Is It Safe to Connect Your Exchange API to a Trading Bot?
Connecting an API key to a trading bot is safe when you control the permissions and trust how the platform stores the key. Here's what the 2022 3Commas leak taught traders, why no-withdrawal access isn't enough on its own, and a checklist for connecting your exchange safely.
Connecting an API key to a trading bot is safe when you control two things: the key's permissions and how the platform stores it. The danger is never the bot placing trades — it's a leaked or over-permissioned key. A no-withdrawal key, IP whitelisting, and secure storage on the platform's side remove most of the attack surface. No setup removes all of it, so the questions below matter before you connect.
TL;DR
- The risk is key exposure, not automation. A trading bot only does what your key's permissions allow.
- The December 2022 3Commas leak exposed roughly 100,000 API keys, and attackers drained accounts through market manipulation, not withdrawals — proof that a no-withdrawal key alone isn't enough.
- Three controls cut most of the risk: no-withdrawal permissions, IP whitelisting, and how the platform stores your keys.
- Test in demo first, then go live. (Setup walkthrough →)
- No platform can promise zero risk. Ask how keys are stored, whether withdrawal keys are rejected, and whether you can whitelist IPs.
What you're actually granting when you connect a key
An API key is a credential that lets an application act on your exchange account. Exchanges issue keys with permission tiers:
- Read-only — view balances and history. Cannot trade or move funds.
- Trade (no withdrawal) — place and cancel orders. Cannot withdraw.
- Withdrawal — move funds off the exchange.
A trading bot needs the trade tier and nothing more. If a key with withdrawal rights leaks, an attacker can send your funds straight out. That's why the first rule is simple: never give a bot a key with withdrawal enabled.
The harder lesson is that trade-only keys can still cause losses. The 3Commas incident is the clearest example on record.
Case study: the 3Commas API key leak (December 2022)
In late October 2022, traders began reporting unauthorized trades on exchange accounts they had connected to 3Commas. The company attributed the early losses to phishing and said it found no evidence of a compromise on its own systems.
The complaints kept coming. On-chain investigator ZachXBT verified a group of 44 victims who lost a combined $14.8 million. On 28 December 2022, an anonymous party posted a sample of the stolen credentials publicly and threatened to release the rest. Binance CEO Changpeng Zhao warned users to disable any key they had ever added to 3Commas. The same day, 3Commas CEO Yuriy Sorokin confirmed the leaked data was authentic and asked Binance, KuCoin and other exchanges to revoke every connected key.
In its official notice, 3Commas confirmed that API keys, secrets and passphrases had been disclosed by a third party, said the hacker alleged an employee sold the data, and stated its internal investigation found no evidence of insider involvement. The FBI reportedly opened a case.
How accounts were drained without withdrawal access
This is the part most security write-ups skip, and it's the reason this article exists.
The stolen keys were trade-only. Attackers couldn't withdraw — so they manipulated the market instead. They used victims' balances to buy thin, illiquid altcoin pairs at inflated prices while selling the same coins from their own accounts, transferring value through the spread. The funds never "left" via a withdrawal. They were traded away. Reports also noted some stolen Binance keys were two to three years old — keys that should have been rotated or revoked long before.
3Commas has since changed its architecture, introducing an isolated key-storage layer it calls Sign Center (deployed 16 November 2022) and adding real-time checks for key permissions and IP whitelisting. The relevant takeaway for any trader, on any platform, is the underlying mechanics — not one company's response to them.
The lesson: "No withdrawal" blocks the obvious theft route. It does not block a thief who can trade your balance into a coin they control. Closing that gap takes more than one setting.
So does a no-withdrawal key protect you? Partly.
A no-withdrawal key is necessary. It is not sufficient. Two further controls close the manipulation gap:
- IP whitelisting. Many exchanges let you bind a key to specific server IPs. A whitelisted key is useless from any other machine, so even a leaked key can't be replayed from an attacker's infrastructure. Where your exchange supports it, this is the single highest-value control.
- Where the platform stores your keys. A leak only happens if the keys are sitting somewhere reachable. Isolated, encrypted storage is what determines whether a database breach turns into a key dump.
Checklist: how to choose a safe trading bot
Before you connect, confirm the platform meets all of these:
- Rejects withdrawal-enabled keys. The platform should refuse, or at minimum warn against, any key with withdrawal rights.
- Supports IP whitelisting. You can bind your key to the bot's server IPs.
- Stores keys in isolated, encrypted form. Ask where and how keys are kept.
- Lets you revoke instantly. You can delete the key on the exchange and cut access in one step.
- Offers demo or paper testing. You can validate a strategy before risking real funds.
- Is transparent about incidents. A clear security page and honest history beat marketing claims.
Is non-custodial. Your funds stay on the exchange; the bot only sends trade instructions.
See how Bitsgap secures your keys
Review the connection model — trade-only keys, withdrawal keys rejected, encrypted storage — before you link anything.
How Bitsgap handles your keys
Bitsgap maps to the checklist above. It automatically rejects any API key with the withdrawal function enabled, stores credentials with 2048-bit encryption, and adds API lock, countertrade protection and device fingerprinting. Funds never leave your exchange — the platform is non-custodial and sends trade instructions only. Since launching in 2017, it has had no publicly reported breach.
That track record is a fact, not a guarantee. No platform — Bitsgap included — can promise zero risk. Use a no-withdrawal key, enable IP whitelisting where your exchange supports it, rotate keys periodically, and start in demo mode. Security is the result of your settings plus the platform's architecture working together.
FAQ
Can a trading bot withdraw my funds? Only if you give it a key with withdrawal permission. Connect a trade-only (no-withdrawal) key and it cannot. Bitsgap rejects withdrawal-enabled keys automatically.
Was 3Commas hacked? 3Commas confirmed in December 2022 that roughly 100,000 users' API keys, secrets and passphrases were disclosed by a third party. It attributes the incident to external intrusion, says it found no evidence of insider involvement, and the FBI reportedly opened a case.
Does a no-withdrawal key make my funds completely safe? No. A no-withdrawal key blocks direct theft, but a leaked trade-only key can still be abused to manipulate your balance through illiquid trades, as the 3Commas case showed. Pair it with IP whitelisting and secure key storage.
What's the safest way to connect an exchange to a bot? Use a trade-only key, enable IP whitelisting if your exchange offers it, confirm the platform encrypts and isolates key storage, and test in demo before going live.
Can I revoke a bot's access at any time? Yes. Delete or disable the API key on your exchange and the bot loses access immediately.Connect your exchange safely
Start with a trade-only key and a demo run — link your exchange the way the checklist recommends.
