How Crypto Trading Bots Actually Work

By bitcointradingbots editorial desk · updated 2026-10-18 · facts checked 2026-10-18

table of contents

1. The core loop
2. The API layer underneath
3. Where the bot runs - and where your keys live
4. Strategy types that actually exist
5. What is NOT automated
6. Realistic expectations
7. Choosing your first bot
8. Before you run anything

The core loop

Every bot, cloud or self-hosted, runs the same loop: read market data (price, candles, order book), evaluate your rules - "if RSI drops below 30, buy 5% of balance" - place orders through an exchange API, and manage open positions: take profit, stop loss, safety-order fills. What differs between products is how you express the rules and who runs the server.

The open-source reference implementations make the loop concrete. Freqtrade describes itself as a free, open-source crypto trading bot in Python, with backtesting, strategy optimization and control via Telegram or web UI [1]. Hummingbot documents the same architecture for market makers: a strategy loads real-time order book snapshots, balances and order status each tick, then executes the logic you configured [2]. Strip away the UI differences and both run exactly the loop above.

The API layer underneath

Between the bot and your money sits the exchange API. Bots authenticate with an API key, query market data, and place, amend and cancel orders - often through a library like CCXT, a 44k-star open-source project that unifies the APIs of more than 100 exchanges behind one interface [3]. That layer is why "supports 16 exchanges" is a weaker claim than it sounds: if the exchange has a public API, supporting it is mostly configuration.

Two properties of that layer matter for users. First, exchanges hard-cap API usage: Binance documents separate request-weight and order rate limits and answers violations with HTTP 429 [5] - legitimate bots pace themselves, and a bot that hammers the API risks your key. Second, the API key's permissions define the bot's blast radius. The 2022 3Commas incident - roughly 100,000 leaked keys, accounts drained through wash trades on illiquid pairs, and a vendor admission that came months later and read "DELETE YOUR KEYS NOW" [4] - is the canonical demonstration that connecting a third-party bot is a security decision. The full checklist lives in the API key security guide.

Where the bot runs - and where your keys live

1. Exchange-native bots (Pionex, Binance, Bybit, OKX) run inside the exchange on your account. No API keys change hands because there is no third party; the trade-off is a smaller feature set.
2. Cloud platforms (3Commas, Bitsgap, Cryptohopper) run the bot on the vendor's servers and connect to your exchange through API keys you create and hand over. Maximum convenience, custody of your keys as the price, plus a subscription.
3. Self-hosted bots (Freqtrade, Hummingbot, Gunbot) run on your own machine or VPS. Keys never leave your infrastructure and the code is auditable; the price is setup work and operational responsibility - your bot is down when your box is down.

The self-hosted vs. cloud guide works through this trade-off with costs; the three models map directly onto our bot table, where every review states the custody model up front.

Strategy types that actually exist

Despite the marketing zoo, five strategy families cover essentially the whole market:

1. Grid bots place laddered buy and sell orders across a price range and profit from oscillation - each completed round trip earns one grid step.
2. DCA bots average into positions over time or on dips, with optional safety orders that grow in size.
3. Signal bots execute external alerts - most commonly TradingView webhooks - translating someone else's chart into your orders.
4. Market-making bots quote both sides of the book for spread capture; Hummingbot's ecosystem of 318 connectors exists largely for this family [2].
5. Arbitrage bots trade price gaps between venues, competing on latency and fees.

Everything else - "AI bots", "sniper bots", "neural strategies" - is a variation, a rebrand, or a combination of these five. The strategy guides cover grid and DCA mechanics in depth with the actual math.

What is NOT automated

Choosing the strategy, the market regime it fits, position sizing, and when to turn it off. A grid bot in a strong downtrend accumulates a bag. A DCA bot on a dead coin averages into zero. The bot has no opinion; the operator's judgment is the strategy - and the loop diagram above draws that judgment deliberately outside the automation boundary.

Realistic expectations

The honest framing comes from the tools' own documentation. Freqtrade's README leads with "this software is for educational purposes only. Do not risk money which you are afraid to lose", tells users to always start in dry-run mode before engaging real funds, and states plainly that coding knowledge is expected [1]. Hummingbot publishes aggregated volume dashboards rather than profit promises [2]. When a commercial platform promises what open-source projects refuse to promise - fixed returns, sure-thing APY - the FTC's benchmark applies: only scammers guarantee profits [8]. The full pattern list is in the scam patterns guide.

What documented results actually look like: our own five-regime replay shows a model grid beating holding in chop and losing to it in trends, with a documented community test in between - the bot vs. hold guide walks that comparison regime by regime.

Choosing your first bot

Live data from our database - established names across the three hosting models:

Live values from our database - details, fees and incidents in each review.

The full comparison with fees, exchanges and incident history is in the bot table; the cost calculator turns any subscription against your expected capital.

Before you run anything

1. Read the bot's own documentation, not its landing page - the README disclaimer tells you more than the marketing does [1].
2. Dry-run or paper mode first; Freqtrade documents dry-run wallet configuration and recommends never engaging money before you understand what profit/loss to expect [1][6].
3. Trade-only, IP-whitelisted API keys from day one - and check what the vendor's incident history says before you hand them over [4].
4. Start with capital whose total loss would be a lesson, not a problem.
5. Keep records from the first trade - bots multiply taxable events faster than manual trading ever could (see taxes and records).

FAQ

Can a trading bot make money while I sleep?

Bots automate execution, not alpha. Grid and market-making strategies harvest volatility, but returns vary with the market regime and can be negative. Compare Freqtrade''s README - "do not risk money which you are afraid to lose" [1] - with any platform promising sure returns, and the honest side of that comparison is obvious.

Do I need to code to use a bot?

No. Cloud platforms and exchange-native bots are no-code. Self-hosted frameworks like Freqtrade require Python and are explicit about expecting coding knowledge [1]. Custom logic requires code on any platform.

What does a bot actually connect to?

Your exchange account through an API key. Bots speak the exchange's REST/WebSocket API - often through a library like CCXT, which unifies 100+ exchange APIs [3]. The bot can only do what the key permits, which is why trade-only, IP-whitelisted keys are non-negotiable.

Do bots run when my computer is off?

Cloud and exchange-native bots do - they run on the provider's servers. Self-hosted bots run on your machine or a VPS; if your server sleeps, so does your stop loss.

What is the difference between a bot and a copy trader?

A bot executes strategy rules against your own account. Copy trading mirrors another person's positions into your account - a different risk model where you inherit their mistakes at your position sizes.

What are API rate limits?

Exchanges cap how many requests a client may send - Binance, for example, documents request-weight and order rate limits and answers violations with HTTP 429 [5]. Legitimate bots rate-limit themselves; a bot that "needs" to bypass limits is a liability to your account.

Sources

1. Freqtrade GitHub repository, verified live 2026-10-18 - 55.6k stars, GPL-3.0, disclaimer, dry-run guidance, Python knowledge recommendation - accessed 2026-10-18
2. Hummingbot homepage, verified live 2026-10-18 - $47B+ reported volume, 111k+ instances, 318 connectors, strategy loop documentation - accessed 2026-10-18
3. CCXT GitHub repository, verified live 2026-10-18 - 44.4k stars, unified trading API for 100+ exchanges - accessed 2026-10-18
4. Reddit r/3Commas_io - 3Commas officially admits API leak, "DELETE YOUR KEYS NOW" (2023 admission of the 2022 incident) - accessed 2026-10-18
5. Binance Spot API documentation (GitHub) - rate limit types, HTTP 429 handling, order endpoints - accessed 2026-10-18
6. Freqtrade documentation - configuration including dry-run wallet setup - accessed 2026-10-18
7. Wikipedia - Algorithmic trading (definition, 2019 study on ~92% of forex volume executed algorithmically) - accessed 2026-10-18
8. FTC - What To Know About Cryptocurrency Scams ("Only scammers guarantee profits") - accessed 2026-10-18

Keep reading