3Commas API dispute highlights risks of algorithmic trading

Despite the bear market, cryptocurrency day traders still see opportunities to get rich. Many seek an edge by using algorithmic trading bots that automatically execute trades instantly.

However, there are risks in letting code make quick decisions. A group of investors organizing on Telegram say they fell victim to hackers who compromised the application programming interface (API) of the $22 million automated trading platform 3Commas.

In a series of tweets, the pseudonymous internet sleuth @ZachXBT claims that dozens of users have reported thieves siphoning funds through unauthorized trades on their centralized exchange accounts due to the 3Commas API.

“3Commas blames it on ‘phishing’ but I have now verified a group of 44 victims who had a total of $14.8M stolen from them,” ZachXBT tweeted.

1/3 Over the past few weeks, a number of @3commas_io users have reported unauthorized trades on their CEX accounts.

3Commas blames it on “phishing,” but I’ve now verified a group of 44 victims who had a total of $14.8 million stolen from them. pic.twitter.com/49K28a5Pf8

— ZachXBT (@zachxbt) December 20, 2022

In a Google Docs document shared to the Telegram group and viewed by Decrypt, members say the exchanges where the unauthorized transactions took place include Binance, Coinbase Pro and KuCoin.

“Users have filed complaints about various exchanges,” wrote ZachXBT. “It is clear that this is not phishing and API keys were stolen.”

2/3 users have filed complaints about various exchanges. It is clear that this is not phishing and API keys were stolen.

3Commas and its founder have chosen to blame their users. Delete the API keys if you haven’t already and stop using 3commas.

— ZachXBT (@zachxbt) December 20, 2022

What is an API?

An API is a set of rules that define how two software programs — in this case, a trader’s portfolio or wallet and a cryptocurrency exchange — should communicate. APIs are used for a variety of reasons, allowing developers to access multiple services and data, and allowing users to interact with different applications from a single user interface.

What is algorithmic trading?

Algorithmic trading uses computer programs, including APIs, to execute trades in the financial markets. Also known as trading bots, these programs are designed to analyze market conditions and execute trades triggered by predefined parameters.

One advantage of algorithmic trading is that traders can execute trades quickly and without human interaction. Trading bots can be particularly useful in fast-paced global markets like cryptocurrencies, where manual trading may not be possible.

While algorithmic trading bots can help traders looking for an edge, their use also comes with risks such as: B. potential bugs or malfunctions in the algorithm or compromised access to their settings.

A previous 3Commas scam

In October 2022, then-FTX CEO Sam Bankman-Fried paid out $6 million to FTX traders who were victims of a multi-million dollar scam that hit FTX users via compromised 3Commas APIs.

Bankman-Fried tweeted that he was willing to compensate FTX users affected by an exploit in which attackers used 3Commas’ API to trade on the exchange, but warned that the action shouldn’t set a precedent or company policy should be considered.

13) But in this particular case, we will compensate the affected users.

THIS IS A ONE-TIME THING AND WE WILL NOT DO THIS IN THE FUTURE.

This is not a precedent.

We will not make a habit of compensating usages phished by fake versions of other companies!

— SBF (@SBF_FTX) October 23

3Commas says the theft of user funds was due to a phishing attack and not their software, calling the claims of API leaks or exploits – then and now – fake and disseminated by bad actors.

There were some fake rumors spread by malicious actors using fake evidence to claim that 3Commas leaked users’ API keys. These rumors were related to fake screenshots of Cloudflare logs shared on Twitter and Youtube.
The full article: https://t.co/KVOF2BWlYn pic.twitter.com/qJ52CvnVg0

— 3Commas (@3commas_io) December 11, 2022

In a series of blog posts published on the 3Commas website, co-founder Yuriy Sorokin has repeatedly addressed the claims against the platform.

“In the latest installment in this saga of API keys and exchange attacks, we now see people on Twitter and YouTube posting fake screenshots of Cloudflare logs to convince people that there is a vulnerability within 3Commas and that we were irresponsible enough to allow open access to user data and log files,” Sorokin wrote, referencing a December 10, 2022 tweet in which he claimed 3Commas employees were stealing API keys.

The investigations are ongoing

In an email response to Decrypt, 3Commas claimed that “there are no API leaks or exposure of our database,” and said it’s working with Google to take down phishing sites trying to copy its platform, which is what Could trick customers into submitting their API key.

3Commas also wrote that they are working with Binance to “investigate the root cause” and said its own team is “finding a permanent solution to fix the API issue.” The company did not respond to a request from Decrypt to explain the API issue that needed fixing.

Insider actions aside, how would an attacker know who to target — via phishing or otherwise — and when?

“Normally my answer would be ‘it depends,'” David Schwed, COO of Web3 security firm Halborn, told Decrypt.

“If an attacker were able to inspect network traffic, they could get some information about who made API calls based on the URL or the originating IP address,” Schwed said. “In this case, however, the users of the API were much easier to identify.”

“In the developer area of ​​3commas.io they have an API chat link to a [Telegram] Group of nearly 1,000 members,” he explained. “These members, I assume, are all API users.”

Edmondo “Mundy” Pena, a cybersecurity expert and algorithmic trader, tells Decrypt that he has been using 3Commas’ trading software since 2020, when he first heard about the platform. Around the same time, Pena says he started his Crypto Trading Desk company.

Pena says he’s been using 3Commas’ API across multiple portfolios for almost two years with no issues. Pena says he first noticed problems with his trading account during the Thanksgiving holiday in November 2022.

“I had an API with tradable access to my portfolio,” he said. “My biggest fear came true on Thanksgiving morning when I started seeing thousands of trade alerts in my portfolio.” Pena said he deleted the API before the thieves took all his money.

Pena says he went to Google to research what happened to him and realized he wasn’t the only one who experienced what he did. Pena says he works with others who say the same thing happened to them.

Pena says he has so far had face-to-face interviews with nearly 60 individual users reporting unauthorized transactions through 3Commas’ API.

He says several of the people he spoke to have taken the step of contacting law enforcement about the matter. With his background in cybersecurity forensics, Pena says he was able to reverse engineer the attack on his account. He then took this information to contacts in US intelligence.

In December 2022, a crypto trader using CoinMamba tweeted that its Binance was compromised due to a 3Commas API key leak, causing it to lose funds.

Hi Guys. Unfortunately my Binance account was exploited 2 days ago by an API I created 2 years ago and haven’t used since which I assumed I deleted but apparently haven’t. It has been used to trade low cap coins to boost the price to make profits.

— CoinMamba (@coinmamba) December 8, 2022

The tweet prompted multiple exchanges of words between CoinMamba and Binance CEO Changpeng “CZ” Zhao, which ended with CoinMamba’s Binance account being shut down.

“The only common denominator here is 3 commas,” Pena said.

While Pena is confident that there is a problem with the 3Commas software, he acknowledged that some of the problems are due to traders forgetting and leaving APIs connected to their accounts.

“Most people forget,” he said. “Setting up APIs is something you don’t do often. Most people have only had one API linked to their portfolio.”

Pena tells Decrypt that other affected merchants are also reviewing their legal options and are working with law enforcement.

Stay up to date on crypto news and receive daily updates in your inbox.

Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers