A correctly configured AI trading bot is safe — it cannot withdraw your funds, only trade them. The risk isn't the bot itself but how you set up the connection. Generate API keys with withdraw disabled, lock them to the bot's IP address, and use a non-custodial vendor. Do those three things and the worst-case outcome is bad trades, never a stolen balance.
What you're actually defending against
Before talking solutions, let's name the threats. There are three:
- The bot itself — bug, malicious code, or rogue employee.
- The bot company being hacked — attacker steals API keys.
- You — phishing, weak password, or careless config.
The good news: with proper API key setup, threats #1 and #2 can only cause trade losses, not balance theft. Threat #3 is the one most users actually need to worry about.
API keys 101 — what you're really granting
An exchange API key is like a hotel keycard with a list of rooms it can enter. When you create one, you tick boxes for what it's allowed to do. The standard options:
| Permission | What it does | Should bot have? |
|---|---|---|
| Read | See balances, prices, history | ✅ Yes |
| Spot Trading | Buy/sell on the spot market | ✅ Yes |
| Margin / Futures | Leveraged positions | Only if you use leverage |
| Withdraw | Move funds OUT of the exchange | ❌ NEVER |
The single line between safe and not safe is the Withdraw toggle. With it off, no one — not the bot company, not a hacker who stole the key, not a rogue employee — can move money out of your account. They can only execute trades.
Custodial vs. non-custodial — the bigger question
Some bots are custodial — they hold your funds on their platform. Examples: Pionex, certain copy-trading services. The pitch is simplicity, but the risk profile is fundamentally different. If the platform is hacked, drained, or goes bankrupt, your funds are at risk along with theirs.
Non-custodial bots — including Prometheus AI — never see your funds. The capital lives on your exchange account; the bot only places trades through API permissions you control and can revoke instantly.
"Not your keys, not your coins" applies to bots too. Non-custodial isn't paranoid — it's the baseline standard for retail trading software in 2026.
The 60-second lockdown
Run this once on day one. Saves you 10x as much grief later.
- Enable 2FA on your exchange account (use an authenticator app, not SMS).
- Generate a fresh API key just for the bot — don't reuse old ones.
- Disable Withdraw on that key.
- Whitelist IPs — restrict the key to the bot's IP address (your VPS IP, or the one your bot vendor publishes).
- Set a withdrawal whitelist on your exchange itself, separately, to a wallet address you control. Now even if your password is compromised, attackers can't withdraw to their own address.
What does "2048-bit encryption" actually mean?
You'll see this number on bot security pages. In plain English: it refers to the cryptographic key length protecting data in transit between your device and the bot's servers. Modern banks use the same standard. The relevant detail isn't the bit-length — it's that the connection is end-to-end encrypted and the bot vendor doesn't store your API secret in plaintext.
Red flags to walk away from
If you see any of these on a bot's website or onboarding flow, don't sign up:
- Asks you to deposit funds into the bot's wallet (not your own exchange).
- Requires withdraw permissions on the API key.
- Promises specific guaranteed returns ("X% per day").
- Has no public refund policy.
- Founder anonymity with no LinkedIn presence or company registration.
- Pushes you toward sending crypto to "get the bot started".
How Prometheus AI's security model works
The setup matches the standard above, no shortcuts:
- Non-custodial. Funds stay in your exchange account.
- API key with Withdraw disabled. The bot literally cannot move your money out.
- 2048-bit encryption on all data in transit.
- No KYC required on our end — we never see your identity or balance.
- Revocable instantly. Disable the API key on your exchange any time and the bot stops trading immediately.
See the full security breakdown on the home page.