Across 19,168 deduplicated archived channel messages there is exactly one mention of an API key, and it is a warning. Here is where the money sits in each arrangement, and what can take it.
Who holds the money in each of the four arrangements?
You do, in three of them. The differences between those three are about who else can move it while it is sitting there.
Four arrangements cover almost everything anyone is offered. You read a post and place the trade yourself. You issue an exchange API key to software. You switch on the exchange's own copy trading. Or you send the money to somebody who says they will trade it.
| Arrangement | Where the funds sit | Who can place trades | Who can move funds out | Worst realistic case |
|---|---|---|---|---|
| You read a signal, you trade it | Your exchange account | You | You | Your own trade goes wrong |
| You issue an API key with trade rights | Your exchange account | You and whoever holds the key | You | The key holder trades the balance away without ever withdrawing |
| The exchange's own copy trading | A copy balance inside your exchange account | The leader, in proportion to your allocation | You | The leader's worst day, applied to what you allocated |
| You transfer funds to a person or a fund | Their account or wallet | Them | Them | All of it, at any moment, with no market event required |
Read the last column downwards. The first three rows describe losses that have to travel through the market. The fourth row describes something a person can do to you, and it does not need the market's permission.
Why is "somebody can lose it" different from "somebody can take it"?
Because an account has two exits, and only one of them needs price to move.
A loss goes out through the market. Something has to be bought, something has to fall, and the whole event is visible in your positions while it happens. It is bounded by what you exposed and by the leverage on that exposure, and you can end it by closing the position. None of that makes it small. Plenty of accounts have been emptied this way and nobody broke a rule doing it.
A taking goes out through the door. It needs a transfer and nothing else. No opinion about bitcoin is involved, no volatility, no bad week. The size of the event is the size of the balance, the timing is whenever the other party decides, and there is no position to close because there was never a position.
Almost every custody question is the question of which exits somebody else can reach. Three answers exist, and they are worth naming separately:
- They can move value inside your account. Trading rights. Your balance can change shape and shrink, but it stays with your exchange, under your name.
- They can move value out of your account. Withdrawal or transfer rights, whether you granted them or somebody stole them.
- They hold it and you do not. There is nothing to grant or revoke. The arrangement itself is the exposure.
Which of the four arrangements you are in decides which of those three applies. Which trading decisions you hand over is a separate question with its own answer in copy trading vs signals.
What do signal channels tell their readers about any of this?
Almost nothing, and the imbalance is the finding. We searched 19,168 deduplicated messages from 42 archived Telegram channels for the vocabulary of custody.
| Term | Messages | Channels, of 42 |
|---|---|---|
| deposit | 120 | 27 |
| trading "bot" | 133 | 12 |
| withdraw | 43 | 14 |
| "copy trad*" | 41 | 6 |
| referral, uid or invite code | 21 | 8 |
| "connect your account / exchange / api" | 6 | 3 |
| "I trade for you" / "manage your funds" | 4 | 1 |
| seed phrase or private key | 2 | 2 |
| API key | 1 | 1 |
| "read-only" | 0 | 0 |
| "sub-account" | 0 | 0 |
| 2FA or two-factor | 0 | 0 |
One mention of an API key in nineteen thousand messages, and it is a warning about somebody else's breach:
"3commas lost control over their user's API keys to popular exchanges like binance. Immediately delete your API keys submitted to 3commas if you use it" - altzsignalz
Nobody in this archive explains what a read-only key is. Nobody mentions a sub-account. Nobody mentions two-factor authentication. What does appear is the invitation:
"Copy trading is going according to plan. These signals are copied to you on full automation. No time? I trade for you" - signals_trading3
"Connect your account in minutes and let the system do the work." - signals_trading3
The 41 copy-trading mentions need their composition stated and not their total. Most of them come from TradingForexSPE, a Spanish-language forex channel advertising a managed portfolio, and several more are news items, including a Binance delisting notice and a story about Belarusian regulation. Only signals_trading3 markets automated copying of its own calls. Our own copy trading vs signals reads all 41 as advertisements; this breakdown corrects that, and forty-one mentions is not forty-one crypto copy-trading offers.
One channel in the archive pushes the other way, although what it warns about is the trading and not the custody:
"People copy trades me or any other analyst without context, no risk plan, high leverage." - cryptoanalyst_ff
"Connect your account in minutes" is an instruction with a precise technical meaning, and that meaning changes completely depending on which of the four arrangements it turns out to be. Sorting it out starts with the arrangement where nobody has any access at all.
What does a Telegram signal channel actually get access to?
Nothing. Not the account, not a key, not a balance, not a name. This is the baseline the other three arrangements are measured against.
A post is a suggestion. Until you act on it the custody question has not arisen at all, and after you act on it the only person who moved money is you.
That is the strength of manual following and it is also its ceiling. Everything that can go wrong is your own trade: your entry, your size, your leverage, your decision to hold it through the weekend. A channel with an appalling record can cost you a great deal of money without ever touching your account, and a channel with an excellent one cannot help you if you size the trade wrong.
What can an exchange API key actually do?
Whatever permissions were attached at the moment it was created. That list is longer than most people picture, and it is enumerated in the exchanges' own documentation.
Bybit's API returns the permissions on a key as named groups: ContractTrade, Spot, Wallet, Options, Derivatives, Exchange, Earn, Affiliate, BlockTrade and NFT, among others. Inside Wallet sit the three entries that settle the custody question outright: AccountTransfer, SubMemberTransfer and Withdraw. The same response carries a readOnly field, where 0 means read and write and 1 means read only, and an ips array holding whatever addresses the key is bound to. An expiry date is reported only for keys with no IP bound or whose password has been changed, so plenty of keys carry none at all.
Binance's key creation page offers four ticks: reading, spot and margin trading, futures, and withdrawals. One condition is attached to the last of them for the system-generated HMAC keys most people end up with. "Adding IP access (IPv4 format) restrictions is mandatory to enable withdrawal permission." An unrestricted-IP HMAC key, in that document's words, "won't have any permission other than reading."
None of that has to be taken on trust, and none of it is visible only to a program. Both exchanges keep issued keys on an API management screen, and each key's row carries the same permissions and read-only state the endpoint above returns. The habit worth forming is reading that screen for the keys you already hold, not only for the one you are about to create. A key whose permissions you cannot see is a key to revoke, and how to issue, restrict and rotate them is in API keys and account security for traders.
Can a key that cannot withdraw still empty an account?
Yes. The exchange's own incident report is the clearest description of how.
On 7 March 2018, between 14:58 and 14:59 UTC, the VIA/BTC market on Binance moved in a way no news explained. Binance's summary of the incident describes attackers who had accumulated user credentials by phishing since early January, then "created a trading API key for each account". They "selected VIA, a coin with smaller liquidity, to maximize their own gains", and "placed a large number of market buys on the VIA/BTC market, pushing the price high, while 31 pre-deposited accounts were there selling VIA."
The attempt failed at the door. Binance's risk system had already disabled withdrawals, none went out, and the exchange stated that all funds were safe and none had been stolen. What it did not stop was the buying, because buying is what a trading key is for. The victims' bitcoin was spent on a thin altcoin at a price the attackers had made themselves, and every one of those orders looked legitimate to the exchange.
That is the whole shape of a trade-only key. The door is locked and the market is open, and value leaves through the market at whatever price the person holding the key arranges.
The scale version of the same risk arrived at the end of 2022. On 28 December a file containing roughly 100,000 API keys taken from the trading-bot platform 3Commas was published, with whoever released it claiming that was ten per cent of what they held. 3Commas chief executive Yuriy Sorokin confirmed the file was genuine: "We saw the hacker's message and can confirm that the data in the files is true." The company asked Binance, KuCoin and other supported exchanges to revoke every key. Binance's chief executive told users to disable any key they had ever submitted there. Affected traders reported losses in the region of $22 million.
Nobody in that story had to guess a password. They had permissions that had been granted deliberately, months earlier, and left in place.
Where do the funds sit in an exchange's own copy trading?
Inside your account, in a compartment the exchange opens and closes on your instruction. The leader gets an instruction channel and never a credential.
Binance's spot copy trading documentation is explicit: "the Spot Copy Trading Account is separate from the Binance Spot Account". Funds move into it when you start, and closing the portfolio sends them back: "the funds will be returned to your Spot Account once the Copy Trading Portfolio is closed", in the same document's words. OKX describes the same shape from the fee side: ordinary trading fees at your normal tier, no extra transaction charge, and a profit share of 8% to 13% paid to the lead trader out of profits.
Read as a permission question, that is a leader who can trade your allocation and cannot withdraw it. The custodian of the balance is the venue, so whatever an exchange failure would do to your ordinary balance it does to this one.
What changes when you transfer the funds instead?
Everything, because there is no longer a permission to inspect. Permissions are a property of accounts you own.
The public record has a case large enough to settle the argument. On 24 April 2023 a US federal court entered judgment against Cornelius Johannes Steynberg over Mirror Trading International, a scheme running from around May 2018 to March 2021 on the claim that a proprietary "bot" was trading forex. The CFTC's account is that at least 29,421 bitcoin came in from at least 23,000 individuals in the United States and more elsewhere. The order states that the defendants "misappropriated all of the Bitcoin they accepted from pool participants."
Hold that against the two sections above. There, the question was which rights somebody held over an account with your name on it, and the answer could be read off the exchange's own screen in about a minute. Here there was no such screen. Account statements existed and were fictitious, the trading was described and did not happen, and the only verifiable thing was never the performance but the address the money went to.
None of which makes every managed arrangement a fraud. The point is narrower and it is structural: this is the only one of the four arrangements where the worst case is the entire balance and the trigger is somebody else's decision. If that is the arrangement, the diligence has to be about the person and their regulator, because nothing else is left to inspect.
Two lookups are free and take a minute. The CFTC tells the public to "verify that the entity is properly registered with the CFTC" before working with anyone to trade futures, pools, options, forex or other derivatives. It points at the NFA's BASIC database, where registration, disciplinary or regulatory history and financial information can be checked. In the United Kingdom the equivalent is the FCA's Financial Services Register. Neither lookup is a verdict on anybody, and nothing here claims what either register did or did not show for Mirror Trading International. What to do when it has already gone wrong is in what to do if a channel scammed you.
How do you settle the custody of an offer?
By asking three questions, and the first does most of the work. They take a minute, and they work on an exchange product and on a stranger's direct message equally.
- Whose name is on the account holding the funds? If the answer is not yours, the other two questions are decoration. Ask it about the money and not about the platform, because a well-known venue can host a page where you are asked to send funds somewhere else.
- What is the strongest single thing the other party can do without asking me again? Place a trade is one answer. Withdraw is a different answer. "I do not know" is a third, and it belongs with the second.
- What ends it, and how quickly? Revoking a key, closing a copy portfolio and unfollowing a leader are all things you do yourself, in seconds, from your own account. Asking somebody to send your money back is in no way the same category of action.
An offer that cannot survive the first question is not a bad version of copy trading. It is a different arrangement wearing the word, and the other checks in 10 red flags of a signal channel apply to it long before performance does.
What this does not prove
The archive counts are marker searches over free and public Telegram channels, so they are a floor and not a census. A channel that explains read-only keys in a pinned image, a video or a language our patterns do not match is counted as silent when it is not. The absence of the phrase is evidence about what gets published in the feed, and about nothing else.
The concentration caveat travels with every figure in that table. Six channels of 42 produce the copy-trading mentions and one produces the direct offers, so these are counts of what a handful of feeds say, not a survey of the market.
The Binance and OKX passages are product documentation. Documentation states how a product is built to behave, which is a different claim from a record of how it behaved, and we have audited neither venue's handling of follower funds. Binance's account also covers its spot copy trading product specifically, not futures copy trading and not any other venue's implementation, so the section heading generalises further than its sources do. Terms change, and the versions used here date from 18 August 2026. Bybit's help centre would not open from the machine this was written on, so nothing about Bybit's copy-trading fund handling is claimed here.
Mirror Trading International is one enforcement action and not a rate. It shows what the fourth arrangement permits, not how often the permission gets used. A copy-trading product is not a scam because it exists, paid access is not evidence of fraud, and none of the channels quoted above is alleged to have done anything wrong by inviting readers to copy its trades.
The practical read
Sort the offer before you judge the trader. Manual following, a key with trade rights, a venue's copy account and a transfer to a manager are four different questions about your money. Only the last of them puts the whole balance behind somebody else's decision with no market event required to move it.
If you connect a key, connect the weakest one the job allows and write down the date you issued it. If you use a venue's copy trading, the leader's worst day is your exposure and the venue is now your custodian. If you are being asked to send funds anywhere, that is the whole conversation, and it has nothing to do with how good the signals are.
Where the keys themselves live, and the mistakes that lose them, is in crypto wallets explained. What we can and cannot say about the channels we score is at Signal Providers. Nothing here is financial advice.
Sources
- What permissions an API key carries. Bybit's V5 API reference, Get API Key Information, opened 18 August 2026, for the permission groups, the
WalletentriesAccountTransfer,SubMemberTransferandWithdraw, thereadOnlyandipsfields, and the note thatdeadlineDayandexpiredAtapply only to keys "with no IP bound or the password has been changed". The same page marks theCopyTradinggroup "Deprecated, always []", so it is not cited as an inspectable permission. Binance, How to Create API Keys on Binance, opened the same day, for the reading, spot and margin, futures and withdrawal permissions. Both quoted sentences about IP restrictions are scoped by that document to system-generated HMAC keys. - A trading key with no withdrawal right. Binance's own Summary of the Phishing and Attempted Stealing Incident on Binance, published 8 March 2018 and describing the incident of 7 March, opened and quoted directly. It supplies the trading API keys created per phished account, the choice of VIA for its liquidity, and the market buys against 31 pre-deposited accounts. It also supplies the withdrawals the risk system had already disabled.
- The 3Commas key leak. 3Commas CEO confirms API key leak following warning from CZ, Cointelegraph, opened for Yuriy Sorokin's confirmation and Binance's advice to users. Crypto trading service 3Commas confirms massive API key leak from hack, SiliconANGLE, 29 December 2022, opened for the roughly 100,000 keys in the published file and the leaker's claim that it was ten per cent of the total. The same piece supplies the request to exchanges to revoke keys and the approximately $22 million of losses reported by traders. That loss figure is what traders reported and is not independently verified here.
- Where funds sit in exchange copy trading. Binance, Frequently Asked Questions on Binance Spot Copy Trading, opened and quoted for the separate Spot Copy Trading Account and the return of funds on closing a portfolio. That document covers spot copy trading only. OKX, Copy trading FAQ, opened and quoted for the fee structure and the 8% to 13% profit share. Bybit's help centre returned an error and could not be opened, so it is cited nowhere above.
- Funds transferred to a manager. CFTC press release Federal Court Orders South African CEO to Pay Over $3.4 Billion for Forex Fraud, opened and quoted. It gives the order of 24 April 2023 and the at least 29,421 bitcoin taken from at least 23,000 individuals in the United States between approximately May 2018 and March 2021. It also gives the claimed proprietary "bot" and the finding that the defendants misappropriated all of the bitcoin they accepted.
- Checking a registration. The CFTC's Check Registration and Disciplinary History page, opened and quoted for the instruction to verify registration before trading through anyone, and for the NFA BASIC database covering registration, disciplinary or regulatory history and financial information. The FCA's Financial Services Register is named as a destination for UK readers; it would not open from this machine and nothing is quoted from it.
- Channel vocabulary. Our own archive,
data/channel_dumps/, 42 files and 19,168 messages after exact deduplication, searched on 18 August 2026. Every count in the table above, the single API-key mention, the invitation quotes and the composition of the 41 copy-trading mentions come from that run and are recorded inwork/_batch10-shared-research.md.