Audits › Report
Report · 2026-09-17
Why trading bots lose money: controls, not strategies
Read the issue trackers of open-source bots and the reviews of the paid suites and the same thing appears every time: the strategy is not what fails. What fails is a size cap checked in the wrong unit, a kill switch that one code path skips, a support desk that goes quiet when money is at stake. This report collects the evidence behind this site, with a source and a date for every claim.
One open-source bot, read at the code
- CloddsBot (alsk1992/CloddsBot): an open-source AI trading agent built on Claude, MIT license, 2,758 stars, 335 forks, 28 open issues, created 2026-01-26, last push 2026-09-12. A bot with almost 2,800 stars and active maintenance. (source, 2026-09-17)
- Issue #126 (opened 2026-09-12): market orders defeat the notional cap through a caller-supplied price, several execution routes (Drift, Pump.fun, Meteora) are still ungated, and one route ignores dry-run mode. (source, 2026-09-17)
- Issue #127 (opened 2026-09-12): the BUY size cap is validated in the wrong units (a 100 USD cap lets a 1,000 USD spend through), a direct fallback path is ungated, and fallback orders are double-counted by the circuit breaker. (source, 2026-09-17)
- Both issues are follow-ups to earlier fixes (#116, #119, #115, #120): each fix covered one execution path and the next feature added another one without the check. (source, 2026-09-17)
Both issues describe controls that exist but can be bypassed: exactly the difference between present and partial in this site's verdicts. See the CloddsBot audit page.
What paying customers complain about
- 3Commas charges 20, 50 and 140 USD per month (Starter, Pro, Expert); the free plan does not allow real trading. (source, updated 2026-07-31, read 2026-09-17)
- A 3Commas customer review: the bot crashed while the user slept, grid bots lost about 10,000 USD before positions could be closed by hand, and support went silent for a month after promising to escalate. (source, read 2026-09-17)
- A Cryptohopper customer review: six months on the platform plus a purchased strategy, no profit, capital down to 50 %. (source, read 2026-09-17)
- Cryptohopper's own price table could not be read without JavaScript; third-party comparisons place it between 19 and 129 USD per month. Gunbot: 29 USD per month or a lifetime license. (third-party comparison pages, 2026-09-17)
- None of the commercial suites sells the monitoring layer on its own: the kill switch, the drawdown alert and the heartbeat come bundled with the bot that needs watching. (3Commas, Cryptohopper and Gunbot plan pages, 2026-09-17)
Where a U.S. or Puerto Rico resident can run a bot
| Exchange | Puerto Rico | Allows | Official API |
|---|---|---|---|
| Binance.US | Yes, in writing | Spot; no futures, no margin. 0 % maker / 0.02 % taker | Yes |
| Robinhood Crypto | Yes, in writing | Spot crypto | Yes |
| Kraken | Not verified | Spot; CFTC-regulated perpetuals for U.S. clients since 2026-06-15 | Yes (spot); futures not confirmed |
| Coinbase | Not verified | Spot; regulated futures via Coinbase Financial Markets | Yes; futures not confirmed |
| Hyperliquid, dYdX | No: their own terms exclude U.S. persons | n/a | n/a |
"Not verified" means the exchange's eligibility page could not be read without JavaScript or returned an access error on the check date; it is not a "no".
Demand, measured
- Hacker News comments mentioning trading bot: 11,139 in the last 12 months versus 7,888 in the 12 months before (+41.2 %). (source, 2026-09-17)
- GitHub: 784 repositories matched the trading-bot searches with 50 stars or more; 480 of them are bots rather than lists, libraries or API clients. (source, 2026-09-17)
- ccxt, the exchange library most bots are built on: 475,225 PyPI downloads in the last month. (source, 2026-09-17)
- Google Suggest returns a full set of 10 completions for is trading bot safe, best trading bot for, and claude trading bot. (source, 2026-09-17)
What this site does about it
- Audits the public code of 80 open-source trading bots against 21 risk controls, with file-and-line evidence. 10 audits published so far; the rest are queued.
- Publishes, per bot, whether its README names the exchanges a U.S. resident can use and what the audit says about running it with a live key.
- Builds the watchdog: the monitoring layer that no suite sells on its own, independent of the bot, on a read-only key.
- Takes no referral money from any bot or exchange, so it can say "absent" when a control is absent.