FTX Users Lose Millions due to API Exploit

On Saturday, several crypto traders suffered massive losses after hackers stole millions of dollars worth of digital assets from their FTX accounts by exploiting an API linked to their trading accounts.

An FTX user was shocked when he realized that his account using the 3Commas API traded the Governance (DMG) token more than 5,000 times, resulting in a loss of about $1.6 million worth of assets, including Bitcoin, Ether, and FTX tokens.

3Commas is a crypto trading platform that allows users to build automated trading bots on FTX and many other exchanges.

The report confirmed that this was not an isolated incident, as there were three other victims who suffered the loss. The second victim of the FTX exploits disclosed that he lost $1.5 million to the incident, which occurred on October 21. While he said malicious players had traded DMG via his account on October 18th and 19th, he questioned why FTX had not put in place risk control measures to guard against illegal trading activities.

An investigation conducted by trading-bot platform 3Commas and crypto exchange FTX showed that API keys linked to 3Commas were used to carry out unauthorized trades for DMG trading pairs on FTX. Both FTX and 3Commas identified that hackers used new 3Commas accounts to perform the DMG trades, as “the API keys were not taken from 3Commas but from outside of the 3Commas platform.”

The investigation showed that fraudulent websites identifying themselves as 3Commas were used to phish API keys as users linked FTX accounts to fraudulent web interfaces. The fake websites' API keys were then stored and later used to put the unauthorized trades on the DMG trading pairs on FTX.  3Commas further suspected that hackers used third-party browser extensions and malware to steal the API keys from users.

The duo identified suspicious accounts based on user activity and, as a result, suspended the API keys to avoid further losses. FTX users who linked their accounts with 3Commas, therefore, received a message concerning their API as being “invalid” or “requires updating” and now are expected to create new API keys.

3Commas and FTX are currently working with the victims to provide assistance and garner more information about the hacking incident.

Why Crypto Hacks Are Surging

2022 has been identified as the worst year in terms of crypto hacks, according to a Chainalysis research firm. October is recognized as the worst-ever month for crypto-related crimes, with more than $718 million in overall losses. Funds were stolen from various DeFi protocols during 11 different attacks.

This year is expected to surpass 2021 as the most prolific year for hacking on record, with 125 hacks that have led to over $3 billion worth of funds stolen so far. $325 million attack on cross-chain service Wormhole, a $625 million attack on Axie Infinity’s Ronin bridge, a $200 million attack on the Nomad bridge, a $100 million hack on Binance, and many more took place this year.

Poorly protected protocols and unaudited decentralized apps are easy pickings for hackers who take advantage of their highly vulnerable locks.