Trades on your exchange accounts go through an API key without withdrawal rights: we cannot move money off your exchange. Prizes in USDT, Tour Pass and BUYT are kept on your BuyCrypt balance, and investor tournament money sits on separate Hyperliquid accounts.
You connect your own Binance / Bybit / OKX account through an API key. Your funds stay on your exchange. We never have permission to transfer or withdraw.
Your keys are encrypted at rest, each with its own key. They are decrypted only in memory at the moment of a trade. Never logged. We cannot read or recover them ourselves.
When you create an API key, enable only read and trade permissions. Withdrawal must stay disabled. We physically cannot move funds off your exchange.
For the duration of a tournament, investors' USDC is moved to a separate Hyperliquid account for each trader. The trader trades with a trade-only key held by BuyCrypt and cannot withdraw the money. After the finish the result goes back to the investors' balance. Investor tournament rules
Found a vulnerability? Responsible disclosure to [email protected]. We reply within 24 hours.
