Is Insilico Terminal safe to connect?
Web trading terminal ยท Hyperliquid, Lighter, Bybit (via API key), Binance (via API key). Checked 2026-10-25; every line links its source.
Worst case: Insilico can place trades with the API keys or Hyperliquid connection you give it, so a leaked key or a compromised device or session can open bad or leveraged trades. If you had enabled withdrawals on a key, the exchange balance could be drained.
Safe setup in 3 steps
- Create trade-only API keys with withdrawals disabled, IP-restricted to Insilico's servers as its docs describe, and used for Insilico only
- Leave API-key sync off unless you need it, so keys stay in your browser's local storage instead of on Insilico's servers
- Keep only trading margin on the connected exchange or Hyperliquid account, and revoke the key or agent approval when you stop using the terminal
What it can do with your money
| Who holds the keys | You hold the keys Funds stay on your exchange or Hyperliquid/Lighter account. The API keys you add are stored in your browser's local storage, unless you turn on the optional 'Synchronize API Keys Across Devices', which stores them on Insilico's servers. source |
|---|---|
| Can funds be sent out to any address? | Insilico never holds your funds. Withdrawals happen on the exchange or Hyperliquid account itself, and Insilico tells you never to enable withdrawals on the API keys you give it. source |
| What a leaked API key can do | Insilico's docs say 'do not ever enable withdrawals' on keys you give it. Bybit keys created through its flow are locked to Insilico's server IP range. For Binance you whitelist Insilico's server IPs. It recommends one API key per application. Keys stay in local browser storage unless you opt in to server-side sync. source |
Official links
- Website:
insilicoterminal.com - X:
@InsilicoTrading
Where we confirmed these
Incidents
None found in official sources or reputable reporting for 2024 to 2026. That doesn't prove nothing happened.