Skip to main content
In short: a venue is an exchange outside your account, such as Binance, Hyperliquid or Lighter. You connect one, set limits on it, and the agent places orders there inside those limits. The agent cannot withdraw to an address of its own on any venue. It can still lose money by trading badly inside the limits you set. You can cut it off from your own wallet or from the venue itself, and this page says how for each one. Everything else on these docs is about money in your own account. A venue is different. While money sits at a venue, it is under that venue’s rules as well as ours.

​
What is live now

Binance is not live with real money. The Binance page in the app trades play money on Binance’s demo exchange. Do not send real funds to it. Real-money trading is coming soon. The Binance section says what is built, what runs today and what changes then.

​
How connecting works

Every venue follows the same five steps. The details differ, and each venue page lists them.
  1. A key is derived inside the enclave. The enclave holds one sealed secret per venue. It derives each trading key from that secret for your account, so no key is stored anywhere. You and we only ever see its public half.
  2. You sign a lock with your wallet. The lock is a short record on a network. It says which markets the venue may trade for you and the highest leverage. For Hyperliquid it also caps the money that may go to the venue.
  3. The key is accepted by the venue. On Binance you paste the public key into Binance and tick trade permissions only. On Lighter your account registers the key. On Hyperliquid the key connects itself after your first deposit.
  4. You sign a grant (Binance and Lighter). A grant names the exact markets, the size limits, the number of runs and an expiry of at most 90 days. Signing and switching a grant on is called arming in the app. Switching it off is called revoking. Hyperliquid has no grant: its bounds are the lock and your account’s own limits.
  5. You fund it. Binance holds your money in your own Binance account, so you deposit there as usual. Hyperliquid and Lighter take USDC from your account, on chain, and only into your own account at the venue.
Our fee payer sends the lock for you. You pay no gas for it.

​
Who holds which key

The trading key never exists outside the enclave. It is not in a database, a file, your browser or our servers. If the enclave restarts, operators must hand it the sealed secret again. Until they do, orders on venues are refused. Exits that you sign from your own wallet do not depend on this.

​
What the enclave enforces

The enclave is an isolated part of a cloud machine (AWS Nitro). Even the operators of that machine cannot read its memory. Keys are released only to code whose fingerprint matches a build we approved. The enclave checks these rules itself, before anything leaves it:
  • Your signature covers the order. It places an order only if a grant you signed with your wallet covers it. Our servers pass requests along. They carry no authority.
  • The lock holds. An order that opens or adds to a position in a market outside the lock is refused, whatever a grant says. A grant can only narrow the lock.
  • The key is trade-only. On Binance it refuses a key that can withdraw or transfer. On real money it also refuses a key with no IP restriction. Binance enforces which addresses the key accepts.
  • Money goes nowhere new. A withdrawal from Lighter pays your own account. Hyperliquid deposits go only to your account’s own Hyperliquid account.
  • Exits are always allowed. A cancel and a reduce-only close need no grant. They work after a grant expires and after you revoke it.
  • A retry is safe. Order ids are derived from the grant and the run, so a repeat never doubles an order. On Binance, an order is never placed late: a run that cannot be sent within 10 minutes is dropped.

​
What the agent can and cannot do on a venue

It can

Place orders in the markets your lock allows. Cancel orders. Close a position with a reduce-only order. Set leverage up to your ceiling. Fire a grant you signed, until it expires.

It cannot

Withdraw to an address of its own. Open or add to a position in a market your lock leaves off. Go above your leverage ceiling. Raise your limits. Act after a grant expires. Make itself the owner.
It can lose money. A trade-only key can still lose value through bad fills inside your limits. The limits bound the loss. Nothing removes it.
With a grant that has no condition, our system decides when it fires. It can fire at any moment before the grant expires, bounded only by your limits and the number of runs. If you want the enclave itself to check the trigger, pick a price level or, on Binance, a schedule.

​
What a breach on our side could and could not do

Our operators can change which enclave build may open the keys. That is a process we run, and it is not a cryptographic guarantee. A rogue operator with the right cloud access could approve a bad build. A change to the key’s release rule raises an alert, so we would see it. We cannot say a bad build would be impossible. The venue-specific worst cases, in full:
  • Binance: a bad build can trade your whole Binance balance badly, in any market and at any leverage the API key’s permissions allow. It cannot withdraw, because your key has no withdrawal permission and Binance enforces that.
  • Hyperliquid: a bad build can place orders in BTC and ETH inside your lock’s price band and leverage ceiling. Losses stay bounded by the cap you signed. It cannot send money to anyone.
  • Lighter: a bad build can move your account’s USDC into your own Lighter account, up to your daily limit for USDC if you set one and all of it if you did not, and trade it badly there. It can send money nowhere but your own accounts. The lock bounds what it signs on Lighter. It does not bound deposits into Lighter.

​
Taking control back

The lock is the venue lock. Revoking it, or setting it to no markets, stops all new orders on that venue. Closes and cancels still work.

​
Stops and protective orders

What is live:
  • Cancel and close, any time. On Binance you can cancel an open order and place a reduce-only close from the app, with no grant. On Lighter the same exits exist, and the exit kit sends them from your own wallet. On Hyperliquid the close, cancel and withdraw steps run even while our kill switch is on.
  • Two ways to stop a card on Binance or Lighter. Close mode: no new entries, and take-profit and stop-loss orders stay until the position is closed. Cancel all: no new entries, and the card’s open orders are cancelled, take-profit and stop-loss included. Our kill switch uses cancel all.
  • A sweep checks every 15 seconds for protective orders of cards stopped in cancel-all mode or halted by our kill switch, and cancels them. Close mode keeps them. If it cannot read a card’s state, it cancels nothing that round.
  • Binance futures take-profit and stop-loss, paused. Setting them is refused until the sync of your fills is switched on, which ships with a coming update. Legs set earlier stay, and you can cancel them. Each leg is a reduce-only exit sized to the card’s own share of the position, never the whole account. Spot has none. Details.
What is not live:
  • Setting, moving or cancelling take-profit and stop-loss on a Hyperliquid position that is already open.
  • Take-profit and stop-loss orders on Lighter.
  • Binance spot take-profit and stop-loss, and one-cancels-the-other orders.

​
Under the hood

For readers who want the mechanism.
  • Two models. Binance and Lighter orders are signed by a trading key inside the enclave, as the fire of a grant you signed. Hyperliquid orders are on chain: your account queues them through an approved operation. The trading key there only sets leverage.
  • The grant is an EIP-712 message signed by your wallet. It lasts at most 90 days. The enclave verifies it on every fire.
  • The lock is a contract on MegaETH for Binance and Lighter, and on HyperEVM for Hyperliquid. The write needs your signature and a receipt from the enclave for the key it binds. So our servers cannot bind a key of their own.
  • One enclave. All venues use the same hardware enclave as the agent’s own signing. For each venue, the enclave holds one secret, sealed with the cloud’s key service to approved enclave fingerprints. Each trading key is derived from that secret for one owner, one account and a key number. Nothing per key is stored.
  • Market data does not come from the venue’s account. It goes through the feed runtime. See data streams.
  • Networks. Binance has no network of its own. Hyperliquid runs on HyperEVM, Lighter on Ethereum, and locks are written on MegaETH or HyperEVM. Networks shows what runs where.
  • New on-chain operations on a venue follow the 3-day delay described on the contracts.