Only if its API key has withdrawal permission, so don’t give it that. A bot connects to your exchange with an API key, and the key can only do what you allowed when you created it. A key that can read balances and place trades can’t send your coins anywhere.
That doesn’t make a key harmless
A stolen key without withdrawal rights can still place bad trades on your account. In December 2022, data from 3Commas leaked and Binance’s CEO told users to disable their keys. Investigators later counted about 14.8 million dollars taken from 44 victims, through trades made with stolen keys.
So there are two risks to manage. Your coins leaving the account is one. Someone trading badly with your balance is the other.
How to set up a key
- Leave withdrawals off. A bot has no reason to need them. Binance won’t turn them on at all without an IP restriction.
- Restrict the key to the provider’s IP addresses. On Binance, a system-generated key with no IP restriction can only read, so a trading bot needs this anyway.
- Use one key per service, so you can cancel one without touching the rest.
- Keep only what you’re trading in that account.
- Delete the key when you stop. Once it’s deleted on the exchange, the service loses access.
Questions to ask any bot provider
- Does it need withdrawal permission? If yes, walk away.
- How are keys stored, and who can read them?
- What happens to my key if I close my account?
- Can I see every order it placed, and why?
The risk a key can’t remove
A correctly set up key does nothing about a bad strategy. A bot follows its rules, including when they lose, and a stop loss is an instruction that a fast market can fill worse. Test first, then practise on virtual money. Then start with an amount small enough that a mistake is annoying and not life-changing.
Here is what a Tradenos key can and can’t do.