3Commas
Best for documentation-led evaluation
How it rates
- Service reachable without an account
- Documentation or FAQ published
- Terms not found at a conventional public address
- Corporate entity not established from public sources
Each indicator scores 2, 1 or 0. A pillar is the points earned over the points available; the overall score is the weighted sum. Every source below is public — check any of them yourself.
- Met
- Not metTerms and conditions published
Not found at a conventional address at this check.
- Met
- PartialOperator identifiable from published material
Service published under its own domain; corporate entity not established at this check.
3commas.io/ - PartialNo custody of user funds claimed in this assessment
Custody arrangements are not verifiable from the desk and are not scored.
3commas.io/
- Met
- Met
- PartialRates displayed publicly
Page reachable; specific rates not captured at this check.
3commas.io/pricing - Not metTerms describe charges
Not found at this check.
- Met
- Met
- Met
- Not metTerms published
Not found.
- Met
- Not metOperator entity disclosed
Not established from public sources at this check.
- Met
- Not metTerms documentation published
Not found.
- Met
- Not metCorporate entity identifiable
Not established from public sources at this check.
- Not metRegulatory status published
Not established from public sources at this check.
- Met
- Met
- Not metTerms reachable
Not found.
- Met
- Met
An established automated trading platform connecting to exchange accounts by API key, whose 2022 credential leak resulted in multi-million dollar user losses.
Our assessment
3Commas is one of the longest-running automated trading platforms, connecting to exchange accounts through API keys to run grid, DCA and copy-trading strategies. Any assessment has to start with December 2022, when 100,000 customer API keys were posted publicly.
What happened in 2022
Unauthorised transactions were first reported in October 2022. By November, users with significant balances reported roughly $6m lost. In December an anonymous account published sample files containing 100,000 API keys generated on Binance and KuCoin. 3Commas initially denied a security issue and confirmed the breach on 29 December. One verified group of 44 victims reported $14.8m stolen in total.
Why API-key platforms carry this risk structurally
Connecting a bot means handing a third party a credential that can trade your exchange balance. Withdrawal permissions can be withheld, and trading permission alone is enough to drain an account through deliberately bad trades against an attacker's orders. This risk exists for every platform in this group — 3Commas is simply the one where it materialised at scale.
What that means for a user today
If you connect any bot platform: withhold withdrawal permission, restrict the key by IP where the exchange allows it, use a subaccount holding only what the strategy needs, and rotate keys periodically. These steps would have limited the 2022 damage substantially, and almost nobody takes them until after an incident.
Who it suits
3Commas fits traders who want mature bot tooling, have read the incident history, and apply strict key hygiene. Traders unwilling to grant API access to a third party should trade manually or use exchange-native bot features instead.
Frequently asked
Does this score mean 3Commas is trustworthy?
No. It measures what is published and reachable before use: the service, its terms and its documentation. Custody, routing and corporate structure are not tested by us.
Why do all providers score zero on corporate entity?
Because this class of service rarely publishes it. The indicator is identical for every provider in the category, so the comparison stays fair.
Are rates or spreads compared here?
No. Verifying quoted rates requires live transactions, which we do not perform. The rubric covers disclosure, not execution.