Running a crypto trading bot creates a persistent, authenticated connection between software and your exchange account. Unlike manual trading where each session requires active login, a bot operates continuously — making any security weakness a persistent vulnerability. The risk is not just account access: a compromised bot API key can place unauthorized trades, manipulate open positions, and (if withdrawal permission is enabled) drain funds to an attacker's wallet. This comprehensive security checklist covers every layer of automated trading security: API key configuration, VPS hardening, local machine security, monitoring for unauthorized activity, and the periodic review process that maintains security posture over time. DennTech uses local execution — API keys never leave your infrastructure — but local execution security still requires proper configuration. See our dedicated API security guide and VPS guide.
API Key Security Checklist
- Withdrawal permission: DISABLED — this is the most critical item; a bot never needs withdrawal access; enabling it is the single highest-risk configuration choice
- IP restriction: ENABLED — restrict API key to your bot's specific IP address; unauthorized IPs get rejected even with the correct key
- Read-only permission where sufficient — use separate read-only keys for monitoring scripts, trading keys only for execution
- Exchange-appropriate permissions only — Futures key for futures strategies, Spot key for spot strategies; cross-permission enables unnecessary attack surface
- No hardcoded keys in public repos — never commit API keys to GitHub or any version-controlled public repository; use environment variables or encrypted config files
- Rotate keys quarterly — revoke and regenerate API keys every 3 months as a hygiene practice
VPS Security Checklist
- SSH key authentication only — disable password-based SSH login; require SSH public key authentication
- Non-default SSH port — change from port 22 to a non-standard port to reduce automated scan attempts
- Firewall enabled — allow only SSH, and any monitoring ports you explicitly use; deny all other inbound
- Root login disabled — create a non-root sudo user for bot operations; disable direct root SSH login
- Unattended security updates — enable automatic OS security patches
- Log monitoring — review /var/log/auth.log weekly for failed SSH attempts indicating brute-force probing
- No secrets in environment printout — ensure API keys stored in .env files have restricted file permissions (chmod 600)
Local Machine Security Checklist
- Full-disk encryption enabled — BitLocker (Windows) or FileVault (macOS) on the machine running your bot
- Antivirus/EDR active — malware targeting crypto traders often specifically searches for API key files
- Config file encryption — DennTech's configuration file containing API keys should use encrypted storage, not plain text
- Screen lock enforced — automatic screen lock after 5 minutes of inactivity
Exchange Account Security Checklist
- 2FA enabled — hardware key or authenticator app — SMS-based 2FA is the weakest option; use Google Authenticator, Authy, or a YubiKey hardware token
- Withdrawal whitelist enabled — most major exchanges allow whitelisting withdrawal addresses; if withdrawal is needed, whitelist only your verified wallet addresses
- Email account secured — your exchange account recovery path runs through your email; secure it with a strong unique password and 2FA
- Anti-phishing code set — exchanges like Binance and OKX allow setting a personal anti-phishing code that appears in all legitimate emails from that exchange
Monthly Security Review
- Review exchange API key last-used logs — verify only your expected IP addresses are shown
- Check bot trade history — confirm all trades match expected strategy signals
- Review exchange withdrawal history — confirm zero unauthorized withdrawals
- Verify firewall rules on VPS are unchanged
- Check for any exchange security notification emails
Full docs at DennTech docs. Compare editions at pricing page. All strategies at strategies page.
Frequently Asked Questions
- What is the most common security mistake made by crypto bot operators and how do I avoid it?
- The most common and highest-risk security mistake is enabling withdrawal permission on the bot's API key. Many traders enable all permissions when creating the API key for convenience — a single click enables trade, read, and withdrawal access simultaneously. A crypto trading bot requires only trade permission (to place orders) and read permission (to check balances and positions). Withdrawal permission allows an attacker who obtains your API key to transfer funds directly out of your exchange account to any address. Without withdrawal permission, the worst a compromised trading key can do is place unauthorized trades — damaging but not a total loss. Always create API keys with the minimum required permissions, explicitly verify withdrawal is unchecked, and never enable withdrawal for any bot API key. This is the single most impactful security decision for bot operators. See our complete API security guide. Start at the pricing page.
- Is running a crypto bot on a VPS more secure than running it on my home computer?
- VPS and home machine each have distinct security trade-offs. VPS advantages for bot security: always-on uptime without depending on personal machine availability, professional data center physical security, easier to implement hardened OS configuration (Linux with minimal attack surface), and IP restriction is more reliable (VPS IP rarely changes vs home ISP dynamic IP). Home machine disadvantages: personal machines are used for browsing, email, and general computing — all of which expand the attack surface (malware, phishing, browser-based attacks). The recommendation: for any bot managing meaningful capital, a dedicated VPS running only the bot is significantly more secure than a shared personal machine. DennTech's VPS setup guide at our VPS guide covers complete hardening steps. Explore the live demo.
- How do I know if my crypto bot API key has been compromised and what should I do immediately?
- Signs of API key compromise: unexpected trades in your exchange history that don't match your strategy's signals, account balance changes unexplained by bot P&L, exchange security alert emails, or failed login attempts reported from unrecognized IPs. If you suspect compromise: (1) immediately revoke the compromised API key from the exchange API management page — this instantly cuts attacker access; (2) check withdrawal history for any unauthorized transfers; (3) enable withdrawal whitelist if not already active; (4) review all open positions and close any you didn't intentionally open; (5) generate new API keys with IP restriction; (6) audit the source of the compromise (VPS log review, malware scan). The key safety mechanism: withdrawal disabled on the API key limits the financial damage even during a compromise to unauthorized trades only. See the full response protocol in our API security guide. Start at the pricing page.
Security guides: Checklist (this guide), API Security, VPS Guide. Start at the pricing page.