Is OctoBot safe to connect?
Web trading terminal · Binance, OKX, Bybit, Coinbase, More than 12 exchanges (per octobot.cloud). Checked 2026-10-26; every line links its source.
Worst case: If you self-host OctoBot, anyone who can reach its web interface (no password by default) or the machine it runs on can control your bots and read your exchange keys. A key with withdrawal enabled could then be emptied, and a trade-only key could still place trades that drain your balance. OctoBot says there is no recovery service.
Safe setup in 3 steps
- Get OctoBot only from octobot.cloud, github.com/Drakkar-Software/OctoBot or the App Store (id6502774175), keep it updated as OctoBot's blog advises (the 2022 remote-code-execution flaw was fixed in 0.4.4), and start in simulation mode, as the README recommends
- Create the exchange API key with only the permissions OctoBot's exchange guide lists (for Binance: Enable Reading and Enable Spot & Margin Trading) and nothing else
- If you self-host, turn on the web-interface password (off by default), set CORS_ALLOWED_ORIGINS, and keep the machine secure and your connection to it encrypted, as OctoBot's web-interface guide and self-custody blog advise
What it can do with your money
| Who holds the keys | The exchange holds your funds Your coins stay on the exchange you connect, and OctoBot trades through your API keys. For the self-custody mobile app, octobot.cloud says 'your keys never leave your devices' and that 'even the OctoBot team cannot access your keys'. An optional 'personal mini-cloud' is a server you create yourself, 'not a server owned by the OctoBot team'. A self-hosted OctoBot keeps keys in its own config ('It contains exchange API keys...'), so anyone who can reach that machine can reach the keys. source |
|---|---|
| Can funds be sent out to any address? | No. Only if your key is limited to what OctoBot's guides ask for: for Binance, 'Enable Reading' and 'Enable Spot & Margin Trading'. OctoBot's guides we could read do not say to disable withdrawals or explain how keys are protected, so a key you create with withdrawal rights could be emptied if the bot's machine or config leaks. Even a trade-only key can place bad trades on your balance. source |
| What a leaked API key can do | OctoBot's Binance guide asks for only two permissions: 'Enable Reading' (to read balances) and 'Enable Spot & Margin Trading' (to place orders). The pages we read give no withdrawal or IP-whitelist guidance. OctoBot's self-custody blog says 'You are responsible of your crypto wallet and API keys security, there is no recovery service if you lose your keys.' The OKX and Bybit setup guides could not be fetched. source |
Official links
- Website:
octobot.cloud - Telegram:
@octobot_trading - GitHub:
github.com/Drakkar-Software/OctoBot - App:
https://apps.apple.com/us/app/octobot-crypto-investment/id6502774175
Where we confirmed these
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2022-07-16 | CVE-2021-36711: the OctoBot web interface before 0.4.4 allowed remote code execution through mishandled 'Tentacles' (plugin) uploads. Rated critical (CVSS 3.1 9.8, no login needed) in the GitLab advisory, and a public exploit was published (Exploit-DB 50979, 'OctoBot WebInterface 0.4.3 - Remote Code Execution'). | Fixed in OctoBot 0.4.4; upgrading is the fix. We found no reports of losses. | source |