Useful capabilities, with meaningful limitations to understand.
Hummingbot offers deep connector and market-making infrastructure with public code, active releases and unusually clear foundation governance. It is not a managed profit product: users operate the runtime, secure credentials, validate strategies and absorb exchange, dependency and execution risk. Public code and community scale improve inspectability, not proof of security or returns.
Local execution and public code support inspection, but secure deployment, dependencies, connectors and wallet authority remain user responsibilities without a platform-wide independent audit.
Repository, license, releases, bylaws, governance and foundation purpose are public.
The project has a long public release history and visible community process; usage figures remain company-controlled metrics.
CEX and DEX connectors, market making, controllers, scripts and research tooling support advanced workflows.
Docker tooling helps, but strategy configuration, infrastructure and monitoring require technical competence.
The core code is free, while hosting, exchange fees and operational time remain real costs.
Documentation, Discord, governance and issue tracking are active without a conventional commercial service level.
Hummingbot provides strategy infrastructure, not independently verified user-return evidence.
What this score means It evaluates the product and available evidence. It does not predict returns or eliminate trading risk.
Trust profile
Thirteen disclosed factors create the calculated Trust Score.
The Foundation and its role are disclosed in official materials.
Factor score: 88/100Cayman foundation-company structure and bylaws are public; an independent current registry extract was not reviewed.
Factor score: 72/100Governance, board structure and maintainers are visible, though contributor identity varies.
Factor score: 78/100Repository and release history establish multi-year maintenance.
Factor score: 90/100The Apache-2.0 core has no subscription price.
Factor score: 95/100Code and security-relevant deployment documentation are public; no comprehensive independent audit was located.
Factor score: 72/100Connector and credential configuration are documented and executed on user infrastructure.
Factor score: 88/100CEX trading normally does not require withdrawals; DEX connectors have separate wallet authority.
Factor score: 84/100Extensive product, connector, installation and release documentation is public.
Factor score: 96/100Scale metrics are provider-reported and no cross-user performance assurance was located.
Factor score: 48/100Community and issue support are active; response quality was not measured.
Factor score: 76/100No qualifying project-wide loss incident was identified; connector and local-host issues may not become public incidents.
Factor score: 58/100The software and foundation roles are described, but exchange and jurisdiction obligations remain user-specific.
Factor score: 64/100Red flags & concerns
Context that should inform—not replace—your own assessment.
During our latest review. This does not mean the platform is risk-free.
Exposed services, unpatched images, weak secret handling or compromised hosts can defeat the benefit of local execution.
Wallet keys and token approvals can carry powers unlike a withdrawal-disabled CEX key.
Reported aggregate volume does not show user profitability, security or strategy quality.
What we verified
Checks completed during the latest research cycle.
Hummingbot product and safety research
Company, product, permission and regulatory evidence reviewed separately.
Is Hummingbot legit?
A public foundation structure, bylaws, repositories, governance process and current releases establish a real maintained project.
The Foundation's role, domicile, bylaws and governance model are public; an independent current registry extract was not included in this review.
Operator and legal sources: Hummingbot Foundation bylaws (Primary)
Is Hummingbot safe?
Local control reduces provider-side credential custody but transfers host hardening, dependency updates, secret storage, dashboard exposure and strategy safety to the operator.
How Hummingbot works
Users deploy Hummingbot, configure connectors and strategy controllers, and keep the process running. The client submits orders locally through exchange or blockchain interfaces.
Trading bots and automation features
The project is strongest for market making, connector-driven execution and custom strategy development across CEX and DEX venues.
Supported exchanges
Binance, Coinbase, Kraken, OKX, Bybit, KuCoin, Gate.io, Hyperliquid
Pricing
Pricing last checked on 2026-08-19. Check the provider's current pricing before purchase.
The core is free, but VPS, monitoring, exchange fees, gas, data and maintenance time are part of total cost.
Pricing source: no dedicated source in the current evidence set; see the full source list and stated limitations below.
Custody model
Funds remain at connected exchanges or user-controlled wallets; the user operates the software and secrets.
Security
Hummingbot keeps execution and secrets on infrastructure controlled by the user, but that control is useful only with prompt updates, restricted network exposure and careful connector permissions.
Use official tagged images, isolate the host, protect configuration files, restrict CEX keys and review wallet approvals separately for DEX connectors.
API and withdrawal permissions
Credentials are configured in the user-controlled deployment. CEX live trading requires exchange API authority; DEX connectors can introduce wallet and signing authority. Withdrawal status: Not required for ordinary CEX trading; DEX wallet permissions require connector-specific review.
Security and permission sources: Hummingbot core repository (Primary) · Hummingbot release notes (Primary) · Hummingbot FAQ and governance (Primary)
Regulatory information
Hummingbot presents as open-source software maintained by a Cayman foundation. Users remain responsible for exchange eligibility, market-access and local legal obligations.
Regulatory and service-scope sources: Hummingbot Foundation bylaws (Primary)
Performance evidence
Hummingbot provides strategy infrastructure, not independently verified user-return evidence.
Claim verification
Source, claim type, evidence, status and analyst note are shown separately.
“Users generated over $34 billion in trading volume across 140+ unique trading venues”
- Company source
- Open original claim
- Checked
- August 19, 2026
- What we found
- The figure appears in the official repository description, but no independent methodology or assurance was located.
- Analyst conclusion
- Treat as a Foundation-reported cumulative metric, not a current active-user or performance measure.
“The codebase is publicly available, auditable, and free”
- Company source
- Open original claim
- Checked
- August 19, 2026
- What we found
- The core repository and Apache-2.0 license are public.
- Analyst conclusion
- Publicly inspectable is supported; the wording does not establish that a comprehensive audit occurred.
“Hummingbot generally releases a new version every month”
- Company source
- Open original claim
- Checked
- August 19, 2026
- What we found
- The release index shows frequent dated releases, including a July 2026 release.
- Analyst conclusion
- Release cadence indicates maintenance, not security or stability by itself.
Security incident history
Documented events and bounded public-source checks, with entity scope preserved.
Public repository and incident check
No documented Hummingbot-wide credential or asset-loss incident was identified in the reviewed primary sources.
- Provider response / research note
- This does not cover every connector defect, dependency issue or compromise of a user-managed host.
Strengths & limitations
Strengths
Public Apache-2.0 code
Active 2026 releases
CEX and DEX connector breadth
User-controlled execution
Limitations
–Technical deployment burden
–No platform-wide audit located
–DEX authority can be complex
–No independently verified return evidence
Who may find it useful
Technical market makers
Users needing CEX and DEX connectors
Teams able to operate secure infrastructure
Who should look elsewhere
–You need a managed strategy
–You cannot maintain a server
–You assume open source guarantees safety
Hummingbot alternatives and comparisons
Alternatives are selected for overlapping workflows, with the main distinction shown.
Frequently asked questions
Is Hummingbot open source?+
Yes. The core repository is available under Apache-2.0, but public code is not proof of a completed security audit.
Where do Hummingbot API keys stay?+
They are configured in the user's deployment. The user must secure the host, files, backups and network access.
Is Hummingbot free?+
The core software is free; hosting, exchange fees, gas and maintenance still cost money.
Sources & evidence
Company-provided information is labeled and not treated as independent validation. Research coverage: 8/9; evidence confidence: High.
- [01]Primary · DocumentationHummingbot core repository
Hummingbot Foundation · Accessed August 19, 2026 · Last checked 2026-08-19
- [02]Primary · DocumentationHummingbot release notes
Hummingbot Foundation · Accessed August 19, 2026 · Last checked 2026-08-19
- [03]Primary · Official WebsiteHummingbot Foundation
Hummingbot Foundation · Accessed August 19, 2026 · Last checked 2026-08-19
- [04]Primary · DocumentationHummingbot FAQ and governance
Hummingbot Foundation · Accessed August 19, 2026 · Last checked 2026-08-19
- [05]Primary · TermsHummingbot Foundation bylaws
Hummingbot Foundation · Accessed August 19, 2026 · Last checked 2026-08-19
- [06]Primary · DocumentationHummingbot deployment repository
Hummingbot Foundation · Accessed August 19, 2026 · Last checked 2026-08-19
Research changelog
Conclusions may change when new evidence appears.
Reviewed status, repository, license, releases, governance, deployment, credentials and claims.
Hummingbot: 77/100
Hummingbot offers deep connector and market-making infrastructure with public code, active releases and unusually clear foundation governance. It is not a managed profit product: users operate the runtime, secure credentials, validate strategies and absorb exchange, dependency and execution risk. Public code and community scale improve inspectability, not proof of security or returns.
Research disclaimer This review is informational and not financial, investment, legal or security advice. Scores evaluate disclosed product qualities and evidence—not profitability, solvency or safety. Features, prices and eligibility can change.
No active affiliate relationships or compensated outbound links are configured. Any future commercial relationship will be disclosed and will not affect scores or conclusions. Read our policy.