⚠️ CRITICAL: Never connect a bot that requires withdrawal permissions. This is the #1 way traders lose funds to compromised or malicious bots.
Why This Checklist Matters
Trading bots can automate your strategies, but they require access to your exchange accounts. If you don’t verify custody and permissions, you’re trusting a third party with your funds.
This checklist takes 5 minutes. It could save your entire portfolio.
Your 7-Step Pre-Connection Checklist
Step 1: Verify Architecture Layer
□ Identify which layer the bot uses:
- L1-Native (HyperCore API): Fastest execution (<100ms), no EVM smart contract access
- HyperEVM (Smart Contracts): Composable with DeFi, 2s block times, gas costs
- Dual-Layer (Hybrid): EVM detection + L1 execution [RARE - only 1 verified bot]
Why it matters: Wrong layer = wrong latency/composability for your strategy
⚠️ Red Flag: Bot claims to be “dual-layer” but only HyperEVM Sniper Bot is verified. Others may be misrepresenting.
Architecture differences:
- HyperCore (L1): Direct API access to Hyperliquid’s native layer. Fastest execution (~100ms), but limited to spot/perp trading
- HyperEVM: EVM-compatible smart contract layer. 2-second block times, full composability with DeFi protocols
- Dual-Layer: Combines both—detect opportunities on HyperEVM, execute on HyperCore for speed
Step 2: Check Custody Model
□ Confirm custody type:
- API-Only (Non-custodial): Keys on your device ✓ SAFEST
- Self-Hosted: You run the software ✓ SAFEST
- Vault-Based: Protocol holds funds temporarily ⚠️ MODERATE RISK
- Custodial: Platform controls your keys ❌ HIGH RISK
Why it matters: Non-custodial means you keep control. Custodial means trusting the bot operator completely.
🚫 DEALBREAKER: If bot requires you to deposit funds to THEIR wallet, do not proceed.
✅ Good signs:
- Bot generates keys on your device
- You control API key permissions
- Platform can’t withdraw funds
❌ Bad signs:
- “Deposit to our wallet to start”
- “We’ll manage your keys for you”
- No mention of custody model
Step 3: Confirm API Permissions (Critical)
□ When generating API keys, verify:
- ☑ Read account info
- ☑ Trade place/cancel orders
- ☐ Withdraw funds [MUST BE UNCHECKED]
Why it matters: Order permissions let bots trade. Withdrawal permissions let bots steal everything.
Action: In Hyperliquid API settings, explicitly UNCHECK withdrawal permissions before creating the key.
How to verify in Hyperliquid:
- Go to API settings in your Hyperliquid account
- Create new API key
- Check “Read” and “Trade” permissions
- Ensure “Withdraw” is NOT checked
- Copy key to bot (never share it elsewhere)
🚫 NEVER:
- Give withdrawal permissions to any bot
- Share API keys via email or chat
- Store API keys in unencrypted files
Step 4: Verify Audit Status
□ Check for security audits:
- ✅ Audited by reputable firm (CertiK, Zellic, OtterSec, Trail of Bits)
- ⚠️ Audit pending or by unknown firm
- ❌ No audit (most common)
Why it matters: Audits don’t guarantee safety, but unaudited code is higher risk.
Current Hyperliquid Bot Audit Status (February 2026):
| Bot | Audit | Auditor |
|---|---|---|
| goodcryptoX | ✅ Yes | CertiK |
| HyperEVM Sniper Bot | ❌ No | — |
| Katoshi AI | ❌ No | — |
| Hyperbot | ❌ No | — |
| Hummingbot | ✅ Open source | Community |
| Bloom Bot | ❌ No | — |
If unaudited (most bots):
- Start with smaller amounts ($50-100)
- Use dedicated wallet
- Monitor for incident reports
- Consider audited alternatives for large amounts
Step 5: Check Official Links
□ Verify ALL official links:
- Website URL matches documentation
- Telegram handle matches website
- Twitter/X is verified or has consistent history
- No slight misspellings (e.g., “goodcrypt0” vs “goodcrypto”)
Why it matters: Fake bots impersonate real ones. One wrong link = drained wallet.
Red flags:
- Domain has extra characters (e.g., goodcrypto-app.com)
- Telegram handle recently changed
- Twitter created last month
- Links don’t match across sources
✅ Verification process:
- Start from official documentation
- Cross-check social links on multiple platforms
- Look for consistent branding and history
- When in doubt, ask in official Discord
Step 6: Test with Minimal Funds
□ Start small:
- Test amount: $10-50 maximum
- Test period: 24-48 hours
- Test strategy: Simple trade or copy trading
- Verify: You can withdraw profits, bot behaves as expected
Why it matters: Even legitimate bots can have bugs. Test before trusting with significant funds.
Testing checklist:
- Deposit small amount
- Execute 1-2 trades
- Verify execution speed matches claims
- Withdraw a portion
- Check fees match documentation
- Monitor for unexpected behavior
Only scale up after successful test.
Step 7: Plan Your Exit
□ Know how to disconnect:
- How to revoke API keys
- How to withdraw remaining funds
- How to delete account/data
- Emergency contacts if issues arise
Why it matters: If something goes wrong, you need to act fast. Know the exit before you enter.
For Hyperliquid API bots:
- Go to Hyperliquid API settings
- Delete or disable the API key
- Bot immediately loses access
- Withdraw funds to cold storage
⏱️ Time to exit: Should be <2 minutes
Quick Reference: Bot Safety Levels
| Bot | Custody | Audit | Risk Level |
|---|---|---|---|
| goodcryptoX | Non-custodial | ✅ CertiK | LOW |
| Hummingbot | Self-hosted | ✅ Open source | LOW |
| HyperEVM Sniper Bot | Non-custodial | ❌ No | MEDIUM |
| Bloom Bot | Not disclosed | ❌ No | MEDIUM |
| Katoshi AI | Non-custodial | ❌ No | MEDIUM |
| Hyperbot | Non-custodial | ❌ No | MEDIUM |
General rule: Start with audited or open-source bots. Test unaudited bots with small amounts.
Common Scams to Avoid
The “Deposit to Trade” Scam
❌ Red flag: Bot requires you to send funds to their wallet
✅ Reality: Legitimate bots connect via API—you keep funds in your account
The “Guaranteed Profits” Scam
❌ Red flag: Promises specific returns (“10% daily!”)
✅ Reality: No legitimate bot guarantees profits
The “Withdrawal Permission” Scam
❌ Red flag: Bot says they “need” withdrawal access
✅ Reality: Trading bots only need read + trade permissions
The “Urgent Update” Scam
❌ Red flag: Telegram DM saying “urgent update required, click here”
✅ Reality: Legitimate updates come through official channels only
The “Clone App” Scam
❌ Red flag: App store app with similar name but different developer
✅ Reality: Verify developer name matches official website
If You’ve Already Connected a Bot
Don’t panic—audit your setup:
Check API permissions NOW
- Log into Hyperliquid
- Review API key permissions
- Revoke any keys with withdrawal access
Check recent activity
- Review trading history
- Look for unauthorized trades
- Verify balances
Secure your accounts
- Change passwords
- Enable 2FA everywhere
- Revoke suspicious API keys
If you see unauthorized activity
- Immediately revoke all API keys
- Withdraw remaining funds
- Contact Hyperliquid support
- Document everything
Next Steps
✅ Completed the checklist?
You’re ready to explore bots with confidence:
- Browse all HyperEVM bots →
- Compare Tier 1 options →
- Read goodcryptoX review (audited) →
- Read HyperEVM Sniper Bot review (dual-layer) →
⚠️ Couldn’t verify a step?
Don’t connect the bot. Find alternatives or wait until you can verify all 7 steps.
Remember
This checklist is non-negotiable. Every step matters. Skipping one is gambling with your funds.
5 minutes of verification > months of recovery.
Last Updated: February 8, 2026
Next Review: March 8, 2026
Disclaimer: This checklist reduces risk but cannot eliminate it. Trading cryptocurrencies carries substantial risk. Never invest more than you can afford to lose. Always perform your own due diligence.