Skip to main content
Category: Hacks → Account Takeover (CEX, Email, SIM Swap)HacksAccount TakeoverAPI Key TheftReading time: 9 minutes
Risk level: High
Target audience: Developers, automated traders

​
Meet Amara

Amara is a developer who wrote a trading bot for automated cryptocurrency trades. She created a Binance API key to give her bot trading permissions. She hardcoded the API key in her bot’s code:
She published the code to GitHub (publicly) to show friends.

​
What Happened

​
Step 1: The Leaked API Key

GitHub has automated bots that scan public repositories for leaked secrets (API keys, passwords, etc.). Attackers also scan for leaked keys. The API key was discovered.

​
Step 2: The Unauthorized Access

An attacker used the API key to:
  • Access Amara’s Binance account programmatically.
  • Create a withdrawal request to a personal wallet.
  • Withdraw all holdings (₦2.1 million in BTC and USDT).
The withdrawal went through because the API key had “Withdrawal” permission enabled.

​
Where the Scammer Won

  • API keys hardcoded in public code: The key was visible in a public GitHub repository.
  • Overly permissive API key permissions: “Enable Withdrawal” was enabled when only trading was needed.
  • No IP whitelisting: The API key wasn’t restricted to specific IP addresses.

​
Red Flags Amara Missed

  • API keys hardcoded in public code.
  • Overly permissive API key permissions (“Enable Withdrawal” when only trading is needed).
  • No IP whitelisting on the API key.
  • No monitoring of API key usage.

​
How API Key Theft Works

What happens: API key is exposed in public code repository, commit history, or shared files.
What happens: Automated bots or attackers discover the exposed key.
What happens: Attacker uses API key to access exchange account programmatically.
What happens: Attacker uses API key permissions to withdraw funds to their wallet.

​
Prevention

Never commit API keys to code repositories. Use environment variables or .env files (add to .gitignore).
Use API keys with minimal permissions. If your bot only needs to trade, don’t enable Withdrawal.
Whitelist IP addresses for API keys (if the exchange supports it).
Rotate API keys regularly. Delete old keys and create new ones.
Monitor API key usage for suspicious activity.

​
If Your API Key Was Leaked

1

Revoke API Key Immediately

Go to exchange settings and delete/revoke the compromised API key immediately.
2

Check Account Activity

Review all recent transactions and withdrawals for unauthorized activity.
3

Create New API Key

Create a new API key with minimal permissions and IP whitelisting.
4

Remove Key from Code

Remove the key from any public code repositories and commit history.
5

Report Unauthorized Access

If funds were stolen, report to exchange support and law enforcement.

Email Account Takeover

How email compromise leads to account takeover

Hacks Category

Explore all types of account takeover attacks

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. API key security best practices
  2. GitHub secret scanning and prevention
  3. Exchange API key management guidelines