Most of the money lost in this industry was never lost on a chart. It was lost at the moment of transfer — when someone sent their capital to a platform, a "manager", a wallet address, and simply trusted that it would come back. The question that matters before performance, before strategy, before anything, is mundane and decisive: who can physically move your money? With URIEL, the answer is a technical fact rather than a promise. Your funds sit on your own Bybit or Binance account, in your name. URIEL connects through a trade-only API key — a credential that can place and close orders and literally cannot initiate a withdrawal. This article explains what that key is, what the exchange permits it to do, what it structurally forbids, and how to verify all of it yourself in a few minutes.
- Your capital never leaves your exchange account: URIEL trades on it, it never custodies it.
- A trade-only API key carries no withdrawal permission — the restriction is enforced by the exchange, not by URIEL's goodwill.
- You revoke access in one click by deleting the key; open positions remain yours to manage.
- Verified figures as of 2026-10-31: realized return since the start of 2026 +41.4% (closed trades, before the 25% fee); positions still open: 11, unrealized −$8,651 (−21.7% of capital). Past performance does not guarantee future results.
What an API key actually is
An API key is a pair of credentials — a public key and a secret — that an exchange issues to let an external program interact with your account without using your password or your two-factor code. It is not a login. It is a narrow, permissioned door, and you decide how wide to open it.
Exchanges like Bybit and Binance split those permissions into categories. Read: see balances, positions, order history. Trade (sometimes labelled "Spot & Margin Trading" or "Contract Trading"): place, modify and cancel orders. Withdraw: send assets off the account to an external address. Those are distinct switches. A key created without the withdrawal permission cannot acquire it later; the permission set is bound to the key at creation and can only be changed by you, from inside your logged-in account, with your own authentication.
URIEL asks for read and trade. Never withdraw. If a request for withdrawal permission ever appeared on your screen in URIEL's name, it would not be URIEL — and the correct reaction would be to stop and contact us.
Why this is enforcement, not etiquette
The distinction people miss is where the restriction lives. It does not live in URIEL's code, where we could change it. It lives on the exchange's servers. When a withdrawal request arrives signed by a trade-only key, the exchange rejects it before anything happens — the same way a hotel key card that opens room 412 simply does not open the safe in the lobby. There is no override. We are not asking you to believe we would never try; we are pointing out that the attempt returns an error.
The safest promise is the one that doesn't depend on anyone keeping it. A trade-only key is enforced by your exchange, not by our intentions.
What URIEL can do with your key — precisely
Transparency means being specific about the powers granted, not only the ones withheld. With a read-and-trade key on your account, URIEL can:
- See your balance and open positions, in order to size trades proportionally to your capital.
- Open and close positions on the instruments the strategy trades (currently ETH and BTC).
- Set and adjust stop-loss and take-profit orders attached to those positions.
- Cancel orders it has placed.
- Read the trade history of the account to reconcile execution with the strategy account.
That is a real power and we do not minimise it. Someone trading your account can lose money on it. What they cannot do is take it. The failure mode of discretionary copy-trading is market loss, which is visible, measurable and bounded by the strategy's own risk management — not disappearance, which is not.
What the key cannot do, in any circumstance
- Withdraw crypto or fiat to any address, internal or external.
- Create a new API key, or modify the permissions of the existing one.
- Change your email, password, 2FA, or any security setting.
- Enable transfers to sub-accounts or to another user ID.
- Log into your exchange account through the normal interface.
Many exchanges add a second layer: IP whitelisting. You can restrict a key so that it only functions from specific, declared IP addresses. If the key leaked, it would be inert from anywhere else. We recommend it, and we provide the addresses to whitelist.
The one-click exit
Control is not real if leaving is complicated. On Bybit and Binance, deleting an API key takes seconds: you open the API management page, find the key, delete it, confirm with your 2FA. From that instant URIEL's connection is dead — not suspended, not pending review. Dead. No email to send, no notice period, no "please allow 30 days", no form.
What remains is yours. Any positions open at that moment stay on your account exactly as they were, with their stops and targets in place. You can close them yourself, leave them to run, or ask us what the strategy intends to do with the corresponding positions so you can decide knowingly. Nothing is locked, because nothing was ever transferred.
This is the operational meaning of our signature. You stay in control. Not as a slogan about empowerment — as a description of who holds the keys to the account.
Why custody is the industry's real fault line
Look at the way retail investors have lost money in crypto over the past decade and a pattern emerges. The catastrophic losses — the ones that wiped out everything at once — overwhelmingly involved custody: funds sent to a platform that became insolvent, a "fund manager" who vanished, an exchange that commingled client assets. The losses that were painful but survivable were market losses on accounts people still owned.
Non-custodial copy-trading removes an entire category of risk from the table. It does not remove market risk — we are explicit about that below. But it means that the worst day URIEL could ever have is a trading day, not a counterparty event. Your exchange holds your assets. Your identity is on the account. Your bank details are linked to it. You withdraw to your own wallet, at any time, without asking anyone, including us.
The fee model follows the same logic
We charge one thing: 25% of a month's realized gains, and only those. No management fee, no subscription, no onboarding charge. A month that produces no realized gain costs nothing. We do not debit your account — the structure of the key makes that impossible anyway. The fee is settled separately, and it is the only payment that ever exists between us. Starting capital begins at $1,000.
Clients who introduce others earn 5% to 15% of the fees those people pay, for as long as they remain clients. That too is a flow of fees, never a flow of capital out of anyone's account.
What transparency looks like when custody is off the table
Because URIEL never holds funds, the only thing we can be judged on is execution — so we publish it. The public performance page shows every closed trade and every position still open, with its current result, losing ones included.
As of 2026-10-31, on the URIEL strategy account: realized return since the start of 2026 is +41.4% (closed trades only, time-weighted, net of trading costs, before the 25% fee). Month by month, realized: April +0.2%, May +8.4%, June +1.8%, July +2.0%, August +8.7%, September +10.3%, October month to date +4.6%. Since January, 371 trades have been closed, 95% of them in profit. Over the last 7 days, 7 trades closed, all in profit, for a realized +$484, or +1.2% of the capital; the best was an ETH long entered at 2351.39 and exited at 2383.73, +1.4% (+$91).
And the other side of the ledger, which belongs in the same breath: there are 11 positions still open right now, on ETH and BTC, carrying an unrealized result of −$8,651, equal to −21.7% of the capital. That number is not included in the realized return. It is live, it moves every hour, and it could close better or worse than it stands today. Publishing it is the point. Past performance does not guarantee future results.
A trade-only key protects your custody. It does not protect your capital from the market. URIEL practises discretionary copy-trading on volatile crypto assets: positions can and do move against the strategy, as the −$8,651 unrealized figure above shows plainly. You can lose part or all of your capital. A high share of winning closed trades says nothing about what open positions will eventually do, and nothing about tomorrow. Your own result will also differ from the strategy account's, because it depends on when you start, how much you commit, and the 25% fee on realized gains. This is why we ask for a 12-month minimum horizon — anything shorter is a bet on timing, not on a process.
Setting up a key properly: the short checklist
- Create the key from your own logged-in exchange account — never from a link someone sent you, and never by sharing your login.
- Grant read and trade permissions only. Leave withdrawal unchecked; verify the summary screen before confirming.
- Enable IP whitelisting with the addresses we provide, if your exchange supports it for your key type.
- Keep your 2FA active and your secret key private — URIEL needs it once, at connection, and you should store your own copy securely.
- Re-check the permissions on the key a week later, from the API management page. It takes thirty seconds and it is a good habit.
- Know where the delete button is before you need it.
If any step feels unclear, that is a reason to slow down, not to proceed faster. Infrastructure you do not understand is infrastructure you cannot control.
Can URIEL withdraw my funds if something goes wrong?
No. The API key we use carries no withdrawal permission, and the exchange enforces that at its own level. A withdrawal request signed with that key is rejected before execution. Only you, logged into your account with your own credentials and 2FA, can move funds off it.
What happens to my open positions if I delete the key?
They stay on your account, untouched, with any stop-loss and take-profit orders already in place. URIEL simply loses the ability to act on them. You decide whether to close them, hold them, or ask us what the strategy plans to do with the equivalent positions.
Does URIEL see my personal information or other balances?
The key grants read access to the account it was created on — balances, positions, trade history — which is needed to size trades correctly. It gives no access to your identity documents, your login, your security settings, or any account the key was not issued for.
Will my results match the published figures?
No, and we never suggest they will. Your result depends on your start date, your capital, and the 25% fee on realized gains. The published numbers are those of the URIEL strategy account, dated 2026-10-31, and include both realized performance and the current unrealized result on open positions.
What if the API key leaks?
A leaked trade-only key still cannot withdraw anything — that is the structural protection. To reduce the residual risk of unwanted trading, use IP whitelisting where available, and delete and recreate the key immediately if you have any doubt. Deletion is instant.
Why a 12-month minimum horizon?
Because the strategy's realized months have varied widely — from +0.2% to +10.3% in 2026 — and open positions can sit underwater for a long time before resolving. Judging a process over weeks measures noise. Twelve months is the shortest window in which the results mean something.