The "Triangular Arb Bot" that ran for 41 days

February 2025. A holder in Las Vegas buys a "USDT/USDC/BUSD triangular arbitrage bot" from a Telegram seller for 0.4 ETH. The seller shows a YouTube video of the bot running, with logs showing profitable trades every few minutes. The bot requires API keys from his Binance.US account, with trading permissions enabled. He sets it up. For 41 days the bot trades small amounts and slowly accumulates a 2.4% gain — exactly as advertised. Then on day 42, the bot dumps his entire $74,000 USDT balance into a thinly traded pair on the same exchange, filling at absurd prices. The orders on the other side of those fills belong to the operator.

How the long-runway bot scam works

The bot is real software. It does perform small profitable arbitrage trades for weeks — that is the proof phase. Meanwhile, the operator watches the account balance grow (via the API key the victim provided). Once the balance crosses a threshold the operator considers worth taking, the bot executes a single drain trade against orders the operator has already parked in a thin market. No withdrawal permission is needed: the money leaves through the order book. The victim sees the loss after the fact and assumes the bot "broke."

The four hard rules for API keys

  • Never grant withdrawal permissions on an API key. All major exchanges let you create read-only keys, or trading-only keys without withdrawal. The default for any third-party tool should be "no withdraw." That alone does not stop a drain like this one, which is why the next three rules matter.
  • Allowlist IP addresses on the API key. Major exchanges let you restrict an API key to specific IP addresses. Set it to a server you control — never leave it open. If the seller insists the key must run on their server, they hold the key, and IP restriction protects you from everyone except them.
  • Audit the trading history weekly. Open the exchange's history page and review every trade the bot made. A bot that suddenly executes a large trade in a low-liquidity pair is the warning. Catch it on day 30, not day 42.
  • Trust the source of the bot, not the seller. Hummingbot is open source and can be read line by line; 3Commas and Cryptohopper are long-running commercial services with public track records — and even established services have had API-key leaks, so the permission rules above still apply. Bots from Telegram sellers are funnels.

What "real" arbitrage looks like

Profitable arb opportunities on liquid pairs across major exchanges are measured in basis points, last for seconds, and require infrastructure that retail users cannot match. If a "bot" promises steady returns of a couple of percent a month on stablecoin arb, it is either lying about the yield or hiding the risk. There is no free money in CEX-CEX arb — the spreads are gone.