3Commas admits API leak as victims demand refunds and apology

Earlier today, 3Commas confessed to an API leak after denying the community report for months. The move stirred victims to demand refunds and an apology for gaslighting.

3Commas’ clients demand a refund and an apology

Victims of the 3Commas API breach are calling for reimbursement of funds lost and an apology from the company for mishandling the API leak situation. Months after the community released a report showing the API leak, the company engaged in a tussle with the victims whose accounts were involved in the illicit trades.

The company came out strongly to disprove any breach in the platform as the CEO Yuriy Sorokin denied the possibility of a rogue employee facilitating an inside job to defraud customers. The statement by the CEO blamed any exposed APIs on phishing attacks on users.

According to the statement released on Dec. 28, there was a change of stand by 3Commas on the entire incident necessitated by a comprehensive analysis conducted on the API leak. The company CEO, Sorokin, admitted the API breach and confirmed the validity of the API keys broadcasted by the hacker.

1. Statement from 3Commas:
We saw the hacker’s message and can confirm that the data in the files is true. As an immediate action, we have asked that Binance, Kucoin, and other supported exchanges revoke all the keys that were connected to 3Commas.
— Yuriy Sorokin (@YS_3Commas) December 28, 2022

Sorokin told the community that they had done everything to investigate possibilities of an inside job but did not find any traces. According to the investigations, the number of technical employees accessing such information was small, and their access has been limited since Nov. 19. He assured the public of tightened security measures and the complete involvement of law enforcers during the whole investigation.

3Commas Statement:
1) We have seen the hacker’s message and can confirm that the data in the files is true. As an immediate action, we have requested that Binance, Kucoin and other supported exchanges revoke all keys that were connected to 3Commas. pic.twitter.com/ZMuzCqeF1j
— 3Commas (@3commas_io) December 28, 2022

The abrupt announcement has surprised the community, given that 3Commas had previously refuted the claims by customers, terming them as lies perpetuated by “bad faith actors.” They also accused the victims of presenting falsified evidence.

In response to the revelations by 3Commas, Deribit acted quickly to announce the deletion of the API keys its customers used to trade on the platform through 3Commas. They assured customers not to worry since there were no leaked Deribit keys on the internet, but it was a precautionary measure.

Victims and crypto enthusiasts, through Twitter, launched a series of rants castigating the actions by 3Commas. The affected parties, such as Turgut Oztunc, swore to pursue the matter further if the company did not issue refunds.

You are really funny guys. We will see on the court if you don’t recover our funds asap.
According to hackers message you sold our datas and you stole our funds.
So if you recover, everything will be fine otherwise tell Yuriy to select a good prison.
— Turgut Oztunc (@turgut_oztunc) December 28, 2022

Other aggressive comments emanated on Twitter as crypto enthusiasts registered their disappointment on 3Commas.

1/ Six hours ago an account messaged me and sent over a db with api keys of 3Commas users. I began working to verify its validity and quickly shared the info with exchanges. pic.twitter.com/MBKatUyzBE
— ZachXBT (@zachxbt) December 28, 2022

Source: https://crypto.news/3commas-admits-api-leak-as-victims-demand-refunds-and-apology/