Good practices for trading agents.

The rating is our judgement of what skipping a practice can cost, not a measured figure. Open a question for the answer and the sources behind it.

Critical

Skipping it can empty the wallet in one transaction.

High

Skipping it can lose a large part of a trade or let a harmful action through.

Medium

Skipping it makes losses larger or slower to catch.

Decide what the agent can lose before it makes its first trade.

• Why give each agent its own wallet?

  Risk: Critical

  A shared wallet puts everything in it within reach of one bad decision. Give each agent a wallet of its own, holding only what its task needs, so a runaway loop, a bad swap or a hijacked prompt can lose that amount and no more. Top it up from a wallet the agent can’t touch.

  Evidence

  • Halborn, AI agent wallet key management. Recommends building key infrastructure for agent fleets on least privilege, to limit the damage from a compromised key or agent.halborn.com
  • NIST SP 800-207, Zero Trust Architecture. The zero trust model, which grants no implicit trust to any account or asset.csrc.nist.gov

• Why must an agent never see my seed phrase or main private key?

  Risk: Critical

  Anything in a model’s context, memory or environment can leak, through a prompt injection, a log or an error message. A seed phrase that leaks gives the attacker the whole account, for good. Keep main keys offline or in a multisig, and give agents only limited keys you can revoke.

  Evidence

  • OWASP Top 10 for LLM Applications 2025. Lists Sensitive Information Disclosure (LLM02), Excessive Agency (LLM06) and System Prompt Leakage (LLM07) among the main risks of LLM applications.genai.owasp.org
  • Embrace The Red, data exfiltration via images. Shows prompt injection making an AI coding agent leak data from its context window through image rendering, with no click needed.embracethered.com
  • Simon Willison, exfiltration attacks. A running record of prompt injection attacks that make chatbots with access to private information send it out.simonwillison.net

• Where should an agent’s signing key live?

  Risk: Critical

  Not in a .env file, a shell variable, a database row or a prompt. Keep it in a key management service, a hardware security module or a secure enclave, where it can’t be exported. The agent asks for a transaction to be signed and gets back a signature; it never holds the key.

  Evidence

  • AWS KMS, data protection. Keys are held in FIPS 140-3 Security Level 3 validated hardware security modules, and plaintext key material never leaves the HSM boundary.docs.aws.amazon.com
  • Turnkey. Agent wallets that sign inside secure enclaves, with keys and spending policies kept inside the enclave.turnkey.com
  • GitGuardian. Reports more than 28.6 million new secrets leaked on public GitHub in 2025: keys in files and code get out.gitguardian.com

• How can a smart account limit what an agent spends?

  Risk: High

  A plain wallet key can send everything, anywhere. A smart account can give the agent a session key with rules the account checks on every transaction: a spending cap, the tokens and contracts it may use, and an expiry. A prompt can talk a model into anything, but not the account out of its rules.

  Evidence

  • ERC-4337, account abstraction. The standard in which a smart account runs its own validation (validateUserOp) on every operation before it executes.eips.ethereum.org
  • ZeroDev, session keys. Examples of scoped keys: one that can only use Uniswap, one capped at 1,000 USDC, one that expires in 3 days.docs.zerodev.app
  • Biconomy, Smart Sessions policies. Session policies that limit which functions can be called, the amount per transaction and how long the session is valid.docs.biconomy.io

Check what a transaction will do before it is signed, and build it in code the model can’t rewrite.

• Why are unlimited token approvals dangerous?

  Risk: Critical

  An unlimited approval lets a contract take every token of that kind from the wallet, now and later, with no further signature. If that contract has a bug or is an impostor, the approval is how the funds leave. Approve the exact amount for each trade, prefer approvals that expire, and revoke the ones you no longer use.

  Evidence

  • The Block, Socket exploit, January 2024. At least $3.3 million was taken from wallets with infinite approvals to Socket’s contracts.theblock.co
  • Rekt, BadgerDAO, December 2021. About $120 million was taken after an attacker inserted extra approvals that sent users’ tokens to the attacker’s address.rekt.news
  • Uniswap Permit2. Time-bound approvals that remove the risk of approvals hanging over a wallet’s entire token balance.github.com
  • Revoke.cash. A tool to inspect and revoke token approvals.revoke.cash

• Why simulate a transaction before signing it?

  Risk: High

  A model’s description of a transaction is not the transaction. Simulating it against the chain’s current state shows what it will actually do: which balances change, whether it fails, and any transfer you didn’t expect. Sign only when the result matches what you meant.

  Evidence

  • Ethereum JSON-RPC API, eth_call. The standard call that “executes a new message call immediately without creating a transaction on the blockchain”, the basis of a dry run.ethereum.org
  • Tenderly. A simulation service that previews a transaction against the live chain state and shows the resulting state changes.tenderly.co

• How do I protect trades from sandwich attacks?

  Risk: Medium

  A swap sent to the public mempool can be seen before it lands, and bots can trade just before and after it at your expense. Send swaps through a private RPC that keeps them out of the public mempool, and set a tight slippage limit in the transaction itself, so a bad price makes it fail rather than fill.

  Evidence

  • Flashbots Protect overview. Transactions go to a private mempool where they are “hidden from frontrunning and sandwich bots”, and users don’t pay fees for failed transactions.docs.flashbots.net
  • MEV Blocker. A private RPC offering protection from front-running and sandwich attacks, which returns part of the back-running profit to the user.mevblocker.io
  • Daian et al., “Flash Boys 2.0”. The study that documented bots front-running and reordering trades on decentralized exchanges.arxiv.org

• Why should code, not the model, build the transaction?

  Risk: High

  Models make mistakes with long hex strings and encoded parameters, and a model that writes raw transaction data can be steered into writing an attacker’s. Have the model output a small typed request, such as token, amount and maximum slippage. Validate it, then let tested code build the transaction.

  Evidence

  • OWASP Top 10 for LLM Applications 2025. Lists Improper Output Handling (LLM05) and Excessive Agency (LLM06): acting on model output without validation, and giving a model more power than its task needs.genai.owasp.org
  • Coinbase AgentKit README. An agent toolkit where each on-chain action’s inputs are defined by a typed schema (zod).github.com

Everything an agent reads can carry an attack: web pages, posts, token names, even its own transaction history.

• What is indirect prompt injection?

  Risk: Critical

  It is an instruction hidden in something the agent reads: a web page, a post, an API response, a token description. A model reads instructions and data in the same stream, so it can follow the attacker’s text as if you had written it. Treat everything an agent reads as untrusted, and never let text it read authorize a payment on its own.

  Evidence

  • Greshake et al., “Not what you’ve signed up for”. The paper that showed attackers can exploit LLM-integrated apps remotely by planting prompts in data the app is likely to retrieve.arxiv.org
  • OECD.AI incident record, 4 May 2026. An encoded reply led Grok to have Bankr’s bot send 3 billion DRB tokens, worth about $150,000–$200,000.oecd.ai
  • Giskard, “How Grok got prompt-injected”. A breakdown of the same incident, in which an X user got about $150,000 in DRB tokens sent from an AI wallet.giskard.ai
  • The Block, “Human player outwits Freysa AI agent”. A player won the Freysa agent’s prize pool of about $47,000 by persuading it that its approveTransfer function was for incoming funds.theblock.co

• Can things sent to the agent’s wallet attack it?

  Risk: High

  Yes. Anyone can send your wallet a token, an NFT or a transaction, and whatever its name, metadata or memo says, an agent that reads its own wallet reads that too. Show the model only tokens you recognise, treat every name and memo as untrusted, and never let something that arrived in the wallet change what the agent may do.

  Evidence

  • Giskard, “How Grok got prompt-injected”. In the Grok and Bankr case, the attacker first sent an NFT that gave the Grok agent “Executive” permissions in the Bankr system.giskard.ai
  • NIST, “Strengthening AI agent hijacking evaluations”. Describes agent hijacking: malicious instructions inserted into data an agent ingests, causing it to take unintended, harmful actions.nist.gov

• What is address poisoning, and why are agents exposed to it?

  Risk: Critical

  A scammer creates an address that starts and ends like one you use, then sends a tiny or zero-value transfer so it appears in your history. Anyone who copies an address from history, or compares only the first and last characters, can pay the scammer instead. Agents should pay only addresses on a fixed allowlist, compared in full.

  Evidence

  • CoinDesk, 3 May 2024. A victim sent 1,155 WBTC, about $68 million, to a look-alike address after a small mimicking transaction.coindesk.com
  • Chainalysis, address poisoning. Explains the scam and notes the $68 million WBTC loss, which the attacker later returned.chainalysis.com
  • MetaMask Support, address poisoning scams. Advises against copying addresses from transaction history and recommends an address book for addresses you use often.support.metamask.io

• How do honeypot tokens trap trading bots?

  Risk: High

  A honeypot token lets anyone buy but stops almost everyone from selling, through a blacklist, a sell tax near 100% or hidden owner controls. Bots that chase fast-moving prices are easy targets. Before buying, check the contract with a token security scanner and simulate both the buy and the sell.

  Evidence

  • CertiK, honeypot scams. Explains how honeypot token contracts stop holders from selling, the blacklist being the most basic form.certik.com
  • GoPlus Security API, response details. A token security API with an is_honeypot flag for tokens that may not be sellable because of the contract’s own code.docs.gopluslabs.io

• When should an agent get a second opinion before acting?

  Risk: High

  Rules handle what can be measured: amounts, addresses, contracts. They can’t tell whether a message is a scam or whether an instruction really came from you. For a costly, irreversible action that passes your rules but still needs judgement, ask for an independent second opinion, from a model that didn’t propose the action. It adds to your rules; it doesn’t replace them.

  Where SECONDED fits: it gives that second opinion. A model from OpenAI and a model from Anthropic answer blind; only an answer both give is delivered, and anything else is NOT VERIFIED and free, up to 5 per wallet in any 24 hours. Agreement is strong evidence, not proof. What a check is, and isn’t.

  Evidence

  • Cequence, encoded prompt injection and the action layer. Argues the Grok and Bankr loss happened at the next hop, the action layer, where no rule checked the transfer: the case for putting rules first.cequence.ai
  • Verga et al., “Replacing judges with juries”. A panel of models from disjoint model families showed less intra-model bias than a single judge model. It measured evaluation, not attacks.arxiv.org

Test it, start small, watch it and keep a way to stop it that doesn’t depend on the agent.

• Why test on a testnet first?

  Risk: Medium

  Backtests can’t show how the whole system behaves live: slow or failing RPCs, gas spikes, failed transactions, trades that land late. Run the complete agent, signing included, on a testnet such as Sepolia or Base Sepolia, and test against a fork of mainnet for real liquidity. Move to mainnet only once it handles failures cleanly.

  Evidence

  • Foundry. Fork mainnet with Anvil and test against live chain state.getfoundry.sh
  • Base docs, deploy smart contracts. Uses Base Sepolia, Base’s test network, throughout its deployment guide.docs.base.org
  • SEC order on Knight Capital, 2013. A faulty software deployment led to over 4 million unintended executions in about 45 minutes and a loss of over $460 million.sec.gov

• How much should a new agent start with?

  Risk: Medium

  An amount you are fully prepared to lose. Add more only after the agent has run cleanly for a set period or number of trades; early profit is not a reason to scale, a clean record is. A small balance turns an unknown bug into a small loss.

  Evidence

  No source we checked supports a specific amount or schedule, so none is cited. This one is our own guidance.

• What should I monitor?

  Risk: Medium

  Every transaction the agent sends, plus balance drops, unusual gas, bursts of trades and runs of failed transactions. Send alerts somewhere a person will see them quickly. Monitoring doesn’t prevent a loss, but it shortens how long one runs.

  Evidence

  • OpenZeppelin docs, Monitor. Monitor on-chain activity in real time, detect anomalies and send alerts to the channels you choose.docs.openzeppelin.com
  • Alchemy docs, webhooks. Get notified of transfers, transactions and balance changes.alchemy.com
  • NIST Cybersecurity Framework 2.0. Continuous Monitoring (DE.CM): assets are monitored to find anomalies and signs of compromise.nvlpubs.nist.gov

• How do I stop an agent that is misbehaving?

  Risk: High

  Keep a way to cut the agent off that doesn’t depend on the agent: revoke its session key, pause the contract it trades through with a guardian key, or move the funds with a key it never had. Trigger it automatically on clear danger signs, such as losing more than a set share of the balance in an hour, and test it before you need it.

  Evidence

  • OpenZeppelin Contracts, Pausable. “A common emergency response mechanism that can pause functionality while a remediation is pending.”docs.openzeppelin.com
  • SEC market access rule 15c3-5, 2010. Requires broker-dealers with market access to have controls that block orders above pre-set credit or capital thresholds, or that look erroneous. A rule for brokers, not agents, but the same idea.sec.gov
  • EU AI Act, Article 14. For high-risk AI systems, people overseeing them must be able to interrupt the system with a “stop” button or a similar procedure.artificialintelligenceact.eu

• Why cap how often an agent can trade?

  Risk: High

  A bug or a reasoning loop can make an agent send transaction after transaction, losing money on each or spending the balance on gas. Enforce a maximum number of trades per hour and a pause between them in code the model doesn’t control, and in the smart account’s session key policy where you can.

  Evidence

  • SEC order on Knight Capital, 2013. Knight’s system sent orders without regard to executions already received: over 4 million executions in 45 minutes and a loss of over $460 million.sec.gov
  • ZeroDev, rate limit policy. A session key policy that allows one operation per interval, up to a set count.docs.zerodev.app
  • Microsoft, Circuit Breaker pattern. Stops repeated calls to a failing resource so one fault doesn’t cascade.learn.microsoft.com