3Commas Review: Pricing, Bots & API Risks

3Commas is software that sends trading instructions to a connected crypto exchange; it is not an exchange and does not hold the trading balance. The current paid plans are Starter at $20 monthly, Pro at $50, and Expert at $140. Those prices buy automation capacity, not a strategy or a promised return. A useful 3Commas review therefore has to test the bot logic, exchange connection, API permissions, failure states, and billing terms together.

The strongest use case is operational: run a defined DCA, Grid, or Signal-bot rule across a supported exchange while retaining the assets at that exchange. The largest risk is also operational: an API with trading permission can place damaging orders even when withdrawals are disabled. 3Commas officially confirmed a disclosure of some users' API credentials in December 2022 and says it has since added stronger controls. That history belongs in the purchase decision.

What 3Commas does

3Commas connects to a centralized exchange through an API key or, on supported venues, Fast Connect. Its software can create and manage orders through DCA bots, Grid bots, Signal bots, SmartTrade, and terminal tools. The exchange remains the venue that holds the assets, calculates margin, and executes each instruction.

This separation matters. 3Commas can standardise when an instruction is sent, but it cannot make liquidity, spread, slippage, exchange uptime, symbol rules, leverage, or liquidation risk disappear. The exchange's fill and account state are authoritative. A 3Commas dashboard result should be reconciled with the exchange order history before it is used to assess a strategy.

A Signal bot is also not automatically copy trading. It can receive a webhook or another external instruction without following a named trader's account. Copy trading transmits another account's orders; signal automation executes a condition or message. The risk question is the same in one respect: who can initiate an order, with what size, and under which shutdown rule?

3Commas pricing and current plan limits

The figures come from the public pricing page and the subscription-plan guide. The annual totals above translate the displayed monthly equivalents into the amount committed for 12 months: $180, $456, or $1,260. Local currency, VAT, a personal discount, or checkout changes can alter the payment, so save the actual order summary rather than relying on a monthly-equivalent headline.

A current limit conflict to resolve before payment

The public pricing page also says paid plans include 9 exchanges, while the live compatibility guide lists more exchange and account-type rows. These are not safely interchangeable counts: one venue can have separate spot, perpetual, regional, or sub-account behavior. Plan by the exact exchange, jurisdiction, market, and bot feature rather than by a logo or aggregate number.

DCA, Grid, Signal bots, and SmartTrade

DCA bots

A DCA bot can open a base order and add safety orders according to user-defined triggers. Averaging changes the entry price, but it also increases position size while price moves against the original trade. Before enabling a bot, define the maximum number of safety orders, total capital at the final order, liquidation distance for leverage, stop condition, and combined exposure across correlated pairs.

The current plan guide allocates 100 DCA backtests over 1 year to Starter, 500 over 2 years to Pro, and 5,000 over the available full history to Expert. A higher run allowance creates more ways to overfit. Keep one untouched validation period and record every tested parameter; the backtesting-integrity checklist explains why future leakage, missing friction, and repeated parameter selection can turn historical simulation into a misleading result.

Grid bots

A Grid bot places repeated orders across a defined range. It can harvest oscillation only while the orders, fees, and inventory behavior fit the market. A sustained trend can leave a spot grid holding a falling asset or a futures grid carrying a leveraged position. Test range exits, gaps, insufficient balance, partial fills, fee drag, and the action taken when price leaves the grid.

Signal bots

A Signal bot converts external messages or Pine Script execution into orders. That reduces manual delay but adds a dependency chain: signal source, webhook authentication, network delivery, symbol mapping, exchange API, and order response. Test a duplicate signal, late signal, malformed size, unsupported symbol, close signal after a manual intervention, and a signal that arrives while the exchange is unavailable.

SmartTrade and the terminal

SmartTrade groups entry and management instructions such as multiple take profit, trailing behavior, break-even, and stop loss. The terminal offers a common interface across supported connections. These tools can make an execution plan repeatable, but the exchange still decides whether an order is accepted and where it fills. Confirm every protection order on the exchange itself after creation.

Exchange compatibility is a four-part check

The current exchange matrix separates spot from derivatives and names feature differences for each venue. It also warns that some exchanges or account types are restricted by country and that not every supported exchange offers every 3Commas feature. Test all 4 parts before funding a workflow:

1. Entity and region: verify the exact regional exchange account, not only the global brand name.
2. Market: verify spot, margin, USDT perpetual, inverse perpetual, or dated futures separately.
3. Feature: verify the intended DCA, Grid, Signal, SmartTrade, backtest, sub-account, and leverage-mode support.
4. Permissions: confirm that the minimum API permissions can perform the intended orders without enabling withdrawals or unrelated services.

Use a separate exchange sub-account when the venue supports it. That isolates bot capital and makes the maximum exposure visible. A compatibility row is not evidence that a production-size order, stop, or shutdown path works correctly on the user's exact account.

API security and the 2022 disclosure incident

On 29 December 2022, 3Commas confirmed that some users' API keys, secrets, and passphrases had been disclosed. Its notice said the credentials could have been used to connect exchange accounts or initiate unauthorized trades. That is stronger and more useful evidence than calling the event a generic “hack” or relying on an unsourced user count.

The same notice includes a later vendor update claiming stricter encryption, isolated API-key environments, rate limiting, behavioral analytics, exchange-restriction checks, activity logs, alerts, and quicker revocation controls. Those measures are relevant improvements claimed by 3Commas; this review has not independently audited their implementation and does not treat them as proof that another disclosure or unauthorized trade cannot occur.

3Commas describes the service as non-custodial and says its transactional API access cannot withdraw or transfer fiat or crypto. That reduces one risk path, but it does not make the connection harmless. A trading-enabled key can buy illiquid assets, sell holdings, add leverage, or open positions that lose value. The official 2022 notice itself identified unauthorized trades as a possible consequence.

Minimum security configuration

• Use a dedicated API key: never reuse the same key across 3Commas and another service.
• Isolate capital: use a separate exchange sub-account and transfer only the amount assigned to the tested bot.
• Grant least privilege: enable only the required trading market; leave withdrawals and transfers disabled.
• Prefer constrained connection methods: use Fast Connect where available or the exchange's trusted-IP whitelist when using manual keys.
• Protect both accounts: enable 2FA on the exchange and 3Commas, use unique passwords, save backup codes offline, and set the 3Commas anti-phishing code.
• Monitor the exchange: enable order/login alerts and reconcile activity rather than relying only on the 3Commas interface.
• Know the kill switch: practise stopping bots, cancelling orders, closing positions, and revoking the API key before increasing capital.

These controls follow the platform's published security checklist, with an added emphasis on limiting blast radius. They reduce exposure; they do not convert automated crypto trading into a low-risk activity.

A connected-exchange test plan

Automation can enforce a written rule, or it can accelerate repeated off-plan orders. The overtrading audit shows how to compare planned entries, later attempts, turnover cost, and post-stop violations. Apply the same log to bot orders; “the bot did it” is not a separate risk category.

What happens when the subscription ends?

3Commas says a paid plan may remain active for a short, unspecified grace period before the account moves to Free. After that downgrade, active trades and SmartTrades are not automatically cancelled. Real DCA and Grid bots are disabled, but existing DCA trades and their averaging, take-profit, or stop orders may continue; spot Grid assets remain in the balance, and futures Grid positions may remain open.

Signal bots stop processing new open or close signals after the downgrade, although take-profit and stop orders already placed through the SmartTrade can continue. This creates a material offboarding risk: a trader who assumes “subscription ended” means “account is flat” can leave positions or orders live. Before cancellation or payment failure, stop each bot, reconcile every open order at the exchange, close or retain inventory deliberately, and revoke the trading key when the service is no longer needed.

Trial, renewal, and refund terms

The current subscription FAQ offers new users a 7-day Starter, Pro, or Expert trial after adding a valid card, Apple Pay, Google Pay, or PayPal method. It says no payment is taken at the start, reminders arrive 3 days before and on the final day, and the selected paid plan is charged if the trial is not cancelled before it ends.

Card, PayPal, Apple Pay, and Google Pay subscriptions recur by default; crypto subscription payments do not. Cancelling recurrence leaves access active until the displayed expiry date. A queued subscription can also start after an existing plan ends, so inspect Subscription History rather than checking only the currently active label.

The refund guide effective 18 December 2025 gives global, non-EEA users a full refund on the first monthly payment when requested within 15 days, but an immediately preceding 7-day trial counts inside that window. Second and later monthly payments have a 24-hour request window. EEA users are directed to a separate policy. Cancel recurring payment separately and confirm the policy applicable to the billing entity and country before relying on a refund.

Benefits and limitations

Verdict: automation infrastructure, not an edge

3Commas is a plausible fit for a crypto trader who already has a testable rule, needs supported exchange automation, can isolate a small balance, and will monitor both the bot and the exchange. Starter covers a limited spot workflow. Pro is the practical step for futures or several strategies. Expert is difficult to justify unless the required bot volume, active connections, backtest allowance, or developer API genuinely exceeds Pro.

It is a poor fit for anyone seeking a profitable bot to copy, treating backtest output as a forecast, or assuming non-custodial access removes account risk. Resolve the active-account limit conflict, verify exact compatibility, run the failure drill, and understand what remains open after a downgrade before paying annually or increasing connected capital.

Frequently asked questions