Wallets, backups, and recovery

Choose custody when adding a walletCopy Anchor Link

Password encrypted (default): your browser generates or imports the wallet and encrypts it with your wallet password. Our database stores the encrypted Ethereum V3 keystore. The password is never sent to the server. We cannot recover your wallet password or a lost recovery phrase from this encrypted backup. Resetting your login password does not recover your wallet. Keep the downloaded backup and its password separately.

Managed: no wallet password is required for a new wallet. You explicitly authorize platform operators to access and recover its key for support, including while the wallet is locked. This is custodial access and permits moving funds. Keys are encrypted at rest with a separate server custody key; they are not plaintext database columns. Both the database and that server key are required for recovery. Losing both your own export and the platform recovery key can still make funds unrecoverable.

An imported encrypted backup still needs its original password to decrypt in the browser, even when registering it as managed. Custody is fixed at registration; existing encrypted wallets are not silently converted.

Export your key or recovery phraseCopy Anchor Link

Open Account → Wallets → Export key / recovery phrase. An authenticated owner session is required; trading API keys cannot export wallets.

For encrypted wallets, enter the wallet password. Decryption and the plaintext download happen in a browser Web Worker. For managed wallets, the server records an access event before decrypting the managed key and returning it to the owner over HTTPS.

The download includes the address, private key, and recovery phrase when the wallet has one. Private-key-only imports do not have a recovery phrase; the application never fabricates one. Anyone with these secrets can spend the wallet's funds. Keep exports offline and out of shared storage.

Encrypted wallets also have an Encrypted backup button. To decrypt a downloaded backup without signing in, open Wallet tools. File and password processing stays in your browser. Imported V3 files may not contain mnemonic metadata; the private key remains exportable.

Unlocking automated tradingCopy Anchor Link

Encrypted wallet decryption happens locally. Unlocking explicitly sends the signing key over HTTPS to an isolated backend worker, which holds it in memory. Managed unlock recovers the key server-side, records an access event, and sends it directly to that worker.

While unlocked, server operators could access a signing key in process memory. This is not zero-access or hardware-isolated custody. Locking/restarting clears the application's signer reference; JavaScript cannot guarantee physical erasure of every memory copy. Keys are not placed in URLs, cookies, localStorage, command journals, or logs.

Workers preserve copy on/off state and protection settings across restarts. With an explicit unattended-signing grant they restore signing automatically; without a grant they remain locked. Managed custody alone is not the same as an unattended grant.

Managed support accessCopy Anchor Link

Access history shows the latest 50 recorded owner exports/unlocks and operator recovery attempts. Routine support should use public addresses and redacted logs. Key recovery is a separate operator-only CLI requiring a support ticket/reason, privileged database credentials, and the custody encryption key. It records access before decryption and writes only to a new permission-restricted file; there is no public staff key-download endpoint.

This application-level audit cannot stop a database or server administrator from bypassing application code. Production operation also needs restricted infrastructure access and external access logging. Encrypted wallets have no managed recovery envelope.

Continuous automationCopy Anchor Link

In Trading access, enable Keep automation running across restarts once. An independent server-encrypted signing key is saved for this authorization. Workers can then restart and resume the saved running/stopped state without your browser or another password entry. Enabling access does not itself start a stopped strategy.

This changes the key-access model even for a password-encrypted wallet: the platform can sign through its stored automation authorization. Your wallet password remains unrecoverable, but it would be inaccurate to claim the platform has no recoverable signing key while this grant is enabled. Disable automatic unlock to delete the saved grant. Current in-memory trading is unchanged until you stop/lock it; revocation is not an on-chain cancellation.

Our database stores settings, pending intents, copy mappings and protection peaks. Graceful restart waits for work to finish and checkpoints state. A hard crash can lose recent unsaved observations between five-second checkpoints, and no worker can execute stops during downtime. On-chain positions remain on-chain; restored live PnL comes from fresh prices rather than an old saved display value.