Not Your Keys, Not Your Coins. So Why Does Your Bot Have Both?

This audio is presented by Hacker Noon, where anyone can learn anything about any technology. Not your keys, not your coins. So why does your bot have both? By BTC Bot. EO, every guide to running a trading bot contains the same security paragraph. create an api key on your exchange tick enable trading do not tick enable withdrawals paste the key into the bot you are now safe you are not you are protected against one attack and while you were reading that paragraph it changed the subject It answers the smallest of the three custody questions and lets you stop there, which is most of the reason it appears in every guide. Here are the other two. Both are checkable in about 5 minutes, on any bot, including the one you are running right now. One of them is going to be uncomfortable. 1. The permission you decided was harmless. A trade-only API key is a real control and it is worth using. It also has a shape that is easy to misread. What it prevents? An attacker who steals the key cannot send your coins to an address they own. What it does not prevent? Losing the money by trading it. A key with trade permission can buy an illiquid asset with your entire balance, sell it into a book with no depth, and repeat. Nothing in that sequence is a withdrawal. Your balance leaves through the order book rather than through the door, and the exchange records every step as a legitimate instruction you authorized. The pattern is old enough to have been written up here in 2018, in how your trading API keys can be used to drain your funds. There is also a party you have added to your threat model without noticing. Whoever runs the bot now holds a working credential to your exchange account. It sits in their infrastructure, not yours. If their service is breached, your key is in the breach. Ask any bot vendor where keys are stored, whether they are encrypted at rest with a key the operators themselves cannot read, and whether an IP allow list is enforced on their side. The answers are usually available and occasionally alarming. Olena Usyakova walks through what that credential actually hands over in Not your keys, not your coins, are consequences of using API keys for trading. So, cannot withdraw, is not, cannot lose, and, my key, is not, only mine. That is question 1, and question 1 is the easy one. 2. You do not own a balance. You own a promise. This is the question the API key paragraph distracts from. While your bot is running, your coins sit in an account on a venue. What you see on the screen is a number in that venue's database. It is not possession, it is a claim. The venue owes you that amount, and you find out what the claim is worth on the day you try to collect. Most of the time collection works and the distinction feels academic. It stops being academic in exactly the situations you bought the bot to survive. Withdrawals get paused during volatility, which is when your profit exists and when you want it. An account gets frozen pending a review, and reviews take as long as they take. In an insolvency, the ledger entry becomes an unsecured claim in a proceeding, and your place in that queue is decided by law rather than by your trading. Notice that none