Crypto Exchange API Key Leaked? What Attackers Can Actually Do

Altcoin
By: WEEX|2026-08-03 02:00:00

Most guides tell you a leaked API key is bad and stop there. The more useful question is narrower: what can someone holding your key actually do with it before you revoke it?

The answer depends almost entirely on one setting — the permission scope attached to the key — and on whether the exchange lets an API key move coins off the platform at all. On WEEX, it does not. As of August 2026, the WEEX API documentation offers exactly two permission types per key, Read-only and trading (Spot or Futures). There is no withdrawal permission to enable, and no toggle to accidentally leave on.

That removes the worst outcome. It does not remove the loss. A trade-only key has drained accounts before, and the mechanism is worth understanding before you create your next key.

Can someone steal your crypto with a trade-only API key?

Not by withdrawing it. They take it by trading against you.

Crypto Exchange API Key Leaked? What Attackers Can Actually Do

The reference case is Binance on 3 July 2018. Attackers had spent roughly two months phishing user credentials and quietly generating trading API keys on the compromised accounts. They then pre-positioned sell orders on the thin VIA/BTC book across 31 accounts of their own, and used the victims' keys to market-buy VIA in a two-minute window. VIA spiked close to 70x. The victims' balances had been converted into an illiquid altcoin at the top; the attackers' accounts held the BTC. Binance's risk system froze withdrawals, localised the trades and reversed them — but the exit was never a withdrawal endpoint. It was the order book.

That pattern is why "no withdrawal permission" should be read as one control rather than as safety. The practical rule: a trading key is only as safe as the least liquid pair your account can reach.

Where exchange API key leaks actually come from

Three sources dominate, and only one of them is the exchange.

Your own code and infrastructure. GitGuardian's State of Secrets Sprawl 2026, published March 2026, found roughly 29 million new hardcoded secrets pushed to public GitHub during 2025 — a 34% year-over-year increase and the largest single-year jump the report has recorded. Automated scrapers monitor public commits, Pastebin and container images continuously, so exposure windows are measured in minutes, not days.

Third-party bots and portfolio tools. In December 2022, an anonymous account began publishing a database of roughly 100,000 3Commas customer API keys; CEO Yuriy Sorokin confirmed the files were authentic and asked Binance, KuCoin and other venues to revoke every connected key. Users had reported unauthorised trades since October, and the platform had publicly attributed them to phishing before confirming the breach. Every key you hand to an external service inherits that service's security posture — and its incident-disclosure timeline.

Phishing. Chainalysis recorded $3.4 billion stolen across crypto in 2025, with individual-wallet and credential compromises making up a growing share of incidents even as single large exchange breaches dominated the dollar totals. Credential theft feeds directly into key generation, as the 2018 Binance case showed.

What a leaked WEEX API key can and can't do

The table below is drawn from the live WEEX spot API documentation and the API FAQ, last updated 14 April 2026. Details can change with system upgrades — check the docs before you build against them.

ActionRead-only keySpot / Futures trading keyAny WEEX API key
Query balances and trade historyYesYesYes
Place and cancel ordersNo (-1052)Yes, in that market only
Withdraw crypto to an external addressNoNoNot supported
Transfer to another WEEX accountNoNoNot supported
Change account settings or 2FANoNoNot supported
Work from an unlisted IP when an allowlist is setNo (-1056)No (-1056)No

The error codes matter operationally. -1052 INSUFFICIENT_PERMISSIONS is what a read-only key hits when something tries to place an order — which means a rejected -1052 in your logs is also your earliest signal that a key is being probed. -1056 ILLEGAL_IP is the allowlist doing its job. -1055 USER_AUTH_NOT_SAFE blocks accounts that have not bound a phone number or Google Authenticator from using the API at all. The full list is in the WEEX API error codes reference.

-- Price

--
--
--

The WEEX API security controls worth configuring on day one

Several of these are enforced at the request level, not as advice. Numbers below are from WEEX's spot documentation and API Management page as of August 2026.

ControlWEEX settingWhy it matters after a leak
Default permissionRead Only on every new keyA key created carelessly cannot trade
Keys per accountUp to 10 API key groupsSeparate keys per bot; revoke one without killing everything
IP allowlistUp to 10 IPs per key, comma-separatedA stolen key fails with -1056 from any other network
SignatureHMAC SHA256 over timestamp + method + path + query + body, Base64-encodedThe secret never travels on the wire
Replay windowRequests rejected if the timestamp is off by more than 30 secondsA captured request is unusable within half a minute
Account 2FAPhone or Google Authenticator required, else -1055Blocks API use on under-secured accounts
Rate limits100 spot orders/min; 80 cancels/10s; 300 REST/WS connections per 5 min per IP; HTTP 429 then a 10s banCaps how fast an attacker can churn an account
Propagation delayNew or modified keys take about 15 minutes to take effect globallySee below — this cuts both ways

That last row is the one most traders miss. WEEX documents roughly a 15-minute global propagation window for newly created or modified API keys. Plan around it: do not assume a permission change you just saved is live everywhere, and do not treat editing a key's scope as an emergency response. Deletion is the emergency response.

The signature scheme is also worth reading properly if you are building your own client — the exact concatenation order and the 30-second timestamp tolerance are the two things most first integrations get wrong. WEEX documents both, with worked examples, on its API signature page.

What to do in the first 10 minutes after an API key leak

Order matters more than completeness here. Revoke first; investigate second.

  1. Delete the key. Not edit, not restrict — delete, in API Management. WEEX's own documentation is explicit: delete compromised API keys immediately.
  2. Cancel open orders manually in the web interface. Anything the key placed stays live after the key dies.
  3. Flatten or reduce exposure in illiquid pairs. This is where forced-trade losses concentrate.
  4. Check the account's trade history for fills you did not place, with timestamps. This is your evidence set if you contact support.
  5. Rotate everything downstream. If the key sat in a repo, assume the whole repo's secrets are compromised, not just that key.
  6. Re-issue with an IP allowlist and the narrowest scope the strategy needs — read-only if the bot only monitors.
  7. Then look at how it leaked. Environment variables, a third-party service, a screenshot, a phishing page. If you cannot answer this, the replacement key is on the same trajectory.

Step 2 catches people out. Revoking a key stops new requests; it does not touch resting orders already on the book.

Creating a WEEX API key without leaving a hole

The setup itself takes about a minute. Go to Account → API Management → Create API Key and complete the security verification. Then three decisions do most of the work:

Scope. New keys default to Read Only. Only tick Spot or Futures/Contract if the strategy actually places orders. Tax and portfolio tools never need trading rights.

IP allowlist. Up to 10 addresses per key. If your bot runs on a fixed VPS, this single setting makes a leaked key close to useless — it will simply return -1056. WEEX's documentation calls unrestricted keys a security risk, which is a fair description of the risk-reward: you save two minutes of setup and give up your best containment control.

Passphrase. User-defined, alphanumeric only per the WEEX API FAQ, and unrecoverable — lose it and the only route is a new key. Store it in the same password manager entry as the secret, not in the bot's config file.

One habit worth adopting beyond the settings: one key per bot, per venue, per purpose. It costs nothing given the 10-key allowance, and it turns an incident from "revoke everything and rebuild" into "revoke one and keep trading." Full parameter details and rate limits are in the WEEX API FAQ.

The takeaway

A crypto exchange API key leak is not a single risk with a single outcome. On a venue where API keys cannot withdraw — as on WEEX — the exposure shifts from theft to forced trading, and the defence shifts accordingly: narrow scope, an IP allowlist, one key per job, and a revoke-first reflex that does not wait for you to finish diagnosing. The 2018 VIA episode and the 2022 3Commas disclosure both punished the same thing, which was not a weak exchange but a key that was broader and longer-lived than the job required.

Ready to build? Create your key in API Management with read-only defaults, add your IP allowlist before you add trading rights, and read the WEEX API documentation before your first signed request.

FAQ

1. Can a leaked API key withdraw my crypto from WEEX?

No. WEEX API keys support Read-only and trading permissions only — there is no withdrawal permission available to enable, so an API key cannot move assets off the platform or to another account.

2. What is the fastest way to shut down a compromised key?

Delete it in Account → API Management, then cancel any resting orders manually. Editing permissions is not a substitute, partly because WEEX documents roughly a 15-minute propagation delay for modified keys.

3. Does an IP allowlist really help if the key itself is stolen?

Yes, and it is the highest-leverage control available. Requests from any address outside the list are rejected with -1056 ILLEGAL_IP. WEEX allows up to 10 IPs per key.

4. How would I notice a leaked key before losses appear?

Watch for authentication and permission errors you did not generate — -1052, -1049, -1056 — and for fills in pairs your strategy never trades. Unexplained activity in thin altcoin books is the classic signature.

5. Are third-party trading bots safe to give API keys to?

They inherit the bot provider's security, not the exchange's. The 3Commas disclosure of roughly 100,000 customer API keys in December 2022 is the standing reminder. If you use one, give it a dedicated trade-only key, an IP allowlist matching the provider's documented egress IPs, and a calendar reminder to rotate it.

6. Does the 30-second timestamp rule affect normal bots?

Only if your server clock drifts. Requests are rejected when ACCESS_TIMESTAMP deviates more than 30 seconds from WEEX server time, so sync via NTP or query the server-time endpoint on startup.

Risk Warning

Crypto assets are volatile and API-driven trading can amplify both speed and size of loss, up to and including the total value of the assets in the account. Automated strategies carry specific risks: a compromised or over-scoped API key can be used to execute trades you did not authorise, and forced buying in illiquid pairs can destroy value without any withdrawal taking place. Leveraged futures positions opened through the API can be liquidated in full. Third-party bots and portfolio tools introduce counterparty risk, since a breach on their side exposes every key connected to it. Executed trades are generally final and there is no guarantee an exchange can identify or reverse unauthorised activity. Security settings described here reflect WEEX documentation as of August 2026 and may change with system upgrades — verify current parameters in the official API documentation before relying on them. Nothing here is investment advice.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.

You may also like

iconiconiconiconiconiconicon
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com