Handing a third party standing API access to your exchange account is the most consequential decision in this category, and 3Commas is the case study in why. In 2022, user API keys were leaked and used to execute unauthorised trades; the company initially disputed reports before confirming the breach and working with exchanges to revoke affected keys.
What the product does
Grid bots, DCA bots, smart trades with layered take-profit and stop conditions, portfolio tracking, backtesting and paper trading, across most major exchanges. The builder is genuinely capable and more approachable than writing your own execution code, which is the entire market for hosted bots.
Using it safely
If you use any hosted bot service, the rules are the same: create API keys with trading permission only and withdrawals explicitly disabled, restrict them by IP where the exchange supports it, rotate them periodically, and monitor for trades you did not initiate. These precautions limit the damage of a provider breach to unauthorised trading rather than theft.
Cost
A limited free tier with paid plans from roughly $22 a month, rising with bot counts and features. For most strategies the mid tiers are what is actually needed.
Who should use it
Traders who want automation without building it, who understand the standing-key risk and configure permissions defensively. Anyone unwilling to accept that risk should trade manually or run their own bot on their own infrastructure.