Is Bitsgap safe to connect?
Web trading terminal · Binance, Bitget, Bitfinex, Coinbase (Advanced), Crypto.com, Gate.io, Gemini, HTX, Hyperliquid, Kraken, KuCoin, OKX, Poloniex, WhiteBIT, Aster, EVEDEX. Checked 2026-10-26; every line links its source.
Worst case: Bitsgap holds API keys that can trade on your exchange account. It refuses keys with withdrawal rights, so a leak or phishing attack cannot withdraw your coins directly, but an attacker with the key can place trades that drain value from your balance. Bitsgap's terms cap its liability at the lower of AED 5,000 or three months of fees.
Safe setup in 3 steps
- Open Bitsgap only at bitsgap.com or its official apps (App Store id1407713776, Google Play com.bitsgap.pwa), and turn on 2FA or a FIDO2 security key for Bitsgap and your email, as Bitsgap's security page advises. Get support only via support@bitsgap.com or the in-platform chat, since Bitsgap says its socials are not support channels.
- Create the exchange API key with read and trading permission only and withdrawals off (Bitsgap rejects keys with withdrawals enabled), and add Bitsgap's trusted IP addresses, copied from the Manual Replace or Fix window, to the key's whitelist on the exchange.
- Re-check the key's permissions every time you connect it, as Bitsgap's blog recommends, and never paste API keys, passwords or seed phrases into Bitsgap's AI Chat; its terms forbid entering credentials there.
What it can do with your money
| Who holds the keys | The exchange holds your funds Your coins stay in your own exchange accounts. Bitsgap says it 'connects through secure API keys only — we never move or hold your funds' and 'Your assets remain in your own exchange accounts at all times.' Bitsgap stores the API keys that let its bots trade; it says passwords and API keys are always encrypted (RSA 2048 per its help center). These are Bitsgap's own claims. source |
|---|---|
| Can funds be sent out to any address? | No. Bitsgap refuses API keys that have withdrawal permission: its error-status article says 'The API key can't be used because the withdrawal permission is enabled', and its blog says such keys 'are rejected automatically on connection'. A trade-only key can still be misused to place bad trades on your balance; Bitsgap's blog warns a compromised key 'can still be misused within its trading scope, for instance to manipulate a thin market.' source |
| Can it hold or freeze your funds? | This covers the Bitsgap service, not your exchange funds. Bitsgap's terms let it suspend your account until the cause is fixed and suspend or end the service 'at any time without notice'. It caps its liability at the lower of AED 5,000 or the fees you paid over three months. The terms page shows no last-updated date. source |
| What a leaked API key can do | Bitsgap needs read (trade history, balances) and trading permission, and rejects keys with withdrawal enabled. For Binance its guide says to enable Reading, Spot & Margin Trading and (optionally) Futures. Binance, KuCoin, Kraken and Crypto.com require IP whitelisting for Bitsgap. You copy Bitsgap's trusted IP addresses from its Manual Replace or Fix window and add them to the key on the exchange; the addresses are not published in the help text. 'API Account Lock' blocks the same key from being used on more than one Bitsgap account and emails the account it is already linked to. source |
Official links
- Website:
bitsgap.com - X:
@Bitsgap - App:
https://apps.apple.com/app/id1407713776 - App:
https://play.google.com/store/apps/details?id=com.bitsgap.pwa
Where we confirmed these
Incidents
None found in official sources or reputable reporting for 2024 to 2026. That doesn't prove nothing happened.