Self-Hosted vs. Cloud Trading Bots - The Real Trade-offs
Short answer: Self-hosting keeps your API keys on a machine you control and removes the vendor-breach scenario entirely - at the price of a VPS, real setup effort and weeks of learning. Cloud platforms sell convenience; the 2022 key leaks made that convenience a security decision.
The choice is control against convenience. After the 2022 API-key leaks, it is also a security decision - see the API key security guide for why the vendor-breach scenario is the axis this whole comparison turns on [7]. Here is the full trade-off set, with the costs computed instead of vibes.
table of contents
What self-hosting buys you
Your API keys never leave a machine you control. That single fact removes the entire 2022 scenario class - no vendor database can leak what a vendor never had.
The open-source tier is also genuinely free and mature. Freqtrade is a free, open-source Python bot with backtesting, plotting, machine-learning-based strategy optimization, control via Telegram or web UI - 55.6k stars, GPL-3.0 licensed, actively developed [1]. Hummingbot is a community-owned framework for market makers, Apache-2.0 licensed with 20.6k stars [2]. Both are years deep in production use, with public issue trackers and code you can audit - which is more due diligence than any closed platform offers.
And there is no subscription: today's VPS pricing starts at $4.54/month for 2 vCores and 4GB RAM [5], comfortably above Freqtrade's stated minimum of 2GB RAM, 1GB disk, 2 vCPUs [1].
What self-hosting costs you
The honest list:
- Setup effort - Python, TA-Lib or Docker, configuration. Freqtrade's README is blunt that it strongly recommends coding and Python knowledge and invites you to read the source [1].
- The strategy work itself - public strategies mostly fail live, backtests overfit easily, and the project's own guidance is to dry-run for weeks before engaging money [1]. Hummingbot's learning path assumes the same patience [2].
- Ops ownership - updates, backups, monitoring. If your server sleeps, so does your stop loss. Nobody pages you when it is your box.
- Time to competence - weeks, not days, if you are not already a developer.
The trade is asymmetric in a way the cloud marketing never mentions: self-hosting converts a security risk into a competence requirement. One concrete detail makes the custody difference tangible - a Freqtrade install keeps its exchange credentials in a local config.json on your own machine, with dry-run wallets documented for testing before any live key is used [6]:
What cloud platforms buy you
Polished UIs, template marketplaces, one-click OAuth connections, mobile apps, support desks and zero ops. For non-developers this is the difference between running a bot and reading about one. The verified pricing: 3Commas at $15-105/month across its tiers [3], Cryptohopper from $9.99 to $99.99/month [4].
What they cannot sell you is the 2022 lesson back: vendor-held keys are a breach scenario you accept on someone else's security budget [7]. The key security checklist mitigates it - IP whitelists, one key per service, low balances - but mitigation is not elimination.
The 36-month cost picture
Costs are the one dimension you can compute before choosing. Using verified prices - OVH VPS-1 at $4.54/month [5], 3Commas tiers at $15-105/month [3] - here is what each model accumulates over three years on identical trading fees [8]:
| Hosting model | Monthly | 36-month total |
|---|---|---|
| Exchange-native bots | $0 software | $0 |
| Freqtrade + VPS (mid-tier) | $10 | $360 |
| Cloud entry tier | $15 | $540 |
| Paid framework + VPS | $39 | $1,404 |
| Cloud pro tier | $105 | $3,780 |
Two honest caveats to that table. First, we deliberately do not monetize your setup time - price it at zero if you want to learn, or at your freelance rate if you do not; both readings are legitimate and the decision flips around the middle. Second, the $0 line is not the whole story for exchange-native bots: they are free because the exchange monetizes your trading fees [8] - fine if the fee rate is competitive, which is a per-exchange question, not a hosting question.
The hybrid worth considering first: exchange-native bots (Pionex, Binance, Bybit, OKX, KuCoin, Bitget, Gate) give you cloud convenience with zero third-party key exposure - the bot runs inside the exchange, keys never leave, and grid/DCA use cases are covered without a subscription. For most non-developers this is the highest value-per-dollar entry point in the entire market.
Live platforms across all three models, from our database:
| Bot | Category | Custody | Score |
|---|---|---|---|
| Freqtrade | Self-hosted | Self-hosted | 8.1/10 |
| Hummingbot | Self-hosted | Self-hosted | 8.1/10 |
| 3Commas | Cloud platform | Your keys (API) | 7.1/10 |
| Pionex | Exchange-native | Exchange-held | 7.4/10 |
Live values from our database - details, fees and incidents in each review.
Deciding, honestly
- If you cannot read code and do not want to learn: exchange-native first, cloud platform second - and apply the full key checklist in the second case.
- If you can read code or want to: Freqtrade or Hummingbot on a VPS [1][2], dry-run for weeks before a single live order [1].
- Whatever you choose: the strategy question - what the bot should do - comes before the hosting question. The strategy families and the bot vs. hold comparison answer that one.
The checklist view, side by side
| Question | Self-hosted | Cloud platform | Exchange-native |
|---|---|---|---|
| Keys leave your control? | Never | Yes - vendor breach scenario [7] | Never |
| Monthly cost | VPS $4.54-20 [5] | Subscription $9.99-140 [3][4] | Trading fees only [8] |
| 36-month cost (mid) | $360 | $540-3,780 | $0 |
| Setup time | Weeks [1] | Minutes | Minutes |
| Strategy freedom | Unlimited (your code) [1] | Template marketplace | Grid/DCA presets |
| Ops ownership | Yours | Vendor's | Exchange's |
| Audit-ability | Full GPL/Apache source [1][2] | None | None |
The table is the honest version of every "which is best" thread: it depends on which cells you can afford - in money, in time, and in risk tolerance. The one cell nobody else can fill for you is ops ownership: a self-hosted bot is only as reliable as the operator's monitoring habit, and that habit is the real subscription price of the free software.
Model assumptions, for reproducibility: costs are software subscription plus VPS rental only, verified prices as of 2026-10-18 (OVH VPS-1 $4.54/month [5]; 3Commas $15/$105 tiers [3]; Gunbot-style paid framework $29/month from our database). Trading fees excluded - they apply identically across models [8]. Setup time not monetized. Scripts and result files: research/data/ in the site repository.
FAQ
Is Freqtrade free?
Yes - fully open source under GPL-3.0. Your only cost is the server it runs on and your time. The project recommends Python knowledge and reading the source code, and its own README tells you to start in dry-run before engaging money [1].
How much does a cloud bot cost per year?
Verified tiers run $15-105/month at 3Commas [3] and $9.99-99.99/month on Cryptohopper [4]. Over 36 months our cost model totals $540 for an entry tier versus $3,780 for a pro tier - against $360 for Freqtrade on a VPS [5].
What hardware does a self-hosted bot need?
Less than you fear: Freqtrade's own minimum guidance is a cloud instance with 2GB RAM, 1GB disk and 2 vCPUs [1] - and a $4.54/month VPS today ships 2 vCores and 4GB RAM [5], which clears the bar with room to spare.
Is exchange-native the same as self-hosted?
No, but it shares the key property: your API keys never reach a third party. Native bots run inside the exchange itself - cloud convenience without the vendor-breach scenario.
Can I switch from cloud to self-hosted later?
Yes, but strategies rarely port 1:1 - grid and DCA configurations become different code paths in different frameworks. Plan a parallel dry-run period rather than a hard migration with live funds.
What is the biggest self-hosting mistake?
Treating uptime as optional. If your server sleeps, so does your stop loss - and a strategy that backtests beautifully is worthless when the process dies at 3am silently. Monitoring is part of the cost.
Sources
- Freqtrade GitHub repository + README, verified live 2026-10-18 - 55.6k stars, GPL-3.0, minimum hardware 2GB RAM / 1GB disk / 2 vCPU, dry-run guidance - accessed 2026-10-18
- Hummingbot GitHub repository, verified live 2026-10-18 - 20.6k stars, Apache-2.0 license - accessed 2026-10-18
- 3Commas pricing page, verified live via headful browser - Starter $15/mo annual, Pro $38/mo, Expert $105/mo (screenshot in our DCA guide) - accessed 2026-10-18
- Cryptohopper pricing page, verified live 2026-10-18 - Copy Bot traders $9.99-$99.99/month - accessed 2026-10-18
- OVH VPS pricing, verified live 2026-10-18 - VPS-1 from $4.54/month (2 vCores, 4GB RAM, 40GB NVMe, daily backup included) - accessed 2026-10-18
- Freqtrade documentation - configuration via local config.json (self-hosted keys never leave your machine) - accessed 2026-10-18
- Reddit r/3Commas_io - 3Commas officially admits API leak, "DELETE YOUR KEYS NOW" (the vendor-breach scenario this comparison turns on) - accessed 2026-10-18
- Binance fee schedule, verified live via headful browser - trading fees apply identically in every hosting model (screenshot in our grid guide) - accessed 2026-10-18