Non-Custodial Arbitrage Bot: What the Label Does and Does Not Cover

A non-custodial arbitrage bot is one where the software provider does not hold your funds or private keys; you keep control. That reduces one kind of risk, but it does not remove exchange risk, software risk or API-key risk, so the label is a starting question, not an assurance.

What the vendor says

On its Bitcoin arbitrage bot page, CryptoMEV Bot describes the design as non-custodial: the user’s funds stay in their wallet and the company never has access to private keys. The same page describes a three-step flow of connecting a wallet, configuring a strategy and deploying. It also says users need funded BTC and stablecoin accounts on at least two supported exchanges. It does not explain how those two statements fit together in technical detail, such as which keys the software needs for centralised exchanges. That is a question to put to the vendor and to check in its terms.

Custody on exchanges versus in wallets

Cross-exchange arbitrage needs balances where the order books are. Those balances sit on exchanges, which are custodial by nature. A bot that is non-custodial still trades with money held by Binance, Coinbase or Kraken, which means exchange counterparty risk remains yours. The software may avoid holding funds, but your capital is still in somebody’s custody at the moment of trading.

Layer	Who controls it	Risk if it fails
Your own wallet	You	Loss of keys, phishing
Exchange balance	The exchange	Freeze, hack, insolvency
API key	You create it, the bot uses it	Misuse if leaked or over-permissioned
Bot software	The vendor and you	Bugs, wrong parameters

Key takeaway: non-custodial answers “can the vendor take my money?” It does not answer “can I lose it?”

API key hygiene

For exchange-based trading, the single most important protection is the permission set on the API key.

1. Enable trading, disable withdrawals.
2. Restrict the key to specific IP addresses if the exchange supports it.
3. Use a separate key per tool so you can revoke one without disrupting others.
4. Rotate keys periodically and delete unused ones.
5. Never share keys in chat, email or screenshots.

If any software asks for withdrawal permission or your seed phrase, stop. A legitimate arbitrage workflow has no reason to need either for exchange trading.

Questions to ask any vendor

• Where do the keys live: on my machine, in your cloud or both?
• What permissions does the software need on each exchange?
• What data does the company keep about my trades and balances?
• What happens if your service goes down mid-trade?
• Can I run it self-hosted? The vendor lists self-hosted infrastructure under Enterprise, which suggests the retail tier is hosted differently, so ask exactly how.

You can compare the answers using the criteria in bitcoin arbitrage trading software.

On-chain arbitrage is different

Decentralised exchanges and flash loans work with wallets and smart contracts rather than exchange accounts. There, non-custodial has a stricter meaning: the contract executes trades from a wallet you control, with gas fees and the risk of failed or front-run transactions. The vendor covers that world on separate pages such as its DeFi arbitrage bot and Ethereum arbitrage bot pages. We compare it with other bot styles in arbitrage bot versus MEV bot.

What custody does not change

Whatever the custody model, these risks stay: leg failure, slippage, API downtime and the fee drag explained in bitcoin arbitrage risks. Tax and reporting duties also stay with you; see is bitcoin arbitrage legal.

A safe first connection

1. Create a new exchange sub-account if available, funded with a small amount.
2. Create a trade-only, IP-restricted API key.
3. Connect the bot and run a small test following how to test a bitcoin arbitrage bot.
4. Review logs daily for the first week.
5. Increase only after reconciliation matches.

Nothing here is financial advice. Trading carries risk of loss, and vendors’ descriptions should be verified independently.

Reading a non-custodial claim critically

Words like “non-custodial” and “your keys, your coins” are attractive, and they are also easy to print on a page. A useful reading exercise is to ask what would have to be true for the claim to hold in the scenario you care about, then check each part.

For exchange-based Bitcoin arbitrage, funds sit with exchanges, so the claim can only refer to the software. For on-chain strategies, it refers to whether a contract or wallet you control signs the transactions. In both cases, ask whether the vendor’s servers ever see anything that could move your money, such as an API key with withdrawal rights, a seed phrase or a signing key. If the answer is “only a trade-only key”, the exposure is limited to bad trading, which you can cap with size limits. If the answer is “a withdrawal-enabled key”, the exposure is the full balance.

What to do if something looks wrong

1. Revoke the API key at the exchange immediately, before contacting the vendor.
2. Check recent orders and withdrawals on every connected account.
3. Rotate any other credentials that were stored in the same place.
4. Save logs and screenshots with timestamps.
5. Contact the vendor and the exchange support, in writing.
6. Review whether any funds moved, and report if appropriate.

Preparing this plan before connecting anything is cheap. The vendor lists contact details on its site, and the about page describes the company, which you can read as part of your due diligence before you trust any service with access to your accounts. It is also wise to read the Bitcoin arbitrage bot page once more for the exact wording of the custody claim and to compare it with the terms.