新型黑客手法：3Commas API KEY 泄露；在 FTX 等对敲盗币 全过程记录

吴说区块链Published on 2022-10-25Last updated on 2022-10-25

Abstract

一名来自巴拉圭的受害者告诉吴说：他在攻击中损失了近 104 比特币。

21日一名杭州用户向吴说爆料：他的 FTX 账户在19日晚突然“疯狂”地进行交易达5000多次，账户资产160万美金接近归零，包括10几个 BTC、上百个 ETH 以及几千个 FTT 等，全部通过交易小币 DMG 对敲盗走。用户1年前开始使用量化机器人 3Commas，FTX 的 API 不需要更新，所以从来没动过也没保存过 API。

FTX 反馈是由于有能够访问 API KEY 的人通过 REST API 完成，可能是泄露了用户 API KEY。FTX 表示需要拿到立案通知书才能配合相关例如冻结等工作，但在用户提交报案回执后暂无回复。3Commas 则表示没有发生任何的泄露。

值得注意的是，FTX 客服在最初回复中表示，“受影响的并非只有你”，可随后 FTX 客服就不再联系，并且表示这是个误会。

问题来到了 3Commas 这边，它在吴说报道后连忙回应称：目前，3Commas 将此事视为重中之重。我们在登录时使用 2FA 和 OTP 等具有最高安全性，以确保用户帐户始终安全。我们与用户保持联系，以确保他们获得所需的所有支持。

随后 3Commas 发布了一个公告：

10 月 20 日，3Commas 团队接到警报，发生一起事件，其中一些合作伙伴交换 API 密钥连接到 3Commas，并用于在合作伙伴账户上对 DMG 加密货币交易对进行未经授权的交易。

在 3Commas 和我们的合作伙伴交易所进行的合作调查中，发现许多 API KEY 与新的 3Commas 帐户相关联，这些帐户首次创建并用于在合作伙伴交易所对 DMG 交易对执行未经授权的交易。API 密钥不是从 3Commas 获取的，而是从 3Commas 平台外部获取的。

我们扩大了调查范围，发现了几个假冒的 3Commas 网站，这些网站通过复制 3Commas 网络界面的设计并从 3Commas 用户那里捕获 API 密钥来“钓鱼”3Commas 用户，这些用户不小心使用假冒网站尝试连接他们的交易账户.

API 密钥随后由虚假网站存储，随后用于在合作伙伴交易所的 DMG 交易对上进行未经授权的交易。由于攻击的规模和复杂性，我们还怀疑可能还使用了 3rd 方浏览器扩展或恶意软件。作为预防措施，合作伙伴交易所和 3Commas 已识别出可能存在可疑活动的帐户，并禁用了可能已泄露的 API 密钥。

如果您有一个连接到 3Commas 的交易所帐户，并且显示 API“无效”或“需要更新”，那么您的 API 详细信息可能已被泄露，并且 API 密钥已被合作伙伴交易所删除。我们敦促您在该交易所创建新的 API 密钥。

https://3commas.io/blog/3commas-security-update-october-20

然而在公告发布后，更多的受害者开始出现。

一名来自巴拉圭的受害者告诉吴说：他在攻击中损失了近 104 比特币，他强调FTX 自 10 月 19 日以来就知道该漏洞，两天后我遭到了攻击！3Commas 说是网络钓鱼攻击，但我从未使用我的 3Commas 帐户来设置机器人，而且该帐户甚至已过期并已降级为免费帐户。我已经有一年多没有进入该帐户，我从未将密钥或 API 密钥保存到任何文档中，但仅在一年多前使用它来建立 FTX 连接。我也是一名 IT 工程师，我的笔记本电脑和智能手机由 Norton 360 和其他积极防止任何网络钓鱼或病毒攻击的机制保护。

另一名来自中国的量化交易的受害者也表示，从未使用过 3Commas。在他的截图中，19、20、21日均发生了关于 DMG 的对敲盗币，但 FTX 竟然没有对此做预防措施。

https://twitter.com/littlesand2/status/1583830658203283456

随着舆论发酵，10月24日 SBF 终于回应，表示将赔偿600万美金，但“这是一次性的事件，我们不会养成补偿被其他公司的假冒版本钓鱼使用的习惯”。目前用户已经收到了赔偿的金额。FTX 对敲盗币事件攻击者已将所获取利润转移至 Binance 和 FixedFloat 交易所。SBF 表示若攻击者在 24 小时内归还 95% 的被盗资金，则免除其法律责任。

目前来看，FTX 与 3Commas 都坚称是用户登陆了虚假钓鱼网站而泄露了 API KEY。受害者当然对此并不同意。但事件核心确实是 API KEY 泄露。由于数据都掌握在 3Commas 与 FTX 内部，披露的信息目前也非常稀少，所以真相究竟如何，外界可能也无法完全了解。总而言之，对 API KEY 的授权与管理需要更加谨慎。

24日晚，据 @x_explore_eth 最新研究，因为 API KEY 泄露，除了 FTX 用户因为对敲遭到数百万美金的损失，Binance US 和 Bittres 的交易所也遭到类似的攻击，使用的小币种分别为 SYS/USD 与 NXT/BTC，损失分别达到 1053 ETH 和 301 ETH。FTX 的 DMG/USD 当攻击发生时，交易量增加千倍币价波动2-3倍，属于重大异常交易事件，但 FTX 并没有即时阻止，问题后续持续多次发生，因此也需要承担一定的责任（SBF 也及时补偿了用户损失），其他交易所也应该对此多加关注。

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
aPrioriAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
mantra
MantraMANTRA
xvs
VenusXVS
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
velodrome
Velodrome FinanceVELODROME
brev
BrevisBREV
zrx
ZRX（0X）ZRX
cake
PancakeSwapCAKE

Related Reads

Foundation Steps Back, Ethlabs Steps Forward: Ethereum Undergoes Its Largest Restructuring in History

On June 23rd, the Ethereum ecosystem witnessed two major shifts, signaling a significant governance realignment. First, former Ethereum Foundation researchers established Ethlabs, a new independent non-profit. Backed by major ETH holders like Bitmine and SharpLink, Ethlabs aims to address practical needs for institutional adoption, including faster settlement, native asset issuance, cross-chain transactions, and mainnet scaling. Secondly, the Ethereum Foundation announced a major restructuring, laying off 54 employees (20% of its staff) to become a leaner entity focused on protocol governance and maintenance rather than being the primary builder. This move represents a pivotal correction. Criticisms had mounted over the Foundation's perceived slowness, lack of clear strategy, and over-reliance on Vitalik Buterin's influence. Ethlabs emerges as a more execution-oriented, "industrialized" layer focused on market adoption—bridging the gap between research and real-world use. Notably, Vitalik Buterin is absent from its list of supporters, interpreted as an intentional step to avoid excessive personal endorsement and allow the organization to build independent credibility. The Ethereum Foundation's downsizing and redefinition mark a retreat from its former central coordinating role. It now aims to share the "privilege of stewarding Ethereum" with other emerging groups like Ethlabs, the Ethereum Applications Guild, and The Ethereum Economic Zone. Analysts frame this dual shift as the Foundation ensuring Ethereum remains "correct" (credibly neutral), while Ethlabs must prove it remains "effective" (competitive and attractive for capital and adoption). This addresses community "shareholder-like anxiety" about ETH's market performance. While risks exist—such as concerns over shifting from Foundation centrality to large-holder influence—the consensus is that the greater risk for Ethereum was inaction, caught between technical idealism and organizational inertia. These steps aim to create a more multi-stakeholder, execution-driven future for the network.

链捕手4h ago

Foundation Steps Back, Ethlabs Steps Forward: Ethereum Undergoes Its Largest Restructuring in History

链捕手4h ago

Bitbase World Trading Clash (BWTC) 2026 Is Live — Registration Open Through July

Bitbase has opened registration for BWTC 2026 (Bitbase World Trading Clash), a global trading competition with a Promotion Pool of up to 1,000,000 USDT. Registration runs from June 22 through July 23. The competition features two parallel tracks: a team-based Futures Team Pro track, scored on both total volume and return on capital, and an individual Trophy Picks track, ranked on individual volume. Team formation closes July 9. Over 2,000 traders registered in the first 36 hours, unlocking an initial 10,000 USDT in the dynamically scaling prize pool. Most rewards are paid as USDT futures trial credit (with profits withdrawable), except for a top-captain cash award. A referral-based scout program offers additional incentives. The event emphasizes rewarding effective capital usage over mere trading volume, aligning with Bitbase's "Trust Through Every Cycle" principle.

TheNewsCrypto6h ago

Bitbase World Trading Clash (BWTC) 2026 Is Live — Registration Open Through July

TheNewsCrypto6h ago

Second Half of U.S. Crypto Policy: The Clarity Act Aims for 60 Votes, CFTC's "One-Person Commission" Becomes Biggest Variable

In a pivotal year for US crypto policy, the "CLARITY Act" is advancing in the Senate but faces a high hurdle, needing 60 votes to pass. Key challenges include bridging partisan divides on ethics and swaying undecided Republican senators within a tight legislative calendar of only about 40 working days. The policy "second half" involves intense negotiations on a broader framework for Web3 and DeFi, including crypto tax reforms and the Blockchain Regulatory Certainty Act. A significant uncertainty is the understaffed CFTC, operating with four commissioner vacancies, which complicates regulatory clarity. Meanwhile, the departure of key "crypto champions"—SEC Commissioner Hester Peirce and Senator Cynthia Lummis—will impact ongoing policy efforts. Industry experts are cautiously optimistic but realistic. Sara K. Weed notes that while progress is being made, CLARITY is unlikely to pass this Congress, pushing agencies like the SEC and CFTC to provide more guidance. Sulolit Mukherjee suggests meaningful crypto tax legislation is more likely to be attached to larger must-pass bills. Rashan Colbert discusses the jurisdictional debate over prediction markets, emphasizing the need for a regulatory framework that fosters their development as financial tools rather than treating them broadly as gambling. The clock is ticking, but opportunities remain for substantive progress through continued bipartisan dialogue and pragmatic efforts.

marsbit7h ago

Second Half of U.S. Crypto Policy: The Clarity Act Aims for 60 Votes, CFTC's "One-Person Commission" Becomes Biggest Variable

marsbit7h ago

Dan Koe's New Essay: Escaping the Fate of the Wage Slave, How to Survive the AI Replacement Wave?

Dan Koe argues that the true threat in the AI era isn't technology itself, but a reliance on others for one's livelihood and happiness. The core problem is "wage slavery"—spending life on unfulfilling work. To survive and thrive, one must escape this by building their own enterprise. The key is developing five elements: Agency (initiative), Taste (discernment), Persuasion, Persistence, and Iteration. These boil down to problem-solving skills and experiential knowledge, which cannot be learned passively but only through doing your own projects. The solution is to become "unemployable" by shifting your identity. This requires: 1) Radically changing your environment to force growth, 2) Choosing a medium (like content creation) that provides real feedback through trial and error, and 3) Mastering either code or, preferably, media (content). Content creation is more valuable because its subjective nature and need for human perspective create a durable advantage over generic AI output. To start, define your life's work by answering foundational questions about your innate knowledge, unique abilities, and contrarian beliefs. Then, immediately act by publishing your first piece of content. The cycle of creating, receiving feedback, and iterating is the essential path to developing the skills needed for an independent, meaningful career and financial resilience.

marsbit8h ago

Dan Koe's New Essay: Escaping the Fate of the Wage Slave, How to Survive the AI Replacement Wave?

marsbit8h ago

Research Report Analysis: Morgan Stanley Details SanDisk SNDK, The Truth About Cloud Data Center Pricing Power and AI Inference Benefits

Morgan Stanley raised its price target for SanDisk (SNDK) from $1100 to $1750 on June 22, maintaining an Overweight rating. The upgrade is driven by AI inference demand reshaping the NAND market, particularly for KV Cache and context window storage in cloud data centers. These cloud clients exhibit price inelasticity and sign long-term contracts, granting SanDisk significant pricing power. SanDisk's New Business Model (NBM) agreements, covering over one-third of FY27 bit shipments with 3-5 year terms and fixed price/price collar structures, are crucial. They are projected to sustain gross margins around 80% even at floor prices, providing a buffer against cyclical downturns. Morgan Stanley forecasts gross margins to surge from 30.3% in FY25 to 86.7% in FY27e. With NAND supply expected to remain tight into 2026/2027 and cloud/data centers becoming the largest end-market, SanDisk holds supply-side pricing power. The company targets 15-19% bit growth via technology transitions, not capacity expansion. Revenue is projected to grow ~6.6x from FY25 to FY27, with EPS rising from $2.74 to $14.73, driven by high-margin cloud business. Key upside catalysts include faster enterprise SSD adoption and edge AI growth. Downside risks involve slower industry growth, competitor capex increases, market share loss, and competition from Chinese players like YMTC. The investment thesis rests on AI-driven structural demand, NBM's margin protection, and sustained supply tightness. The $1750 target implies ~28x FY27e P/E.

marsbit8h ago

Research Report Analysis: Morgan Stanley Details SanDisk SNDK, The Truth About Cloud Data Center Pricing Power and AI Inference Benefits

marsbit8h ago

Trading

Spot
Futures

Hot Articles

What is $BITCOIN

DIGITAL GOLD ($BITCOIN): A Comprehensive Analysis Introduction to DIGITAL GOLD ($BITCOIN) DIGITAL GOLD ($BITCOIN) is a blockchain-based project operating on the Solana network, which aims to combine the characteristics of traditional precious metals with the innovation of decentralized technologies. While it shares a name with Bitcoin, often referred to as “digital gold” due to its perception as a store of value, DIGITAL GOLD is a separate token designed to create a unique ecosystem within the Web3 landscape. Its goal is to position itself as a viable alternative digital asset, although specifics regarding its applications and functionalities are still developing. What is DIGITAL GOLD ($BITCOIN)? DIGITAL GOLD ($BITCOIN) is a cryptocurrency token explicitly designed for use on the Solana blockchain. In contrast to Bitcoin, which provides a widely recognized value storage role, this token appears to focus on broader applications and characteristics. Notable aspects include: Blockchain Infrastructure: The token is built on the Solana blockchain, known for its capacity to handle high-speed and low-cost transactions. Supply Dynamics: DIGITAL GOLD has a maximum supply capped at 100 quadrillion tokens (100P $BITCOIN), although details regarding its circulating supply are currently undisclosed. Utility: While precise functionalities are not explicitly outlined, there are indications that the token could be utilized for various applications, potentially involving decentralized applications (dApps) or asset tokenization strategies. Who is the Creator of DIGITAL GOLD ($BITCOIN)? At present, the identity of the creators and development team behind DIGITAL GOLD ($BITCOIN) remains unknown. This situation is typical among many innovative projects within the blockchain space, particularly those aligning with decentralized finance and meme coin phenomena. While such anonymity may foster a community-driven culture, it intensifies concerns about governance and accountability. Who are the Investors of DIGITAL GOLD ($BITCOIN)? The available information indicates that DIGITAL GOLD ($BITCOIN) does not have any known institutional backers or prominent venture capital investments. The project seems to operate on a peer-to-peer model focused on community support and adoption rather than traditional funding routes. Its activity and liquidity are primarily situated on decentralized exchanges (DEXs), such as PumpSwap, rather than established centralized trading platforms, further highlighting its grassroots approach. How DIGITAL GOLD ($BITCOIN) Works The operational mechanics of DIGITAL GOLD ($BITCOIN) can be elaborated on based on its blockchain design and network attributes: Consensus Mechanism: By leveraging Solana’s unique proof-of-history (PoH) combined with a proof-of-stake (PoS) model, the project ensures efficient transaction validation contributing to the network's high performance. Tokenomics: While specific deflationary mechanisms have not been extensively detailed, the vast maximum token supply implies that it may cater to microtransactions or niche use cases that are still to be defined. Interoperability: There exists the potential for integration with Solana’s broader ecosystem, including various decentralized finance (DeFi) platforms. However, the details regarding specific integrations remain unspecified. Timeline of Key Events Here is a timeline that highlights significant milestones concerning DIGITAL GOLD ($BITCOIN): 2023: The initial deployment of the token occurs on the Solana blockchain, marked by its contract address. 2024: DIGITAL GOLD gains visibility as it becomes available for trading on decentralized exchanges like PumpSwap, allowing users to trade it against SOL. 2025: The project witnesses sporadic trading activity and potential interest in community-led engagements, although no noteworthy partnerships or technical advancements have been documented as of yet. Critical Analysis Strengths Scalability: The underlying Solana infrastructure supports high transaction volumes, which could enhance the utility of $BITCOIN in various transaction scenarios. Accessibility: The potential low trading price per token could attract retail investors, facilitating wider participation due to fractional ownership opportunities. Risks Lack of Transparency: The absence of publicly known backers, developers, or an audit process may yield skepticism regarding the project's sustainability and trustworthiness. Market Volatility: The trading activity is heavily reliant on speculative behavior, which can result in significant price volatility and uncertainty for investors. Conclusion DIGITAL GOLD ($BITCOIN) emerges as an intriguing yet ambiguous project within the rapidly evolving Solana ecosystem. While it attempts to leverage the “digital gold” narrative, its departure from Bitcoin's established role as a store of value underscores the need for a clearer differentiation of its intended utility and governance structure. Future acceptance and adoption will likely depend on addressing the current opacity and defining its operational and economic strategies more explicitly. Note: This report encompasses synthesised information available as of October 2023, and developments may have transpired beyond the research period.

433 Total ViewsPublished 2025.05.13Updated 2025.05.13

What is $BITCOIN

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of BTC (BTC) are presented below.

活动图片

Top Questions