Curriculum·S210 Automation Literacy: What Bots Actually Do·about 30 min
The security surface
By the end of this lesson you can
- →Enumerate the surface an automation introduces, including the components outside the product
- →Explain why trade permission alone is sufficient to drain an account
- →Configure a key for an automation so that a leak of it is inert
- →Set the revocation triggers that apply on any incident anywhere in the stack
Sophomore · enrolled learners
This lesson opens with 3Commas, 2022.
- What happened
- Around 100,000 exchange API keys belonging to users of the trading-bot service 3Commas were obtained by an attacker. Unauthorized trades on user accounts were reported from October 2022. On 10 December the company published an update stating it had found no evidence of a compromise of its systems. On 28 December an anonymous party published a sample of the keys and threatened to release the rest, and the chief executive confirmed the data was authentic and asked exchanges to revoke every connected key. Because withdrawal permission had generally not been granted, the attackers could not move funds out, so they instead used victims' balances to buy thin, illiquid pairs at prices they set, taking the other side themselves. Reported aggregate losses reached around $22M.
- The decision point
- Every affected user had configured permissions according to the standard advice, which is to enable trading and disable withdrawal. That advice was built around one question, whether an attacker could withdraw, and the attackers answered a different one. Trade permission alone was sufficient, because a balance can be converted into worthless assets as effectively as it can be moved away.
- Recorded loss
- $22,000,000
What you will be able to answer
- →Why is disabling withdrawal not sufficient for a bot key?
- →Which restriction makes a leaked key inert?
- →What surface does an automation introduce?
- →When do you revoke?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://3commas.io/blog/api-security-incident-faq
- https://www.bleepingcomputer.com/news/security/crypto-platform-3commas-admits-hackers-stole-api-keys/
- https://cointelegraph.com/news/telegram-bot-banana-gun-users-drained-500-ether
- https://www.ledger.com/blog/security-incident-report
Confidence high·Volatility high·Reviewed 2026-08-06·Owner unassigned
Contested
F109-02 owns API keys as a delegation topic at Freshman level and uses this same incident. This lesson covers the automation-specific surface and the operational rules for bot keys. Keep the split and do not re-derive the delegation map here.
The route by which the keys were obtained was never publicly established and the company initially reported no evidence of compromise of its systems. Describe what was confirmed.