Why Trade-Only API Keys Aren't Safe Enough for Autonomous AI Agents
Disabling withdrawals stops theft, not bad trades. What trade-only keys, exchange risk settings and signing-level limits each protect against, compared.
5 min readAsk how to give a trading bot or AI agent exchange access safely, and you'll get the same answer everywhere: create a trade-only API key with withdrawals disabled. It's good advice. It's also where most people stop, and for an AI agent, it isn't enough.
A trade-only key answers one question: can this key move money off the exchange? An AI agent raises a different one: what will it do with the money that's there?
What "trade-only" actually means
On most exchanges, an API key has separate permissions: read data, trade, and withdraw. A trade-only key has the first two and not the third. On Hyperliquid, the equivalent is an API wallet, which can trade but can't withdraw (Hyperliquid).
That closes the most obvious attack. Someone who steals the key can't send your funds to their own address. For a traditional bot running fixed code you wrote and tested, that may be most of the risk.
Why AI agents are different
A fixed bot does what its code says. An AI agent decides what to do based on instructions and information, and it can be wrong in ways code isn't:
- It can misunderstand an instruction or a number.
- It can act on manipulated input, such as a post, a web page or a token description that contains hidden instructions (prompt injection).
- It can run continuously, making many decisions while you're not watching.
Each of those produces trades. And trades are exactly what a trade-only key allows.
What a trade-only key still lets an agent do
With trading permission alone, an agent can:
| Risk | How it costs you |
|---|---|
| Oversize a position | One order puts far more of the account at risk than intended |
| Max out leverage | A small price move triggers liquidation |
| Trade the wrong market | Exposure to an asset you never chose, often thin and volatile |
| Buy an illiquid asset at an inflated price | Your funds move to whoever sold it, with no withdrawal needed |
| Close a hedge | The rest of the portfolio is suddenly unprotected |
| Churn | Fees and slippage on every round trip quietly drain the account |
The illiquid-asset route has been used deliberately, and at scale. In late 2022, attackers got hold of API keys that users of the trading-bot platform 3Commas had connected to their exchange accounts. They posted sell orders for illiquid tokens at inflated prices, then used the stolen keys to trade victims' liquid holdings into those tokens. One account worth 50 BTC was left with about 7 BTC. Blockchain security firm HAPI verified around $27 million in losses, most of it on Binance (ForkLog, Decrypt). The same trick was used on Binance in 2018, when phished trading keys pushed Viacoin up roughly 10,000% in minutes. Binance blocked the withdrawals but said it was "not in a position to reverse those trades" (Trend Micro). In neither case did the attackers need withdrawal access.
An agent that can be prompt-injected gives an attacker a way to attempt the same thing without stealing anything. They only need the agent to read the right text.
Comparing the protections
There are three layers you can use. They protect against different things:
| Trade-only key | Exchange risk settings | Limits enforced at signing | |
|---|---|---|---|
| Stops withdrawals to outside addresses | ✅ | – | ✅ (if destinations are restricted) |
| Stops a leaked key working elsewhere | ✅ with IP allowlist | – | ✅ (the agent holds no key) |
| Caps size per trade | ❌ | Sometimes | ✅ |
| Caps leverage | ❌ | ✅ (venue maximum) | ✅ (your maximum, checked against the whole account) |
| Restricts markets | ❌ | Rarely | ✅ |
| Protects against bad prices | ❌ | ❌ | ✅ (price band) |
| Keeps a reserve the agent can't trade | ❌ | ❌ | ✅ |
| Holds up against prompt injection | ❌ | Partly | ✅ |
The first two are free and you should use both. But only the third controls what the agent does with the money.
What limits at signing look like
The idea is simple: every order has to be signed before an exchange will accept it. If the signature is only produced when an order passes your limits, then no order that breaks them can reach the exchange, whatever the agent was told or tricked into doing.
Pakt works this way. You approve a set of limits (markets, size, leverage, concentration, price band, reserves) with a signer you hold. Your agent proposes orders; Pakt checks each against your limits and your account's projected state, inside secure hardware, and signs only what passes. Refused orders get no signature and are final. Pakt never holds your funds or keys, and your venue executes as normal. It's live for Hyperliquid perpetuals, in beta.
The practical setup
Use all three layers:
- A trade-only key or API wallet, so nothing can be withdrawn.
- The venue's own risk settings, as a backstop.
- Limits enforced at signing, so the agent can only make trades you'd approve of.
FAQ
Is a trade-only API key safe for a trading bot?
For a fixed, tested bot it removes the biggest risk, theft by withdrawal. For an AI agent, it's necessary but not sufficient, because bad trades can lose money without any withdrawal.
Can someone steal funds with a trade-only API key?
Not directly, but they can extract value through trades, for example by making your account buy an asset they're selling at an inflated price.
Are exchange risk limits enough?
They help, but they're set per venue, usually coarse, and rarely cover markets, price bands or reserves. They can't reflect your strategy's specific limits.
What's the difference between a limit in the prompt and a limit at signing?
A prompt asks the agent to behave. A signing limit makes it impossible for an order outside the rules to be signed, whatever the agent does.