# Is OctoBot safe? Check before you connect

> OctoBot: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-26.

Canonical: https://tradingagentstack.com/check/octobot/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. OctoBot

# Is OctoBot safe to connect?

Web trading terminal · Binance, OKX, Bybit, Coinbase, More than 12 exchanges (per octobot.cloud). Checked 2026-10-26; every line links its source.

**Worst case:** If you self-host OctoBot, anyone who can reach its web interface (no password by default) or the machine it runs on can control your bots and read your exchange keys. A key with withdrawal enabled could then be emptied, and a trade-only key could still place trades that drain your balance. OctoBot says there is no recovery service.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Get OctoBot only from octobot.cloud, github.com/Drakkar-Software/OctoBot or the App Store (id6502774175), keep it updated as OctoBot's blog advises (the 2022 remote-code-execution flaw was fixed in 0.4.4), and start in simulation mode, as the README recommends

2. Create the exchange API key with only the permissions OctoBot's exchange guide lists (for Binance: Enable Reading and Enable Spot & Margin Trading) and nothing else

3. If you self-host, turn on the web-interface password (off by default), set CORS_ALLOWED_ORIGINS, and keep the machine secure and your connection to it encrypted, as OctoBot's web-interface guide and self-custody blog advise

## What it can do with your money

| Who holds the keys | The exchange holds your funds Your coins stay on the exchange you connect, and OctoBot trades through your API keys. For the self-custody mobile app, octobot.cloud says 'your keys never leave your devices' and that 'even the OctoBot team cannot access your keys'. An optional 'personal mini-cloud' is a server you create yourself, 'not a server owned by the OctoBot team'. A self-hosted OctoBot keeps keys in its own config ('It contains exchange API keys...'), so anyone who can reach that machine can reach the keys. [source](https://www.octobot.cloud/features/self-custody-trading-bot) |
| --- | --- |
| Can funds be sent out to any address? | No. Only if your key is limited to what OctoBot's guides ask for: for Binance, 'Enable Reading' and 'Enable Spot & Margin Trading'. OctoBot's guides we could read do not say to disable withdrawals or explain how keys are protected, so a key you create with withdrawal rights could be emptied if the bot's machine or config leaks. Even a trade-only key can place bad trades on your balance. [source](https://www.octobot.cloud/en/guides/octobot-partner-exchanges/binance/account-setup) |
| What a leaked API key can do | OctoBot's Binance guide asks for only two permissions: 'Enable Reading' (to read balances) and 'Enable Spot & Margin Trading' (to place orders). The pages we read give no withdrawal or IP-whitelist guidance. OctoBot's self-custody blog says 'You are responsible of your crypto wallet and API keys security, there is no recovery service if you lose your keys.' The OKX and Bybit setup guides could not be fetched. [source](https://www.octobot.cloud/en/guides/octobot-partner-exchanges/binance/account-setup) |

## Official links

**Not fully confirmed.** Some of these links were confirmed in only one place, so treat them with care.

- Website: `octobot.cloud`

- Telegram: `@octobot_trading`

- GitHub: `github.com/Drakkar-Software/OctoBot`

- App: `https://apps.apple.com/us/app/octobot-crypto-investment/id6502774175`

Where we confirmed these
- https://www.octobot.cloud (vendor site, 'Drakkar-Software © 2021-2026', 15 rue des halles, 75001 Paris: footer links github.com/Drakkar-Software/OctoBot, twitter.com/DrakkarsOctoBot, t.me/OctoBot_Project; community section links t.me/octobot_trading and discord.com/invite/vHkcb8W; links App Store id6502774175 and Google Play com.drakkarsoftware.octobotapp)

- https://github.com/drakkar-software/octobot (Drakkar-Software/OctoBot, GPL-3.0, ~6.6k stars; About links www.octobot.cloud; README links t.me/octobot_trading, t.me/OctoBot_Project, x.com/DrakkarsOctoBot, App Store id6502774175)

- https://apps.apple.com/us/app/octobot-crypto-investment/id6502774175 ('OctoBot: Crypto investment', seller DRAKKAR-SOFTWARE, developer website https://www.octobot.cloud, privacy policy octobot.cloud/privacy, v1.6.1)

- https://pypi.org/project/octobot (package registry: homepage github.com/Drakkar-Software/OctoBot, author Drakkar-Software, latest stable 2.1.1 released 2026-03-29, 3.0.0 betas to 2026-10-08)

- https://docs.digitalocean.com/products/marketplace/catalog/octobot/index.html.md (DigitalOcean Marketplace listing links octobot.cloud guides and github.com/Drakkar-Software/OctoBot)

- https://gainium.io/review/octobot (third-party review: GitHub github.com/Drakkar-Software/OctoBot, Telegram t.me/octobot_trading, Discord discord.com/invite/vHkcb8W)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2022-07-16 | CVE-2021-36711: the OctoBot web interface before 0.4.4 allowed remote code execution through mishandled 'Tentacles' (plugin) uploads. Rated critical (CVSS 3.1 9.8, no login needed) in the GitLab advisory, and a public exploit was published (Exploit-DB 50979, 'OctoBot WebInterface 0.4.3 - Remote Code Execution'). |  | Fixed in OctoBot 0.4.4; upgrading is the fix. We found no reports of losses. | [source](https://cveawg.mitre.org/api/cve/CVE-2021-36711) |

## Check a link

Got a link, @handle or repo that claims to be OctoBot? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for OctoBot

We email you if we add an incident, a freeze report, a known fake or a deadline for OctoBot. Free; unsubscribe anytime.

## More checks: Web trading terminals
[GMGN](https://tradingagentstack.com/check/gmgn/)[Photon](https://tradingagentstack.com/check/photon/)[BullX Neo](https://tradingagentstack.com/check/bullx-neo/)[Axiom](https://tradingagentstack.com/check/axiom/)[Padre](https://tradingagentstack.com/check/padre/)[Fomo](https://tradingagentstack.com/check/fomo/)[Genius Terminal](https://tradingagentstack.com/check/genius-terminal/)[Based](https://tradingagentstack.com/check/based-one/)[HyperDash](https://tradingagentstack.com/check/hyperdash/)[Insilico Terminal](https://tradingagentstack.com/check/insilico-terminal/)[Moonshot](https://tradingagentstack.com/check/moonshot/)[Ave.ai](https://tradingagentstack.com/check/ave-ai/)[3Commas](https://tradingagentstack.com/check/3commas/)[Bitsgap](https://tradingagentstack.com/check/bitsgap/)[DEXTools](https://tradingagentstack.com/check/dextools/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)