Secure crypto bot: why a trade-only key changes everything
The biggest fear when automating crypto is simple: what if the bot runs off with my money? Theta answers that by architecture, not by promise. The bot runs on a trade-only API key — it can read your balance and place buy and sell orders, but it cannot withdraw. Your funds never leave your exchange account.
This is the opposite of custody. You don't transfer crypto to us; we never touch a balance. The worst a leaked key could do is trade inside your own account — never move funds out.
Why trust it
The API key reads and trades, and cannot withdraw. And the refusal errs on the safe side: if the exchange answers in a way that does not let the permissions be confirmed, the connection does not complete at all. Your funds never leave your exchange account.
Not a philosophy, an engine lock: on its own it requires 0.35% above average cost, which covers the round trip of the fee plus room (the exact fee varies by exchange). If price drops, the bot holds and reopens later. The lock is on what the bot does by itself, not on you: telling it to sell now is still your call.
Simulate with a virtual balance, no time limit, before risking a single real cent. The simulator runs against real candles from the exchange itself, so it is what reproduces any number we publish.
On managed bots, the Pilot's Plan adjusts how many coins and how much per coin from the money available at the exchange — climbing a public ladder as the capital grows. If it cannot read the exchange balance, it does not plan the step: it would rather stop than guess a number.
What happened in 2022 (and why it matters)
In December 2022, 3Commas — one of the largest trading-automation platforms — confirmed a leak of roughly 100,000 user API keys (source: 3Commas' own statement, December 2022). Many of those keys had withdrawal permission. The result was predictable: anyone with withdrawals enabled was vulnerable to having funds drained.
The lesson isn't "never use bots." It's: never give a bot withdrawal permission. A trade-only key turns a catastrophic leak into a manageable scare — the attacker can't pull anything off the exchange.
How to create a secure API key, step by step
On your exchange (Binance, Bybit or Coinbase), when generating the API key:
- Enable only Read and Spot Trading. Leave Withdraw UNCHECKED.
- Turn on IP restriction (IP allowlist) and add only Theta's bot IP: 187.127.30.44.
- Never share the Secret Key — it's shown once. Keep it only where you'll paste it into Theta.
- If the exchange offers it, require 2-step confirmation to change key permissions.
Why the IP allowlist changes the game
Even if your key leaks, with an IP allowlist it only works from Theta's server. An attacker on another machine is simply refused by the exchange — the key is useless outside the authorized IP. It's a second lock, independent of the first.
And on Theta's side this doesn't depend on the exchange: the connection refuses any key that comes with withdrawal permission, and also refuses when it cannot confirm the permissions — when in doubt, it denies.
What we do with your key (and what we watch)
The key you connect is trade-only by obligation: a key with withdrawal permission is refused at signup. The one that gets in is encrypted in the database. And if you turn on the IP restriction at the exchange (step 2 above), a leaked key becomes a scrap of paper, because from another IP the exchange refuses it — without the restriction it still cannot withdraw, but it can trade. On top of that, an accounting audit runs every dawn and a watchdog checks the server every 5 minutes.
- A key with withdrawal: refused at signup. Only a trade-only key gets in.
- Encrypted in the database; with the IP restriction on at the exchange, useless outside our server.
- Accounting audit every dawn; watchdog checks the server every 5 min.
Custody vs. non-custody, in one sentence
Custody: you hand your funds to a third party and trust them to give them back. Non-custody (Theta): your funds stay in your exchange account the whole time; the bot only trades inside it. There's no withdraw button in Theta — so there's no custody. You keep control and revoke the key whenever you want, straight on the exchange.
Frequently asked questions
Why should I trust Theta?
Can Theta withdraw my money?
What if Theta's API key leaks?
Do I have to set the IP allowlist manually?
Which exchanges are supported?
No automatic charges. Cancel anytime.
30 days free, no card · then R$ 59/mo (from R$ 97) or R$ 490/yr (from R$ 790) · founder pricing locked until Dec 31, 2026. Outside Brazil: $12/mo (from $19) or $99/yr (from $149). Crypto (USDT): $12 = 1 month, $24 = 3 months, $79 = 1 year.
Keep exploring
Theta is automation software; it is not investment advice. Crypto involves risk; past results do not guarantee future results. You pay for the software — your funds stay on your exchange.