3Commas Referral Code

Connecting a bot means granting permission to trade the assets you still own. In 2022 about 100,000 of those permissions leaked.

There is a rung on the custody ladder that has no popular name, and 3Commas sits on it.

You do not deposit your coins with a bot platform. They stay in your exchange account, and in that sense you keep custody. What you hand over is an API key — a credential that lets the platform place trades on your behalf. You still own the assets. Something else can now move them within the exchange.

That distinction is the whole risk, and it is worth being precise about it. An API key is normally issued with a set of permissions: read-only, trade, and in some cases withdraw. A trade-enabled key cannot take your coins off the exchange — but it can trade them into something worthless, which achieves a similar result. That is not hypothetical; it is exactly what happened.

The 2022 incident, in sequence, because the sequence is the lesson.

From late October 2022, unauthorised trades began appearing on customer accounts at the then-operating FTX exchange, concentrated in thinly traded pairs — one trader was reported to have lost around $1.6 million across thousands of trades in a single low-liquidity token. 3Commas publicly attributed the reports to users being phished, rather than to any compromise on its side.

Binance's chief executive then said publicly that he was "reasonably sure there are widespread API key leaks from 3Commas" and told users to disable their keys immediately.

Shortly afterwards, an anonymous account published what it said was a database of 3Commas API keys — around 100,000 in total, with more than 10,000 released initially and the remainder threatened. 3Commas' chief executive, Yuriy Sorokin, then confirmed the leak was authentic and asked Binance, KuCoin and other supported exchanges to revoke every key connected to the platform. The breach was reported to have drawn the attention of the FBI.

The reusable lesson is not "bots are dangerous". It is about the order of events. The platform's first public account attributed losses to its own users' carelessness, and that account was wrong. When you are assessing any platform that holds credentials or assets, how it behaved during its worst incident is better evidence than anything on its marketing pages — and specifically, whether it investigated before attributing blame. Our LastPass page draws the same conclusion from a different breach: what matters is not that an incident happened, but how it was characterised while it was happening.

What to do if you use any bot or portfolio tool, and this is the actionable part:

Never grant withdrawal permission. There is essentially no legitimate reason a trading bot needs it. This one setting is the difference between a bad day and a total loss.
Use IP allow-listing where the exchange supports it, so a leaked key is useless from anywhere else.
Rotate keys periodically, and immediately on any incident anywhere in the chain.
Keep the connected account separate from your main holdings, containing only what the strategy actually needs.
Understand that a trade-enabled key can still destroy value by trading into illiquid assets, which is precisely the attack pattern seen in 2022.

On the referral, briefly. 3Commas pays commission on the subscription payments of the people you refer — a share of software fees, tiered by level. That is an affiliate scheme rather than a user referral, in the sense our batch-55 rule sets out: a percentage of recurring revenue is built for people who publish at volume, not for telling a colleague. It is also, notably, the cleanest reward structure in this batch — it pays on a subscription rather than on how much your friend trades, borrows or deposits, so it does not push them toward riskier behaviour. Worth saying plainly when it is true: a share of a software subscription is a more honest incentive than a share of someone's trading fees.