Bots that need no API keys

What "no keys" removes - and what it leaves behind

Bot	Type	Keys	Price	Free tier	Trade fee	US	EU	Status
PI Pionex	Exchange-native	no keys	0.05% per trade	yes	0.05% per trade	US	EU	-
Binance Trading Bots	Exchange-native	no keys	free	yes	-	-	EU	-
BI Bitget Copy Trading	Copy trading	no keys	unknown	yes	-	-	EU	-
BY Bybit Copy Trading	Copy trading	no keys	unknown	yes	-	-	EU	-
OKX Trading Bots	Exchange-native	no keys	free	yes	-	-	EU	-
GA Gate.io Trading Bots	Exchange-native	no keys	free	yes	-	-	EU	-
KuCoin Trading Bots	Exchange-native	no keys	free	yes	-	-	EU	-
Bitget Trading Bots	Exchange-native	no keys	free	yes	-	-	EU	-
BY Bybit Trading Bots	Exchange-native	no keys	free	yes	-	-	EU	-
AX Axiom	DEX / Telegram sniper	wallet	0.7% per trade	yes	0.7% per trade	-	-	-
Banana Gun	DEX / Telegram sniper	wallet	1% per trade	yes	1% per trade	-	-	-
BullX	DEX / Telegram sniper	wallet	1% per trade	yes	1% per trade	-	-	-
PH Photon	DEX / Telegram sniper	wallet	0.9% per trade	yes	0.9% per trade	-	-	-
GM GMGN	DEX / Telegram sniper	wallet	1% per trade	yes	1% per trade	-	-	-
Maestro	DEX / Telegram sniper	wallet	1% per trade	yes	1% per trade	-	-	-
TR Trojan	DEX / Telegram sniper	wallet	0.9% per trade	yes	0.9% per trade	-	-	-
BO BONKbot	DEX / Telegram sniper	wallet	1% per trade	yes	1% per trade	-	-	-

Live values from our database - details and caveats in each review. "-" = not documented.

17 bots in this lane never require a third-party API key - 17 counting by custody model across the full tracked universe. The figure below maps where your keys and funds actually sit in each custody model, and the documented failure of each:

The 3Commas case defines why this lane exists. In late 2022, tens of thousands of trade-only API keys surfaced from a third-party breach; victims lost six figures to unauthorized trades; the vendor denied involvement for weeks, then admitted the leak and told users to delete keys immediately[1][2]. Every mitigation we recommend elsewhere - trade-only scopes, IP whitelisting (OKX recommends strong binding, 20 IPs max, 14-day expiry for unbound keys[3]) - reduces but cannot zero that risk. Exchange-native bots delete it by construction.

The residual risks are real and different:

• Exchange custody: your funds sit at the venue. Bybit's February 2025 hack (~$1.5B from a cold-wallet compromise) and Bitget's September 2026 incident (~$390M) are the modern benchmarks - both platforms covered losses and continued operating, but withdrawal pauses lasting days are part of the model. Our /incidents/ timeline tracks each.
• Wallet approvals: DEX bots trade through token approvals your wallet grants. A malicious or compromised router can drain anything you approved - the FTC and crime literature treat authorization scams as the dominant loss channel[5][8]. Revoke unused approvals.
• Deposit-custody scams: platforms that pitch "no API keys, just deposit here" invert the benefit - they hold your principal directly. The FCA's growbot.io warning (2025) fits the pattern[6].

Which lane for which case

Set-and-forget grid/DCA: Pionex (0.05% per side), Binance, OKX, Gate, KuCoin, Bybit, Bitget native bots. Strongest where the strategy is single-exchange and mechanical. US access: only Pionex runs a US entity - the others gate US residents.

Copy trading without key custody: Bybit and Bitget's native copy systems - leader trades mirror inside your account. Track records live on the exchange, survivorship bias included; the copy-trading lane has the verification checklist.

DEX sniping: Photon, Axiom, BullX, Trojan, Banana Gun, GMGN, BONkbot - wallet-connected, 0.7-1% per trade. No key vault exists, but approval hygiene, MEV and rug exposure define this category's risk. The sniper lane is the full ledger.

Maximum custody control: self-hosted Freqtrade keeps keys on your own machine - technically still API keys, but no third party ever holds them[4]. If your threat model includes vendors (it should include exchanges too), this is the ceiling of control.

The operational differences that surprise people

• Signal routing is the real feature gap. Exchange-native bots accept parameters you set in their UI; they do not consume arbitrary TradingView webhooks. If your edge is a Pine Script alert, you are choosing between this lane's custody benefits and a cloud platform's plumbing - some venues offer partial native signal integration, and it is worth checking before adding keys.
• Stop-loss depth varies by venue. Several exchange-native grid implementations lack per-bot stop lines; cloud tools expose them prominently. A no-key setup without a venue-side stop needs a manual monitoring rule instead - decide what that rule is before deployment.
• Account-level rate limits disappear. Native bots run on the exchange's own infrastructure - no personal API quota, no 429 loops, no key expiry maintenance[7]. For high-frequency grid configs this is a practical benefit independent of security.
• Withdrawal-pause exposure is symmetrical with key risk. An exchange incident freezes your bot and your balance together (Bitget paused withdrawals for days in September 2026); a vendor incident freezes or drains the key path. Neither lane removes counterparty exposure - they relocate it. Our /incidents/ timeline is the honest ledger for both.

Warnings

• No-keys does not mean no-custody-risk. It means the custody sits somewhere you can name - exchange, wallet or your own server. Choose the counterparty deliberately.
• Wallet bots: audit approvals like positions. Every open approval is an open door[8]. Set a calendar reminder; revoke what you no longer use.
• Deposit-requesting "bots" are the 2026-era scam default. The FTC's core patterns (fixed-return promises, urgency, unsolicited contact[5]) plus the FCA's live warnings[6] cover most of what arrives via social ads and Telegram.
• Key-based vendors are not automatically unsafe - IP-whitelisted trade-only keys with per-service isolation are a defensible middle ground[3]. This lane is the zero, not the only acceptable option.
• Incident data ages. Exchange-hack numbers here reflect our timeline's last verification; check /incidents/ for updates before making a custody decision.

The lane in numbers

• 17 bots pass the no-key filter on this page; across the whole tracked universe 17 need no third-party keys.
• 6% of them document US availability - custody benefits do not override jurisdiction.
• 6 security incidents are documented across this page's operators in our database - the honest reminder that "no keys" still leaves counterparties.
• 0.05% is the lowest per-trade fee in this lane - the fee-light native exchanges anchor it.
• The API key security guide remains the companion read: if you ever do hand out a key, its trade-only/IP-whitelist playbook is the difference between a leak and an anecdote[3].

The threat model, stated plainly

Custody decisions are threat-model decisions, not product decisions. If your primary threat is a vendor breach (the documented 3Commas case[1][2]), this lane solves it. If your primary threat is exchange insolvency or compromise, no lane solves it - not even self-hosted, since the venue still holds the funds; diversification across venues and withdrawal hygiene matter more than bot choice. If your primary threat is yourself - fat-fing approvals, signing drainer transactions - wallet-connected bots concentrate that risk[8], and hardware-wallet signing plus revocation routines are the mitigation.

Regulatory exposure is the last dimension. "No keys" does not mean "no KYC" - exchange-native bots inherit the venue's KYC regime, and the FCA warning list shows that bot-branded unauthorised firms target exactly the users who liked the no-paperwork pitch[6]. Choose the regulated counterparty in your jurisdiction; that choice does more for fund survival than any bot feature.

Finally, keep the custody map current. This lane's population shifts as venues add native bots: the 2025-26 period added copy systems and futures-grid variants to several exchanges. When a new "no-key" offer appears, the three questions that matter: which entity holds funds, which entity can move them, and what does our incident timeline say about both[1][2]. Everything else is interface.

The same diligence applies to wallet bots' fee structures - 0.7-1% per trade plus priority fees and slippage can exceed any subscription on active weeks. Compute your own round-trip cost with the position size calculator before assuming a no-key setup is the cheaper setup; custody benefits and cost benefits are separate axes, and the sniper lane's fee table makes that explicit per bot.