3Commas Review

How 3Commas scores in crypto trading tools

3Commas is rated in our crypto trading tools ranking, where every tool is marked 0 to 10 on the same five criteria at equal weight. The basis is desk research of the company's public pages, checked on 6 November 2026. We did not open an account or run a bot, so nothing below describes how the bots perform.

The overall score is the plain average: (9 + 9 + 8 + 8 + 8) ÷ 5 = 8.4.

Three marks moved at this check because the evidence has changed since the July 2026 review, which had been read mainly from the pricing page. Custody & API safety rose from 6 to 9 after we found the withdrawal-disabled, trade-only key instruction in the connection guide and the non-custodial statement on the security page. Venue coverage rose from 6 to 8 because the security page now names 14 integrations rather than giving only a count. Security posture rose from 4 to 6 because the security page and the incident notice document specific measures, and then from 6 to 8 under the category's security scale, set on 6 November 2026, which marks security on the number of disclosed controls. The earlier score was 6.6.

Strongest criteria

Pricing (9). Every tier is published as a dollar figure, both monthly and annual, with the bot limits per plan: 5 DCA, 2 signal and 2 grid bots on Starter, rising to 1,000 of each on Expert. A reader can work out the cost before signing up, which is what this criterion measures. The 9 matches Altrady, Bitsgap and Cryptohopper, which also publish every tier; refund terms sit on a separate page, with a 15-day window on a first subscription.

Custody & API safety (9). 3Commas never holds coins; trades run on the user's own exchange account. The connection guide tells users to give the key trading access only and to disable withdrawals, and recommends binding the key to 3Commas IP addresses where the exchange allows it. That is the arrangement the rubric scores highest. A trade-only key still lets whoever holds it place orders in your account, which is why the custody mark and the security mark are read together.

Entity transparency (8). The operating company, its registration number and a full British Virgin Islands address are on the about page. That matches the standard at which Bitsgap and Cryptohopper also score 8. The pricing page itself no longer carries the entity, so the about page is now the source for this mark.

Weakest criteria

Security posture (8) credits three disclosed controls and holds back for what cannot be checked. The security page describes the Sign Center, an isolated service that stores keys and signs requests for 3Commas servers, plus Cloudflare's firewall and DDoS protection, and a table of exchanges that support IP allowlisting. The incident notice, last updated 21 May 2026, adds stricter encryption, behavioral monitoring, real-time API alerts and integration logs. It also says engineering processes now get "external review by third-party security auditors," but names no firm and links no report, so that claim cannot be checked. The same notice confirms that some users' API keys, secrets and passphrases were disclosed by a third party in December 2022. Thirteen users sued over the resulting losses in a proposed class action, Freeman v. 3Commas Technologies OÜ, filed on 9 January 2023 in the US District Court for the Northern District of California (No. 3:23-cv-00101); the complaint alleges, among other claims, negligence and that 3Commas failed to encrypt users' API keys, secrets and passphrases. The district court dismissed the case for lack of personal jurisdiction, and on 2 March 2026 the Ninth Circuit reversed and sent it back in an unpublished memorandum (No. 24-6158) that addresses jurisdiction only, not whether the allegations are true. Of the six controls the category's security scale counts, three are on the record: a described key-isolation design (the Sign Center), IP allowlisting, and a disclosed incident with the remediation set out. Three controls score 8, level with Bitsgap and Coinrule. The unnamed auditors are not counted, and no bug bounty is published.

Venue coverage (8) is held back by inconsistency rather than by a short list. The security page names 14 integrations, including Binance, OKX, Kraken, Coinbase Advanced, Bybit, KuCoin, Bitget and Gemini. The pricing page says nine exchanges are included per plan, and the connection guide walks through nine, one of them Hyperliquid, which is connected through a Web3 wallet and does not appear in the security page's list. A reader has to check which list applies to their exchange.

What the score does not cover

• Bot results. Whether a DCA or grid strategy makes money depends on the market and the settings, and no rubric criterion measures returns. Our guide to dollar-cost averaging explains the idea the DCA bot automates.
• Exchange trading fees, which are charged by the exchange on every fill and sit outside 3Commas' subscription.
• Ease of use and support quality, which cannot be evidenced without using the product.
• QuantPilot, the separate agent-based product 3Commas opened in June 2026, which is not part of this entry.

3Commas vs Cryptohopper and Bitsgap

On current marks 3Commas ranks second of ten at 8.4, level with Altrady and Cryptohopper; ties are listed alphabetically. Cryptohopper matches it on pricing (9), custody (9) and entity (8), scores higher on security (9 against 8) and lower on venue coverage (7 against 8). Bitsgap, at 8.8, is 0.4 points ahead: it matches 3Commas on pricing (9), security (8) and entity (8) and leads on custody (10 against 9) and venue coverage (9 against 8). Gunbot, at 7.6, sits 0.8 points below 3Commas.

Who it suits

The score suits someone who wants a hosted bot service with published prices, a named operator and a choice of mainstream exchanges, and who is prepared to set up trade-only, IP-restricted keys. It is a weaker fit for anyone who will not hand trade access to a server-side service that has already had keys exposed; a tool that keeps keys on your own machine addresses that risk differently. The full criteria are explained in our ratings methodology.