Useful capabilities, with meaningful limitations to understand.
3Commas has one of the broadest automation toolsets in this review set, but that capability comes with material API-key risk, a documented 2022 key exposure and a major EEA service transition. It suits experienced users who will enforce strict exchange permissions and monitor regional availability; it is not evidence of likely profitability.
Trade-only permission guidance and isolated key-storage claims are positive, but the 2022 exposure of approximately 100,000 API keys is material and no current public independent control audit was located.
Terms, entity details, pricing, product documentation and the incident FAQ are public; regional entity and EEA service changes add complexity.
Long operating history and broad adoption are offset by the API-key incident and changing EEA availability.
DCA, Grid and Signal bots, multi-exchange support, backtesting, paper trading and mobile access form a deep product set.
Templates and documentation help, although API setup and advanced bot controls still require trading and security knowledge.
Plan prices and limits are published, but useful live automation requires a paid plan and the trial requires payment details.
A public help center and 24/7 support channel are documented; service experience was not independently tested.
Backtesting exists, but no independently audited aggregate customer-return record was found.
What this score means It evaluates the product and available evidence. It does not predict returns or eliminate trading risk.
Trust profile
Thirteen disclosed factors create the calculated Trust Score.
Current terms name 3Commas Technologies OÜ and provide an Estonian registry code and address.
Factor score: 90/100A legal entity and registry identifier are disclosed in the terms.
Factor score: 90/100The company identifies founders, but complete beneficial ownership and current leadership accountability were not independently established.
Factor score: 85/100Company materials state the product has operated since 2017; the history is consistent with archived public reporting.
Factor score: 85/100Current monthly plan prices and core plan limits are publicly listed.
Factor score: 90/100The security center describes key storage and account controls, but no current public audit report was found.
Factor score: 85/100Documentation describes trade-only permissions and IP controls; implementation was not independently audited.
Factor score: 85/100Official guidance says withdrawal permission is not required for supported bot connections.
Factor score: 95/100Extensive bot, backtest, exchange and security documentation is public.
Factor score: 90/100Product capability is documented, but aggregate performance claims lack independent validation.
Factor score: 45/100The provider documents 24/7 support; response quality was not tested.
Factor score: 85/100The provider documented a 2022 exposure affecting approximately 100,000 API keys and described revocation and remediation.
Factor score: 45/100The provider published significant EEA restrictions and a July 1, 2026 closure timeline for 3Commas.eu services.
Factor score: 50/100Red flags & concerns
Context that should inform—not replace—your own assessment.
The provider said files containing about 100,000 customer API keys were posted publicly. Users at the time were instructed to revoke and reissue keys.
Official guidance says new EEA registrations closed and 3Commas.eu bot services were scheduled to stop July 1, 2026. Eligibility must be checked before purchase.
Backtests and product examples do not establish expected future returns.
What we verified
Checks completed during the latest research cycle.
3Commas product and safety research
Company, product, permission and regulatory evidence reviewed separately.
Is 3Commas legit?
The global terms identify 3Commas Technologies OÜ, Estonian registry code 14125515. Separate entities appear in regional and service-provider disclosures, so users should check which contracting entity applies.
The operating entity, registry code, address and founders are publicly disclosed. The multi-entity structure and regional transition require users to identify their actual contracting party.
Operator and legal sources: Terms and Conditions (Primary)
Is 3Commas safe?
3Commas is non-custodial in the sense that connected funds stay at the exchange, but trading API keys remain powerful credentials. Official documentation says withdrawal permission is unnecessary and describes an isolated signing system. The 2022 key exposure materially limits confidence until users can review current independent assurance.
How 3Commas works
The platform covers DCA, Grid and Signal automation with backtesting, paper trading and many exchange connections. Feature depth is a strength, but it increases configuration and operational risk.
Trading bots and automation features
The platform covers DCA, Grid and Signal automation with backtesting, paper trading and many exchange connections. Feature depth is a strength, but it increases configuration and operational risk.
Supported exchanges
Binance, Bybit, OKX, Kraken, KuCoin, Coinbase Advanced, Gate.io, Bitget
Pricing
A free tier exists but does not include real trading. Current monthly prices are $20 Starter, $50 Pro and $140 Expert; annual promotions and taxes can change the effective cost.
Pricing source: Available subscription plans (Primary) · Pricing (Primary)
Custody model
Connected assets remain at the exchange unless the product profile states otherwise.
Security
3Commas is non-custodial in the sense that connected funds stay at the exchange, but trading API keys remain powerful credentials. Official documentation says withdrawal permission is unnecessary and describes an isolated signing system. The 2022 key exposure materially limits confidence until users can review current independent assurance.
Use exchange subaccounts where possible, disable withdrawals, restrict IP addresses, enable 2FA and remove unused API keys. A non-withdrawal key can still place harmful trades.
API and withdrawal permissions
Exchange API keys are used for trading. Documentation says withdrawal access is not required and advises IP restrictions where supported. Withdrawal status: Not required for documented bot connections.
Security and permission sources: 3Commas security (Primary) · DCA Bot introduction (Primary) · Grid Bot settings and options (Primary)
Regulatory information
Global and regional terms identify different entities and roles. Official EEA guidance announced registration restrictions and the planned end of 3Commas.eu bot services on July 1, 2026. This is an availability and contracting issue, not a finding that the software guarantees regulatory protection.
Regulatory and service-scope sources: Terms and Conditions (Primary) · EEA regulatory changes FAQ (Regulator)
Performance evidence
Backtesting exists, but no independently audited aggregate customer-return record was found.
Claim verification
Source, claim type, evidence, status and analyst note are shown separately.
“117,000+ active members”
- Claim source
- Open company source
- Evidence found
- The figure appears on the company About page; no independent methodology or current user audit was located.
- Analyst note
- Treat this as a company marketing metric, not audited adoption data.
“API keys are securely stored in an isolated Sign Center”
- Claim source
- Open company source
- Evidence found
- Official documentation describes an isolated signing environment, but no current independent assurance report was found.
- Analyst note
- The documented design is relevant; its operating effectiveness is not independently established.
“Supports 15+ exchanges”
- Claim source
- Open company source
- Evidence found
- Current product and integration pages list broad exchange support, including the major venues in this profile.
- Analyst note
- Availability and feature parity vary by exchange and region.
Security incident history
Documented events and bounded public-source checks, with entity scope preserved.
Customer API-key data exposure
3Commas said a threat actor published sample files containing approximately 100,000 customer API keys.
- Provider response / research note
- The company asked exchanges to revoke connected keys, told users to reissue keys, investigated the event and later documented security changes.
Strengths & limitations
Strengths
Deep DCA, Grid and Signal toolset
Broad documented exchange support
Public pricing and extensive help content
Withdrawal permission not required
Limitations
–Documented 2022 API-key exposure
–EEA service transition and restrictions
–No independently audited performance record
–Advanced setup can be complex
Who may find it useful
Experienced multi-exchange automation users
Traders who need DCA, Grid and Signal workflows together
Users willing to enforce strict API-key hygiene
Who should look elsewhere
–You require independently audited security controls or returns
–You are in a restricted or transitioning region
–You are not comfortable managing exchange API permissions
3Commas alternatives and comparisons
Alternatives are selected for overlapping workflows, with the main distinction shown.
Frequently asked questions
Does 3Commas need withdrawal access?+
Official guidance says no. Users should keep withdrawal permissions disabled and use IP restrictions where their exchange supports them.
Was 3Commas affected by a security incident?+
Yes. The company documented a December 2022 exposure involving approximately 100,000 customer API keys.
Does its score predict profit?+
No. The score evaluates product quality, evidence and risk controls, not expected returns.
Sources & evidence
Company-provided information is labeled and not treated as independent validation. Research coverage: 9/9; evidence confidence: Moderate.
- Primary · TermsTerms and Conditions
3Commas · Accessed August 19, 2026
Entity, registry code and service terms. - Primary · DocumentationSubscriptions FAQ
3Commas Help Center · Accessed August 19, 2026
Trial, demo and backtesting limits. - Regulator · Regulatory DatabaseEEA regulatory changes FAQ
3Commas Help Center · Accessed August 19, 2026
Company notice about regional service availability; not an independent regulator record.
Research changelog
Conclusions may change when new evidence appears.
Replaced demo data with sourced company, product, security, incident, pricing and regional-availability research.
3Commas: 72/100
3Commas has one of the broadest automation toolsets in this review set, but that capability comes with material API-key risk, a documented 2022 key exposure and a major EEA service transition. It suits experienced users who will enforce strict exchange permissions and monitor regional availability; it is not evidence of likely profitability.
Research disclaimer This review is informational and not financial, investment, legal or security advice. Scores evaluate disclosed product qualities and evidence—not profitability, solvency or safety. Features, prices and eligibility can change.
We may receive compensation from some outbound links. Commercial relationships never affect scores or research conclusions. Read our policy.