Security: Protecting Your Capital

Security isn't optional — it's mandatory. One leaked key costs everything.

Threat Hierarchy (Worst to Least)

🔴 CRITICAL: Private Key Leak

What it is: someone got your wallet private key

Consequences: they can withdraw ALL funds in minutes

How to Protect:

• ✅ Never enter private key on unknown sites
• ✅ Use hardware wallets (Ledger, Trezor)
• ✅ Never share key with anyone

🟠 HIGH: API Key Leak

What it is: someone got your exchange API key

Consequences: they can:

• Trade with your account
• Withdraw funds (if permission given)
• Drain entire balance

How to Protect:

• ✅ Never share full API key
• ✅ Create separate key per bot
• ✅ Disable withdrawal rights on each key
• ✅ Rotate keys every 3 months

🟡 MEDIUM: Password Breach

What it is: someone learned your exchange password

Consequences: they can:

• Change API keys (locking you out)
• Disable 2FA
• Withdraw funds

How to Protect:

• ✅ Use unique long password (20+ chars)
• ✅ Enable 2FA (two-factor)
• ✅ Use password manager (1Password, Bitwarden)
• ✅ Never enter password on unknown sites

🟢 LOW: Phishing (Fake Sites)

What it is: led to fake lookalike site

Consequences: you enter data, it's stolen

How to Protect:

• ✅ Check URL in address bar
• ✅ Bookmark sites (don't search Google)
• ✅ Look for HTTPS and green lock
• ✅ Don't click email links

Security Checklist (Do This Now)

Protect AI Traders Password

1. Create unique password:

   • 16+ characters
   • Uppercase + lowercase + numbers + symbols
   • Example: Tr@d1ng$ecur3p@ss2026!

2. Enable 2FA:

   • Settings → Security
   • Choose Google Authenticator (best)
   • Save backup codes somewhere safe

3. Use password manager:

   • Recommend: 1Password, Bitwarden, LastPass
   • Remember ONE master password
   • Everything else stored safely

Protect Hyperliquid

1. Create Agent (not raw API key):

   • Hyperliquid: Settings → Agents → Create
   • Name: "AI Traders Bot #1"

2. Set Correct Permissions:

   ✅ Trading (trading)
   ❌ Withdrawal (DISABLE)
   ❌ Key Management (DISABLE)
   

3. Add to AI Traders:

   • Only Agent Key and Subaccount
   • No private key!

4. Create Separate Agent Per Bot:

   • Bot 1 (DCA BTC): Agent #1
   • Bot 2 (Grid ETH): Agent #2
   • This isolates risk

Disable Dangerous Features

1. Hyperliquid:

   • Disable "Quick Withdrawal"
   • Add time delay (minimum 24 hours)
   • Whitelist withdrawal addresses (only yours)

2. AI Traders:

   • Disable auto-withdrawal
   • Review trades manually (optional)

Monitor Activity Weekly

1. Check Hyperliquid:

   • Login history
   • Active API keys
   • Recent setting changes

2. Check AI Traders:

   • Open My Bots
   • Verify all active bots
   • Confirm you created them

3. If See Something Suspicious:

   • Immediately disable API key
   • Change password
   • Enable 2FA if off

Security Checklist (Monthly)

Pass regularly:

• AI Traders password: unique, 16+ chars
• 2FA on AI Traders: enabled, codes saved
• Hyperliquid password: unique, 16+ chars
• 2FA on Hyperliquid: enabled (Google Auth)
• API keys: withdrawal disabled
• Agents: created per bot separately
• Activity history: no strange logins
• Password manager: used for everything
• Backup codes: saved securely
• Key rotation: done within 3 months

If Key Gets Compromised

Immediately:

1. Disable Key in Hyperliquid:

   • Settings → Agents → Revoke
   • Click "Disable" on compromised key

2. Disable Bot in AI Traders:

   • My Bots → bot → Stop

3. Check Balance:

   • On Hyperliquid verify funds still there
   • Check recent transaction history

Then:

4. Create New Agent:

   • Different name

5. Update in AI Traders:

   • Add new key
   • Remove old one

6. Change Passwords:

   • Hyperliquid password
   • AI Traders password

Common Security Mistakes

❌ Using same key for all bots

• One compromise = lose everything
• ✅ Separate key per bot

❌ Storing keys in text file

• Virus = steal everything
• ✅ Use password manager

❌ Giving bot withdrawal rights

• Hack = instant loss
• ✅ Disable this right

❌ No 2FA

• Password alone = vulnerable
• ✅ Enable 2FA everywhere

❌ All money on exchange

• Single point of failure
• ✅ Keep reserve in cold wallet

Cold Wallet (For Large Amounts)

If you have > $10,000:

1. Buy hardware wallet:

   • Ledger Nano X (recommend)
   • Trezor One
   • Cost: $50–$100

2. Strategy:

   • Main capital: cold wallet
   • Trading capital: exchange ($100–$1,000)

3. Logic:

   • Bots trade with $1,000
   • When reaches $2,000, withdraw $1,000 to cold
   • Repeat

Result: even if exchange hacked, lose only trading capital.

Summary

Rule #1: never share private keys Rule #2: unique passwords everywhere Rule #3: 2FA everywhere Rule #4: disable withdrawal on API Rule #5: check activity regularly

Follow these — your funds stay safe!

Start with the checklist right now.