The bottom line: the "custody risk" to fear after FTX splits into two layers for lending. The first is the bot's custody structure — is it "API-authorized, principal stays in your account" (non-custodial), or "transfer your coins to us to hold" (custodial)? Only the latter carries the FTX-style "they take your money, misuse it, then run" risk. The second is the exchange's own counterparty risk — even with a non-custodial bot, your money still sits on the exchange. Non-custodial removes the first layer (the bot operator can't run off with your principal); it doesn't remove the second (you still trust the exchange you chose). Separate the two layers and you'll know what you're actually afraid of, and what to guard against.
What actually sank FTX? — "custody + misappropriation"
FTX's core problem: it held customers' money and then used it for other things (lending to affiliated firms, investing it). When customers tried to withdraw, the money wasn't there. That's classic custodial risk — you hand control of your assets to a counterparty that has the ability to move your money, and you can only trust it not to misbehave. The moment it misbehaves or fails, your principal is gone.
The two custody structures of lending bots
| Structure | Where principal sits | What the bot can do | Runaway risk |
|---|---|---|---|
| Non-custodial (API only) | Stays in your own exchange account | Only lend/cancel per API permissions, cannot withdraw | Operator can't touch your principal |
| Custodial (transfer coins to them) | Moved to a wallet/account they control | Full control of your assets | Can misappropriate, can run (FTX model) |
The fastest way to tell which one a service is: does it ask you to "set up an API key" or to "transfer coins to an address"? The former is non-custodial; the latter demands extreme caution. Further reading: how to set up a lend-only API key safely.
Honest take: non-custodial ≠ zero risk
Many marketing pieces gloss over this. A non-custodial bot removes the "bot operator absconds with funds" layer, but your money still sits on the exchange — for Bitfinex lending, your principal is always in your Bitfinex account. So you still bear:
- Exchange counterparty risk: you must trust Bitfinex's own operation and solvency. That's a risk you accepted when you chose which exchange to lend on — nothing to do with the bot.
- Borrower default risk: Bitfinex funding uses over-collateralization plus auto-liquidation to protect lenders, but extreme conditions leave residual risk (that's Bitfinex's mechanism, not the bot's).
- API key theft risk: which is why "lend-only, no-withdrawal" permission matters — even if the key leaks, no one can pull your coins out.
In other words: a non-custodial bot means you only need to trust "the exchange you already chose," and you don't have to add trust in a separate bot operator. It eliminates "one extra layer of possible absconding" — exactly the layer the FTX lesson most warns against.
How do you confirm a service is genuinely non-custodial?
- Check the permissions it asks for: a legitimate lending service needs only "funding/lending" API permissions and should never ask for withdraw permission.
- Check whether it asks you to transfer coins: if it wants you to move assets to its address = custodial, eliminate it.
- Check whether the operating entity is verifiable: is there a verifiable company registration and operating history? For the full set of criteria, see 5 criteria for choosing a service that lasts.
Non-custodial lending services on the market include EarnUSD, Cryptolend, Altinvest, and Coinlend (Coinlend GmbH in Germany). They all use API authorization and never touch your principal; they differ in fee model, capture speed, and verifiability.
EarnUSD's custody stance
EarnUSD is non-custodial — it runs through a lend-only, no-withdrawal Bitfinex API, so your principal stays in your own Bitfinex account the whole time and EarnUSD technically can't pull your money out. The operating entity is JIAJI Co., Ltd., Taiwan business number 54255401, registered in 2013 and verifiable on Taiwan's official company registry. To see the real performance record of actual operation, check the continuously updated lending performance log.
Conclusion
FTX didn't teach us "never touch crypto" — it taught us "don't needlessly hand asset control to one extra middleman." For lending, non-custodial (API-only, principal stays in your account) removes that surplus layer of trust: you only need to trust the exchange you already chose, not also bet on whether a bot operator will run. Remember two checks to dodge FTX-style risk: confirm the service needs only API permission (no withdraw permission), and confirm it doesn't ask you to transfer coins over. To further tell real automation from a Ponzi pitch by its structural red lines, see this article.