How Crypto Trading Bots Actually Work

By bitcointradingbots editorial desk · updated 2026-09-06 · facts checked 2026-09-06

table of contents

1. The core loop
2. Strategy types that actually exist
3. What is NOT automated
4. Realistic expectations
5. Choosing your first bot
6. Before you run anything

The core loop

Every bot, cloud or self-hosted, runs the same loop: read market data (price, candles, order book), evaluate your rules - "if RSI drops below 30, buy 5% of balance" - place orders through an exchange API, and manage open positions: take profit, stop loss, DCA fills. What differs between products is how you express the rules and who runs the server.

The open-source reference implementations make the loop concrete. Freqtrade describes itself as a free, open-source crypto trading bot in Python, with backtesting, plotting, machine-learning strategy optimization and control via Telegram or web UI [1]. Hummingbot positions itself as a community-owned framework for crypto market makers, with connectors to 318 CEX and DEX venues and components for running agentic trading strategies [2]. Strip away the UI differences and both run exactly the loop above.

Strategy types that actually exist

Despite the marketing zoo, five strategy families cover essentially the whole market:

1. Grid bots place laddered buy and sell orders across a price range and profit from oscillation - each completed round trip earns one grid step.
2. DCA bots average into positions over time or on dips, with optional safety orders that grow in size.
3. Signal bots execute external alerts - most commonly TradingView webhooks - translating someone else's chart into your orders.
4. Market-making bots quote both sides of the book for spread capture; Hummingbot's entire ecosystem exists for this family [2].
5. Arbitrage bots trade price gaps between venues, competing on latency and fees.

Everything else - "AI bots", "sniper bots", "neural strategies" - is a variation or a rebrand of these five. The strategy guides cover grid and DCA mechanics in depth with the actual math.

What is NOT automated

Choosing the strategy, the market regime it fits, position sizing, and when to turn it off. A grid bot in a strong downtrend accumulates a bag. A DCA bot on a dead coin averages into zero. The bot has no opinion; the operator's judgment is the strategy.

The operational risk is also yours. The 3Commas API-key incident of 2022 - roughly 100,000 leaked keys, drained accounts, a delayed vendor admission - is the canonical demonstration that connecting a third-party bot to your exchange account is a security decision, not just a convenience decision [3]. The full checklist lives in the API key security guide; the short version: trade-only keys, IP whitelisting, one key per service, low working balances.

Realistic expectations

The honest framing, from the tools' own documentation: Freqtrade's README leads with "this software is for educational purposes only. Do not risk money which you are afraid to lose" and tells users to always start in dry-run mode before engaging real funds [1]. Hummingbot publishes aggregated volume dashboards rather than profit promises [2]. When a commercial bot platform promises what open-source projects refuse to promise - fixed returns, sure-thing APY - the pattern matches the scam markers regulators describe.

What documented community results look like: grid strategies on well-chosen ranges have run roughly 10-40% annualized in ranging markets, with unrealized drawdowns of similar size; in trending markets, holding usually beats them. The bot vs. hold guide walks that comparison regime by regime.

Choosing your first bot

Live data from our database - the established names across the three hosting models:

Live values from our database - details, fees and incidents in each review.

The full comparison with fees, exchanges and incident history is in the bot table; the cost calculator turns any subscription against your expected capital. If you already know you want maximum control, the self-hosted vs. cloud guide maps that trade-off honestly - including the weeks of setup the open-source route realistically takes.

Before you run anything

1. Read the bot's own documentation, not its landing page - the README disclaimer tells you more than the marketing does [1].
2. Dry-run or paper mode first; Freqtrade recommends never engaging money before you understand what profit/loss to expect [1].
3. Trade-only, IP-whitelisted API keys from day one [3].
4. Start with capital whose total loss would be a lesson, not a problem.
5. Keep records from the first trade - bots multiply taxable events faster than manual trading ever could (see taxes and records).

FAQ

Can a trading bot make money while I sleep?

Bots automate execution, not alpha. Grid and market-making strategies harvest volatility, but returns vary with the market regime and can be negative. Compare Freqtrade's README - "do not risk money which you are afraid to lose" [1] - with any platform promising sure returns, and the honest side of that comparison is obvious.

Do I need to code to use a bot?

No. Cloud platforms and exchange-native bots are no-code. Self-hosted frameworks like Freqtrade require Python and are explicit about expecting coding knowledge [1]. Custom logic requires code on any platform.

What does a bot actually connect to?

Your exchange account through an API key. The bot can only do what the key permits - which is why trade-only, IP-whitelisted keys are non-negotiable (see the API key security guide).

Do bots run when my computer is off?

Cloud and exchange-native bots do - they run on the provider's servers. Self-hosted bots run on your machine or a VPS; if your server sleeps, so does your stop loss.

What is the difference between a bot and a copy trader?

A bot executes strategy rules against your own account. Copy trading mirrors another person's positions into your account, which is a different risk model - you inherit their mistakes at your own position sizes.

Sources

1. Freqtrade GitHub - free, open source crypto trading bot (disclaimer, dry-run, features) - accessed 2026-09-06
2. Hummingbot - open source framework for crypto market makers - accessed 2026-09-06
3. Reddit - 3Commas officially admits API leak (user threads documenting the 2022 incident) - accessed 2026-09-03

Keep reading