Curriculum·S210 Automation Literacy: What Bots Actually Do·about 30 min
The security surface
By the end of this lesson you can
- →Enumerate the surface an automation introduces, including the components outside the product
- →Explain why trade permission alone is sufficient to drain an account
- →Configure a key for an automation so that a leak of it is inert
- →Set the revocation triggers that apply on any incident anywhere in the stack
Sophomore · enrolled learners
This lesson opens with 3Commas, 2022.
- What happened
- Around 100,000 exchange API keys belonging to users of the trading-bot service 3Commas were obtained by an attacker; 3Commas's own FAQ says the attackers obtained access to part of its database. Unauthorized trades on connected accounts were reported from October 2022, when 3Commas and FTX traced unauthorized trades in DMG pairs to keys linked to 3Commas and the company blamed phishing sites. On 10 December the company published an update stating it had found no evidence of a compromise of its systems. On 28 December an anonymous party published a sample of the keys and said it held the rest, and the chief executive, Yuriy Sorokin, confirmed the data was real and asked Binance, KuCoin and other exchanges to revoke every connected key. 3Commas states that it has no access to withdraw or deposit funds, and the losses ran through trades rather than withdrawals: per HAPI Labs' analysis, the attackers placed sell orders for illiquid assets at high prices from their own accounts and used victims' keys to buy them with victims' liquid balances. Loss counts differ: the investigator ZachXBT verified 44 victims who lost $14.8M, traders claimed around $22M, and HAPI Labs later counted about $27.3M across 86 users.
- The decision point
- The standard advice for a bot key is to enable trading and disable withdrawal, and 3Commas itself has no withdrawal access. That advice is built around one question, whether an attacker could withdraw, and the attackers answered a different one. Trade permission alone was sufficient, because a balance can be converted into worthless assets as effectively as it can be moved away.
- Recorded loss
- $14,800,000
What you will be able to answer
- →Why is disabling withdrawal not sufficient for a bot key?
- →Which restriction makes a leaked key inert?
- →What surface does an automation introduce?
- →When do you revoke?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://3commas.io/blog/api-security-incident-faq
- https://www.bleepingcomputer.com/news/security/crypto-platform-3commas-admits-hackers-stole-api-keys/
- https://cointelegraph.com/news/3commas-ceo-confirms-api-key-leak-following-warning-from-cz
- https://decrypt.co/118094/after-repeated-denials-3commas-admits-it-was-source-for-earlier-hacks
- https://www.theblock.co/post/179237/ftx-api-keys-3commas-exploited
- https://forklog.com/en/api-key-leaks-and-exchange-inaction-a-hapi-analysis-of-the-3commas-incident/
- https://3commas.io/faq
- https://cointelegraph.com/news/telegram-bot-banana-gun-users-drained-500-ether
- https://www.ledger.com/blog/security-incident-report
Confidence high·Volatility high·Reviewed 2026-08-06·Owner unassigned
Contested
F109-02 owns API keys as a delegation topic at Freshman level and uses this same incident. This lesson covers the automation-specific surface and the operational rules for bot keys. Keep the split and do not re-derive the delegation map here.
The route by which the keys were obtained was never publicly established and the company initially reported no evidence of compromise of its systems. Describe what was confirmed. Its later FAQ says the attackers obtained access to part of its database, and its chief executive also said phishing was at least in part a contributory factor (Cointelegraph, 28 December 2022), so some losses may have come through phished keys rather than the database.
Loss figures differ by counter and date: ZachXBT verified 44 victims and $14.8M (Decrypt, 29 December 2022), traders claimed around $22M (same report), and HAPI Labs counted $27,285,845 across 86 users as of 10 January 2023 (ForkLog's account of the HAPI analysis). loss_usd uses the lowest verified figure. The trade mechanism is from the HAPI analysis; no source we read states what permissions each victim's key carried, so the lesson says 3Commas has no withdrawal access rather than that every user disabled it.
Whether an IP allow-list would have stopped these keys depends on where the attacker sent orders from, which was never published. The lesson treats the sub-account limit as the control that holds either way.