Exchange API Key Leaked? How Accounts Get Drained

By Gurjeet Singh, developer of CoinPriceAlert · Published 19 September 2026 · 10 min read

What an exchange API key actually is

An API key is a credential that lets software act on your exchange account without your password or your two-factor code. It comes as a pair: a public key that identifies you and a secret that signs each request. Trading bots, tax tools and portfolio apps ask for one because it lets them read balances or place orders around the clock.

The part people miss is that the key bypasses the protections they rely on when they log in. Two-factor authentication guards the login page, not the API. Binance puts it bluntly in its own security guidance: with your secret key, anyone can make requests on your behalf without being detected by its risk monitoring. Whoever holds the secret is, as far as the exchange is concerned, you.

Each key carries permissions chosen when it is created. On most large exchanges these are some combination of reading account data, trading (spot, margin, futures) and withdrawing. The permissions decide what a leaked key can do, which is why the first question after a leak is always which boxes were ticked.

Why "no withdrawal permission" did not protect the account

Most people who lose money this way did disable withdrawals, and assumed that made the key harmless. It does stop the obvious route: on Binance, a key cannot withdraw at all unless it is restricted to a whitelisted IP address. But trading permission is enough to move value out, just more slowly.

The technique is a pump into an illiquid market. The attacker picks a coin with almost no trading volume and buys a position in it cheaply from their own account. Then, using your key, they place buy orders from your account at prices far above what the coin is worth. Their own account sells into those orders. Your balance becomes their stablecoins, the coin you now hold is worth a fraction of what you paid, and the exchange logs nothing but a series of ordinary trades.

Binance describes exactly this in its guidance on API key security: a hacker with your keys can use assets with small trading volume to pair trade and slowly siphon assets from your wallet. It is why exchanges treat a trading key as sensitive as a password, and why you should too.

How keys leak in the first place

The largest known case was not a user mistake. In December 2022 an anonymous account published API keys it said came from 3Commas, a trading-bot service, and the company confirmed the leaked data was genuine and asked exchanges to revoke every key connected to it. Users had been reporting trades they never placed on Binance, KuCoin and Coinbase since October. Every one of those users had handed a key to a third party in good faith, and the third party lost it.

The smaller, more common leaks follow a few patterns. A key pasted into a site that looks like a bot or "profit tool" but exists to collect keys. A key saved in a spreadsheet, a notes app or a code repository that is later shared or pushed to a public repository. A key given to an app that was later sold, abandoned or compromised. And malware on a computer where keys were created or stored.

Notice what these have in common: the exchange was not hacked and your password was not guessed. The key left your control the moment you gave it to something else, and its safety from then on depended on every system that ever held it.

If you think a key has leaked: the first fifteen minutes

Delete every API key on the account, not only the one you suspect. Deleting is instant, and you can create fresh keys later for the tools you still trust. Do this before anything else, because an attacker using a key does not need your password and will not be stopped by changing it.

Then change your exchange password from a device you trust, and sign out of every other session and device from the security settings. If the exchange offers a self-service option to freeze or disable the account, use it; it can be lifted later, and it stops further trading while you work out what happened.

Check the parts of the account an attacker would have changed to come back: the withdrawal address whitelist or address book, the email and phone on file, the two-factor method, any anti-phishing code, and any sub-accounts. An address you do not recognise in the whitelist is a sign of something wider than a leaked key, and support needs to know about it immediately.

Finally, secure the email account tied to the exchange. Password resets go there, and a compromised inbox turns a one-off loss into a repeat. Change its password, turn on two-factor authentication and look for forwarding rules you did not create.

Reading the trade history for the pattern

Once the keys are deleted, export or screenshot your order and trade history before changing anything else, then look for the signature of an API drain: trades in pairs you have never used, usually small coins with little volume; buy orders filled far above the price shown on the coin's chart; many orders in a short burst, often at night in your time zone; and a stablecoin or major coin balance that fell while a balance in an obscure token appeared.

Some exchanges show where each order came from (app, web or API). If yours does, that column settles the question quickly. If every suspicious order came through the API while your logins look normal, the key was the route, and changing the password alone would not have stopped it.

Keep a list with timestamps, pairs, prices and order IDs. Support will ask for it, and so will a police report if you file one.

Reporting it, and what to expect

Open a ticket through the exchange's own app or website, never through a link or a support account that contacts you first. Give the order IDs, the time window and the fact that the orders came through an API key, and say which third-party service the key was created for. If a service is at fault, report it to that service as well.

Be realistic about reimbursement. The key was a valid credential issued by you, so exchanges generally treat what it did as activity on your account. Some have compensated users after large third-party leaks; many do not, and the trades themselves were real trades with real counterparties. A clear, well-documented report is still worth filing, because it is the only route to anything being recovered or frozen.

Then expect the second wave. People who post about a loss publicly are quickly contacted by "recovery experts" and "blockchain investigators" promising to trace and return funds for an upfront fee. They are scams without exception. No outside party can reverse trades on an exchange, and paying one only adds a second loss.

Locking keys down properly

Give each tool its own key, with the least permission it needs. A tax or tracking tool needs read access and nothing else. A bot needs trading on the markets it trades and never withdrawal. If a tool asks for withdrawal permission, that request is the answer to whether you should use it.

Restrict every key to the IP addresses of the service using it, if the service publishes them. On Binance an IP-restricted key is the only kind that can ever be given withdrawal rights, and Binance also deletes keys without an IP restriction after 30 days of inactivity. A key that works only from one server is useless to someone who copies it.

Where the exchange supports sub-accounts, run bots in a sub-account funded with only what the bot trades. A leak then costs that sub-account, not your savings. Review the API management page every month or two and delete anything you no longer use. Store secrets in a password manager rather than in documents, chats or code, and never paste one into a website you reached from an advert or a direct message.

Before you create the next key: a short checklist

Ask whether the tool needs a key at all, or whether public data would do. If it needs one, find out which permissions it requires and refuse anything beyond them. Check whether the service publishes fixed IP addresses you can restrict the key to; a service that cannot tell you where its requests come from is telling you something about how it runs.

Look up who runs the service and how long it has operated, and search its name with words like leak, breach and unauthorized trades. A tool that stores thousands of users' keys is a target in its own right, and the 3Commas incident showed that a legitimate company can lose them.

Label every key with the tool and the date you created it, so the API management page tells you at a glance what each one is for. Put a reminder in your calendar to review the list. And keep the money a key can reach small: a bot running in a sub-account with a few hundred dollars is an experiment, while the same bot on your main account is a bet that nobody who ever holds that key will misuse it.

Most tools never need a key at all

A lot of API keys exist for jobs that do not need one. Watching a price, being alerted when a coin moves 5%, following the market while you sleep: all of that runs on public market data. A price alert app has no reason to see your balances, and none at all to place orders.

CoinPriceAlert is built on that principle. It never asks for an exchange API key, a wallet connection or a recovery phrase, so there is nothing in it that could trade or withdraw even if its servers were compromised. If an alert or tracking app asks you for a key with trading or withdrawal rights, treat it the way you would treat a stranger asking for your password.

The durable rule is simple: every key you create is a copy of your account's trading power, held by someone else. Create as few as you can, give each one as little as possible, and delete them when you stop using the tool.

CoinPriceAlert

Never miss a move in the markets you follow

Choose a level worth acting on and let the server do the watching — free to start, delivered by push, Telegram or email, quiet overnight if you want it.

• Fires about a second after the price hits
• Runs on our servers, so it reaches you with the app closed
• Free for 3 alerts — no card, no account

Download the app for real-time notifications

Frequently asked questions

Price alerts that never need an exchange key or wallet access: crypto price alerts, or every market and alert type. Choosing an app? How the alert apps compare, from their own pricing pages.

Related terms

• what to do if your exchange is hacked — when the exchange itself, not your key, is the problem
• crypto app permissions — what an app should and should not ask for
• token approvals — the wallet-side equivalent of a leaked key
• two-factor authentication — which methods resist SIM swaps

Sources

• Binance Blog: How to use an API key securely, 5 tips from Binance
• CoinDesk: Anonymous Twitter user leaks alleged 3Commas API database (28 Dec 2022)
• 3Commas: Notice on API data disclosure incident

Keep reading