3Commas API Dispute Highlights Risks of Algorithmic Trading
1000 Views0 Votes
Despite the bear market, cryptocurrency day traders still see opportunities to strike it rich. Many seek out an edge by employing algorithmic trading bots that automatically execute trades at a moment’s notice.
There are risks in letting code make snap decisions, however. A group of investors organizing on Telegram say that they have been the victims of hackers that compromised the Application Programming Interface (API) of the automated trading platform 3Commas to the tune of $22 million.
In a series of tweets, pseudonymous Internet Sleuth @ZachXBT claims dozens of users have reported that thieves siphoned funds away through unauthorized trades on their centralized exchange accounts because of the 3Commas API.
An API is a set of rules that define how two software programs—in this case, a trader’s portfolio or wallet and a cryptocurrency exchange—should communicate. APIs are used for various reasons, providing a way for developers to access multiple services and data, and enabling users to interact with different applications through a single user interface.
What is algorithmic trading?
Algorithmic trading uses computer programs, including APIs, to execute trades in financial markets. These programs, also known as trading bots, are designed to analyze market conditions and execute trades triggered by predefined parameters.
One advantage of algorithmic trading is that it allows traders to execute trades quickly without human interaction. Trading bots can be especially useful in fast-moving global markets like cryptocurrency, where manual trading may not be possible.
While algorithmic trading bots can help traders looking for an edge, their use also carries risks, such as potential errors or malfunctions in the algorithm or compromised access to their settings.
An earlier 3Commas scam
In October 2022, then-FTX CEO Sam Bankman-Fried paid out $6 million to FTX traders who were victims of a multimillion-dollar scam that hit FTX users through compromised 3Commas APIs.
Bankman-Fried tweeted that he was prepared to remunerate FTX users affected by an exploit in which attackers used 3Commas’ API to make trades on the exchange, but warned that the action should not be considered a precedent or company policy.
13) But in this particular case, we will compensate the affected users.
THIS IS A ONE-TIME THING AND WE WILL NOT DO THIS GOING FORWARD.
THIS IS NOT A PRECEDENT.
We will not making a habit of compensating for uses getting phished by fake versions of other companies!
3Commas says the theft of user funds was due to a phishing attack, not their software, and called the claims of API leaks or exploits—then and now—fake and spread by bad actors.
There have been some false rumors shared by bad faith actors using falsified evidence to claim 3Commas leaked users’ API keys. These rumors were related to fake screenshots of Cloudflare logs that have been shared on Twitter and Youtube. The full article: https://t.co/KVOF2BWlYnpic.twitter.com/qJ52CvnVg0
In a series of blog posts posted to the 3Commas website, co-founder Yuriy Sorokin has repeatedly addressed the claims against the platform.
“In the latest edition to this saga of API keys and attacks on exchanges, we’re now seeing individuals on Twitter and YouTube circulating fake screenshots of Cloudflare logs in an attempt to convince people that there was a vulnerability within 3Commas and that we were irresponsible enough to allow open access to user data and log files,” Sorokin wrote, pointing to a December 10, 2022 tweet that he says claims 3Commas employees are stealing API keys.
The investigation continues
In an email response to Decrypt, 3Commas asserted that “there are no API leaks or exposure of our database,” and said that it is working with Google to take down phishing websites trying to copy its platform, which could trick customers into submitting their API keys.
3Commas also wrote that they are working with Binance in “investigating the root cause” and said its own team is “finding a permanent solution to fix the API issue.” The company did not respond to a request from Decrypt to explain the API issue that required fixing.
Excluding actions by insiders, how would an attacker know who to attack—via phishing or otherwise—and when?
“Normally, my answer would be ‘it depends,’” David Schwed, COO of Web3 security firm Halborn, told Decrypt.
“If an attacker was able to inspect network traffic, they’d be able to obtain some information as to who was making API calls based on either the URL or the originating IP address,” Schwed said. “However, in this case, the users of the API were much simpler to ascertain.”
“In the developer section of 3commas.io, they have an API chat link to a [Telegram] group with close to 1,000 members,” he explained. “Those members, I’d assume, are all API users.”
Edmondo “Mundy” Pena, a cybersecurity professional and algorithmic trader, tells Decrypt he had used 3Commas’ trading software since 2020 when he first heard about the platform. Around that same time, Pena says he launched his business, Crypto Trading Desk.
Pena says he has used 3Commas’ API on multiple portfolios for just under two years without issue. Pena says he first noticed problems with his trading account during the Thanksgiving holiday in November 2022.
“I had an API with trade-enabled access to my portfolio,” he said. “My greatest fear was realized on Thanksgiving morning when I started seeing 1000s of trade alerts happening on my portfolio.” Pena said he deleted the API before the thieves drained all of his funds.
Pena says he took to Google to research what happened to him and found that he was not the only one to experience what he did. Pena says he is working with others who say the same thing happened to them.
So far, Pena says he has had face-to-face interviews with nearly 60 individual users who report unauthorized transactions using 3Commas’ API.
He says that several of the people he spoke with have taken the step of going to law enforcement about the matter. Using his background in cybersecurity forensics, Pena says he was able to reverse engineer the attack on his account. He then took that information to contacts in the U.S. Secret Service.
In December 2022, a crypto trader who goes by CoinMamba took to Twitter to say that their Binance was compromised due to a leak of the 3Commas API key, which led them to lose funds.
Hey guys. Unfortunately two days ago my Binance account got exploited through an API which I’ve created 2 years ago and haven’t used since which I assumed I deleted but apparently didn’t. It was used to make trades on low cap coins to push up the price to make profit.