API permission model rather than of any vendor.
R409-01 owns the mechanical derivation and R409-03 owns the payoff identity. This lesson owns the gap between what is displayed and what is held. Keep the splits.