Can AI agents trade on their own?Yes — within limits you set in code.
Technically, yes: an AI agent can watch prices, decide and send orders around the clock with no person approving each trade. On decentralized exchanges and on-chain perp markets it needs nothing but a wallet; at a centralized exchange it trades through an API key on an account that a person opened and verified. Whether it trades well is another question — in the first public contest with real money, four of six models lost. Below: where autonomous trading works, how a trade runs, which limits hold even if the model is fooled, what is known about results, the risks, and how law and tax treat a trading bot.
Reviewed November 5, 2026 · figures from our live data
The short answer
On-chain an agent can trade with no person involved: swaps on decentralized exchanges such as Uniswap or CoW, perps on Hyperliquid or dYdX.
At centralized exchanges (Coinbase, Kraken, Binance) the account belongs to a verified person; the agent only holds an API key — ideally trade-only, without withdrawal rights and tied to an IP address.
Results are mixed: in Alpha Arena (October–November 2025, $10,000 each in real money) four of six models lost, GPT-5 about 63%. A study found most models do not beat simply buying and holding.
The owner carries the risk and the legal duties. Trading your own money with a bot needs no licence in the EU; trading other people’s money does. Market-manipulation bans apply to bots too, and every swap can be a taxable sale.
tokens an agent’s own wallet can hold in our data today
issuers
stated yield range across 315 with a rate
Where an agent can trade without a person
The dividing line is who holds the account. On a blockchain the wallet is the account; at an exchange a verified person is.
- 1
Decentralized exchanges: fully autonomous
On Uniswap an agent signs a swap from its wallet and the contract executes it. It sets a minimum amount it must receive (amountOutMinimum); if the price moves further, the swap reverts instead of filling badly. No account, no sign-up.
- 2
Intent-based exchanges
On CoW Protocol the agent signs what it wants (an intent), not a transaction; competing solvers find the best execution. Trades in the same batch get one clearing price, which takes away the profit of front-running.
- 3
On-chain perps: Hyperliquid and dYdX
Hyperliquid lets a main account approve “API wallets” (also called agent wallets) that sign orders on its behalf; the docs say they are only used to sign, and an agent’s asset transfers must go back to the same address. dYdX has permissioned keys that separate trading keys from withdrawal keys and can block withdrawals entirely.
- 4
Centralized exchanges: a person’s account, an agent’s key
Coinbase, Kraken and Binance require a verified account holder. The agent trades through an API key the holder creates. Coinbase says API keys are only for access to your own account. Several exchanges now offer agent tools on top (see our guide on agent investing).
- 5
What still needs a person
Opening and verifying the exchange account, funding it from a bank, buying tokens that are only sold to checked investors, and redemptions that run through a manual process at the issuer.
How an autonomous trade runs
Most trading agents work in the same loop. The model decides; code checks and executes.
- 1
1. Read
Prices, order books, funding rates, its own positions and balance — from the chain, an exchange API or a data feed.
- 2
2. Decide
The model proposes a trade with a reason: what, how much, at which limit price, with which stop.
- 3
3. Check against fixed rules
Plain code — not the model — checks position size, daily loss, allowed markets and leverage before anything is signed. A trade that breaks a rule is dropped.
- 4
4. Execute with protection
A limit price or slippage cap, a deadline, and on Ethereum a private route such as Flashbots Protect or MEV Blocker, so sandwich bots cannot see the order first. Flashbots does not include transactions that would revert, so failed attempts cost no fee.
- 5
5. Confirm and log
Read the result back from the chain or the exchange, record the fill, the fee and the reason. The log is what the owner — and the tax return — rely on later.
Limits that hold even if the model is fooled
A model can be talked into anything. The limits that matter are enforced by the exchange, the contract or the key — not by the prompt.
- 1
Keys without withdrawal rights
Kraken lists “Withdraw Funds” as a separate permission and says a key that only places orders does not need it. Coinbase keys have View, Trade and Transfer; with Transfer, a leaked key can empty the account. Binance gives keys without an IP restriction read access only, and withdrawal permission requires one.
- 2
IP allow-lists
A key that works only from the agent’s server is useless to a thief — Kraken says IP whitelisting prevents almost all misuse of a leaked key. At Coinbase it is recommended, not required.
- 3
Spending limits and roles on smart accounts
A Safe can give a key a spending limit per token, one-time or recurring; anything above needs the full signers. The Zodiac Roles Modifier restricts a key to approved contracts, functions and even parameter values — for example “swap on this exchange, send only to this Safe”.
- 4
Session keys
Smart accounts (ERC-4337, modular accounts under ERC-7579) can issue session keys with policies: which contracts and functions, how much gas, how many calls per period, until when. The key works only while every policy is met.
- 5
Hosted agent wallets
Coinbase’s Agentic Wallet keeps the private keys at Coinbase, enforces caps per session and per transaction before any transaction, and screens transfers against sanctions lists.
- 6
A kill switch
One action that revokes the agent’s key or API wallet and stops it. Decide in advance who may pull it and when — for example after a set loss in a day.
How well do AI agents trade?
Public evidence is thin and recent. What exists points the same way: trading on its own is possible; beating the market is not the norm.
- 1
Alpha Arena, season 1 (crypto)
From 17 October to 3 November 2025, Nof1 gave six models $10,000 each to trade crypto perps on Hyperliquid on their own. Reported results: Qwen3 Max +$2,232, DeepSeek +$489, Claude Sonnet 4.5 −$3,081, Grok 4 −$4,531, Gemini 2.5 Pro −$5,671, GPT-5 −$6,267 (about −63%). Win rates were 25–30%.
- 2
Alpha Arena, season 1.5 (US stocks)
In the second round (November–December 2025, US stocks, four modes) a model later named Grok 4.20 was reported up about 12% on average and the only one in profit at the end.
- 3
StockBench
A 2025 benchmark of language-model agents trading stocks under real market conditions found that most models struggle to beat a simple buy-and-hold strategy, though some showed better returns and risk control.
- 4
What this means
Short contests are noisy, and fees, leverage and over-trading eat results — Gemini made 238 trades and paid $1,331 in fees in season 1. An agent that rebalances a few savings tokens is a different task from one that trades perps with leverage.
What has gone wrong
None of these cases needed a broken blockchain. The agent, its tools or its permissions were the weak point.
- 1
Prompt injection: Grok and Bankr (May 2026)
An attacker sent a wallet NFT that carried permissions, then posted a hidden, Morse-coded instruction that Grok repeated. The connected Bankr wallet treated the reply as an order and sent about 3 billion DRB tokens, worth roughly $155,000–180,000. No key was stolen and no contract was hacked.
- 2
A compromised dashboard: AIXBT (March 2025)
Someone got into the agent’s control panel and queued two replies; the agent sent 55.5 ETH, about $105,000, to the attacker.
- 3
Talked out of its rule: Freysa (November 2024)
An agent told never to release its prize pool was persuaded after 482 attempts that its transfer function was for incoming money, and paid out $47,316.
- 4
Trading-bot software: Banana Gun (September 2024)
A flaw in the Telegram trading bot let attackers drain about $3 million from 11 users; the team refunded them.
- 5
Market risks remain
Leverage can liquidate a position in minutes, thin markets fill at bad prices, and a wrong price feed leads to wrong trades. Software reacts faster than a person — also to its own mistakes.
Law and tax
There is no special law for trading bots. The existing rules apply to whoever runs it.
- 1
Your own money: no licenceEU only
MiCA licenses portfolio management “in accordance with mandates given by clients”. A bot that trades only its owner’s money serves no clients. MiFID II’s algorithmic-trading duties bind investment firms, not private people.
- 2
Other people’s money: a licenceEU only
Running a bot on clients’ money is portfolio management — under MiCA for crypto-assets, under MiFID II for securities. BaFin says it makes no difference whether the provider uses automated processes; a licence under § 32 KWG is needed.
- 3
Trading for your own account in GermanyGermany only
BaFin requires a licence for own-account dealing only in special cases, for example with direct electronic access to a trading venue or as a member of a regulated market.
- 4
Market abuse applies to botsEU only
MiCA’s market-abuse rules apply to any person and to trades on or off a platform. Orders that give false signals about supply, demand or price are manipulation — whether a person or an agent places them.
- 5
United StatesUS only
The CFTC reminded registered firms in December 2024 that their duties apply in full when they use AI. Whoever trades for others needs the usual registrations; the SEC has fined advisers for false claims about using AI.
- 6
Every swap can be taxable
In the US and the UK swapping one token for another is a disposal with a gain or loss. In Germany private sales are taxable when held one year or less, with a €1,000 annual allowance. A busy agent creates hundreds of taxable events — keep its log.
Beware of “AI trading bot” offers
Regulators warn about this more than about any other AI topic in finance.
- 1
Guaranteed returns are a red flag
The CFTC: AI cannot predict the future, and promises of high or guaranteed returns point to fraud. Mirror Trading International took more than $1.7 billion in bitcoin from at least 23,000 people with a bot story.
- 2
Fake bots, real casesUS only
In May 2026 the SEC charged a Texan who raised about $12.3 million from some 150 investors for “AI-based trading bots” that, it says, did not work as claimed.
- 3
European warnings
BaFin warned about 17 websites selling an AI trading algorithm without a licence (February 2025); with EBA, EIOPA and ESMA it published warnings on AI and crypto fraud in all EU languages (January 2026). The FCA lists “Ai Trader Bot” as unauthorised.
- 4
Keep the keys
A genuine agent runs on your account or your wallet with keys you control and can revoke. An offer that asks you to send money to its own wallet is not an agent — it is a deposit with a stranger.
The 12 highest stated yields
Yields as stated by the issuer or read on chain, with the date they were checked on each token page. Not a recommendation.
| Token | Issuer | Yield | Minimum |
|---|---|---|---|
| Orca DEX — SOL / NEAR liquidity pool on Solana | Orca DEX (protocol) | 97.07% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Orca DEX — SOL / HYPE liquidity pool on Solana | Orca DEX (protocol) | 72.71% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Aerodrome Slipstream — WETH / USDC liquidity pool (CL50 - 0.025%) on Base | Aerodrome Slipstream (protocol) | 70.56% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Uniswap V3 — USDC / WETH liquidity pool (0.3%) on OP Mainnet | Uniswap V3 (protocol) | 65.07% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Raydium AMM — COINX / USDC liquidity pool (Concentrated - 0.8%) on Solana | Raydium AMM (protocol) | 62.77% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Uniswap V3 — WETH / USDC liquidity pool (0.3%) on Base | Uniswap V3 (protocol) | 60.6% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Raydium AMM — WSOL / ZEREBRO liquidity pool (Standard - 0.25%) on Solana | Raydium AMM (protocol) | 55.73% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Uniswap V4 — UNI / USDC liquidity pool (0.30%) on Ethereum | Uniswap V4 (protocol) | 54.47% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Uniswap V3 — WETH / USDT liquidity pool (0.3%) on Ethereum | Uniswap V3 (protocol) | 53.67% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Orca DEX — SOL / USDC liquidity pool on Solana | Orca DEX (protocol) | 52.86% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Uniswap V3 — CLANKER / WETH liquidity pool (1%) on Base | Uniswap V3 (protocol) | 51.88% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
| Uniswap V4 — ETH / USDT liquidity pool (0.30%) on Ethereum | Uniswap V4 (protocol) | 50.78% (30-day average of trading fees, DefiLlama 2026-11-12) | None |
Questions
Can an AI agent trade crypto without a human?+
Yes. On decentralized exchanges and on-chain perp markets such as Hyperliquid an agent trades from a wallet with no person approving each order. At centralized exchanges it trades through an API key on an account a verified person opened.
Can an AI agent open its own exchange account?+
No. Exchanges verify a natural person or a company. The agent gets an API key or a delegated wallet from that owner.
Do AI trading agents make money?+
Not reliably. In Alpha Arena season 1 four of six models lost money with real funds; in a stock benchmark most models did not beat buy-and-hold. Results depend heavily on the strategy, fees and leverage.
How do I stop an agent from emptying my account?+
Give it a key without withdrawal rights, tie the key to the agent’s IP address, or use a smart account with spending limits, allowed contracts and session keys. Limits must sit in the exchange or the contract, not in the prompt.
Is it legal to let an AI trade for me?+
Trading your own money with a bot is generally allowed; trading other people’s money needs a licence. Market-manipulation rules apply to bots as to people.
Who is liable if the agent makes a bad trade?+
The owner of the account or wallet. The exchange and the model provider execute what the owner’s key signed.
- How AI agents invest on their own: who offers agent access →
- Build your own AI trading agent: step-by-step tutorial →
- Are trading bots legit? →
- Are trading bots legal? →
- AI trading bots for stocks →
- Trading bot vs human vs copy trading →
- How a bot buys a yield token, step by step →
- Which investment tokens a bot can buy without a human →
- Agent buying guide: six steps with the call for each →
- TokenBank MCP server →
- What happens to your tokens if an exchange is hacked →
- Uniswap — Swaps (amountOutMinimum, slippage)
- CoW Protocol — MEV protection
- Flashbots Protect — overview
- MEV Blocker
- Hyperliquid — Nonces and API wallets
- Hyperliquid — Exchange endpoint
- dYdX — Permissioned keys
- Binance — How to create API keys
- Kraken — API keys
- Coinbase — API key authentication
- Coinbase — Agentic Wallet
- Safe — Spending limits
- Zodiac Roles Modifier
- ZeroDev — Permissions (session keys)
- ERC-4337
- Protos — Alpha Arena season 1 results
- ForkLog — Alpha Arena season 1.5
- StockBench (arXiv 2510.02209)
- Cointelegraph — Grok and Bankr prompt injection
- OECD AI Incidents Monitor — Grok/Bankrbot
- Decrypt — AIXBT hack
- The Block — Freysa
- Cointelegraph — Banana Gun refunds
- ESMA — MiCA Art. 3 definitions
- ESMA — MiCA Art. 86 market abuse scope
- ESMA — MiCA Art. 91 market manipulation
- ESMA — MiFID II Art. 17 algorithmic trading
- BaFin — Automated advice and trading systems
- BaFin — Own-account dealing
- CFTC — Staff advisory on AI (Dec 2024)
- CFTC — AI won’t turn trading bots into money machines
- SEC — AI washing charges (Mar 2024)
- SEC — LR-26558 (May 2026)
- IRS — Virtual currency FAQ
- HMRC — CRYPTO22100
- § 23 EStG
- BaFin — Warning on AI trading-bot websites (Feb 2025)
- BaFin — AI and crypto fraud warning (Jan 2026)
- FCA — Ai Trader Bot warning
This guide explains how these products work and is not investment advice or an offer of any security. Who may buy a product is set by its issuer; check the offering documents before investing.