An exchange API key lets software act on an account without using the normal web interface for every request. Traders use keys for portfolio tools, tax software and automated strategies. The convenience creates a separate credential that can be abused even when the account password and two-factor code remain secret.
What a stolen key can do
Permissions differ by platform. A read-only key may expose balances and transaction history. A trading key can place or cancel orders. A withdrawal-enabled key may send assets to an external address. The last category carries obvious danger, but trading-only access can also cause losses by buying illiquid assets, churning fees, disrupting hedges or manipulating the victim’s positions in coordination with another account.
Restrictions are enforced by the exchange, not by the label in a bot’s dashboard. Verify permissions in the exchange account after creating the key.
How keys leak
- Committed to a public code repository or included in a shared archive;
- stored in plain text in a script, spreadsheet or cloud note;
- sent to a fake portfolio application or trading-bot website;
- read by malware from environment files or browser storage;
- printed in application logs, screenshots or support tickets;
- exposed through a vulnerable server or dependency.
Build a key that cannot do more than necessary
Create a separate key for each application. Disable withdrawals unless the automation has an explicit, reviewed reason to move assets. Use the smallest trading scope available, restrict the key to known IP addresses and set exchange-side withdrawal allowlists independently. A portfolio tracker normally needs read access only.
OWASP’s REST security guidance advises against relying on API keys alone for sensitive or high-value resources. Server applications should keep secrets in a dedicated secret store, exclude them from logs and repositories, and rotate them on a documented schedule.
Monitoring must happen at the account boundary
Enable alerts for key creation, permission changes, new IP addresses, withdrawals and unusual orders. Compare intended strategy behaviour with exchange execution records; a compromised application can falsify its own dashboard. Review active keys periodically and delete those no longer in use.
For automated execution, the controls in our algorithmic crypto trading guide provide the wider operational context. Set maximum order size, position limits, price-deviation checks and a kill switch outside the strategy logic. An algorithmic error and credential theft can produce similar orders, so the control should respond to behaviour rather than waiting to identify motive.
Response to suspected compromise
- Revoke the key from a trusted device; do not merely edit the local file.
- Cancel unauthorised orders and review open positions, withdrawals and account sessions.
- Contact the exchange through its verified support channel.
- Rotate related credentials and determine where the key was exposed.
- Preserve logs, IP records, order IDs and transaction hashes.
- Rebuild the affected host if its integrity cannot be established.
Never paste a secret key into a “scanner” that promises to check whether it has leaked. API keys should be treated like narrowly scoped financial credentials: unique, revocable, monitored and unable to withdraw by default.
