When connecting Binance to AI trading, the core of isolation is not "how to connect," but "what it can touch after connecting." If you are using Agent OS or MCP, Binance has already done one layer of fund isolation for you: the AI can only operate in an independent sub-account, and withdrawal permission is excluded by design. What you need to do is decide how much money to put into this sub-account, and which functions the AI can still use within the sub-account.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
If you are using a traditional third-party bot without automatic sub-account isolation, then you must complete the isolation manually through API permissions.
Two Connection Methods, Completely Different Isolation Mechanisms
Connecting via Binance Agent OS / MCP (Built-in Isolation)
This is the AI trading connection method launched by Binance in August 2026, supporting clients such as Claude Code, Cursor, and ChatGPT. The key difference from traditional API calls is that the AI is placed in a dedicated Agentic sub-account, rather than directly touching your main account.
This sub-account has several hard boundaries:
Withdrawal permission does not exist. There is no withdrawal option in the permission list at all, so the AI cannot transfer assets from the sub-account to any external address.
Cannot pull funds from the main account. The sub-account starts empty, and you manually transfer funds from the Binance web interface. The AI cannot move money from your main account by itself.
Transfer scope is limited to within the sub-account. The AI can move funds between the spot wallet and futures wallet inside the sub-account, but nothing can go out.
In other words, the money you transfer into the sub-account is all the AI can touch. That amount itself is the most direct isolation measure.
Connecting via Regular API Key (Manual Isolation Required)
If you are using Hummingbot, 3Commas, or other third-party tools, isolation depends on the permission checkboxes when creating the API key. The path is Binance web interface Profile → API Management → Create API, then reduce permissions in the settings.
The minimum necessary permission combination is:
Enable reading. Allows the AI or bot to view balances and order status.
Enable spot and margin trading. This is the minimum trading permission required for placing orders. If you only trade spot, do not enable futures-related permissions.
Never enable withdrawals. This is the core action for fund isolation. Third-party tutorials usually also clearly mark "Do NOT enable Withdrawals."
Configure IP whitelist. Enter the public IP of the server or local machine running the AI. IP whitelist is mandatory when withdrawal permission is enabled, but even without withdrawals, it is recommended to add it to reduce the risk window after key leakage.
If you are not sure which permissions to enable, the principle is simple: first enable read-only, confirm that the AI can read the account normally, then add trading permission. By default, do not touch any option involving fund transfers out.
Key Action for Fund Isolation: Use a Sub-Account for "Experimental Funds"
Whichever path you take, I strongly recommend using a sub-account to isolate funds, rather than directly attaching an API to the main account. The reason is straightforward: the available balance of the main account is the AI's theoretical risk ceiling, while the sub-account balance is the ceiling you set yourself.
The path to manually create a sub-account is Binance web interface Profile → Sub-Account Management → Create Sub-Account. After creation, transfer the portion of funds you are willing to let the AI operate from the main account to the sub-account. The AI cannot access the remaining assets in the main account at the permission level.
The cost of this approach is an extra transfer step, and the funds in the sub-account need to be managed manually by you. But for letting an AI or bot trade automatically, this cost buys a hard boundary for risk: no matter what mistake the AI makes, the loss will not exceed the amount you set.
Please note that Managed Sub-Account is a different feature, mainly for VIP 1 and above or enterprise users, providing stricter separation of trading/withdrawal permissions, with a default maximum of 10 sub-accounts. If you are not a VIP, a regular sub-account is sufficient.
What Else Can the AI Do Within the Sub-Account: Trading Scope Is Also a Dimension of Isolation
Fund isolation solves the problem of "how much can be lost," but which products the AI can operate within the sub-account is the second layer of isolation.
In the Agent OS permission settings, you can toggle functional scopes one by one:
Market data: Public information, does not involve the account.
Account reading: Can see sub-account balances and positions.
Trading: Spot, margin, futures, etc. Only enable what you actually need. If the strategy only trades spot, do not enable futures permission.
Transfer: Limited to between wallets inside the sub-account.
A practical suggestion: start with spot trading only. Futures and margin lose money much faster than spot, and AI "hallucinations" or wrong parameters are amplified under leverage. Wait until you have observed the execution quality of a particular AI before considering enabling more products.
After Changing Permissions, Where to Confirm Isolation Is Effective
After creating an API key or connecting an Agent, do not start trading immediately. Do a verification first:
Check the permission list. On the API management page, confirm that the withdrawal column is off. If there is no withdrawal option at all in the Agent OS interface, isolation is already effective.
Check fund location. Confirm that the AI is operating on the sub-account, not the main account where you keep your main assets. In Agent OS, the AI's trading records and balances should be displayed under the sub-account name.
Do a small test. Transfer a small amount of funds to the sub-account, have the AI place a minimum-amount limit order far below market price so it will not fill, and confirm that the order appears in the sub-account order history, not the main account. Cancel the order after testing.
If you see the order in the main account order history after the AI places it, isolation is not effective, and you need to go back and check the permission settings.
If Isolation Fails, What Are the Most Likely Causes
Permissions not taking effect or configuration omissions usually manifest in the following situations:
The AI can read the main account balance but cannot place orders. This usually means you gave read permission but did not enable trading permission. Check whether "Enable Spot Trading" is checked in API management.
Orders placed by the AI appear in the main account. If you are using a regular API key and have not created a sub-account, the AI is operating on the main account. Isolation can only rely on permissions (no withdrawal) and amount control (low main account balance). Under this configuration, it is recommended to transfer most of the main account assets to the funding account or cold storage, leaving only the necessary trading funds.
IP restriction error. If you enabled the IP whitelist but the public IP of the AI running environment has changed (for example, you changed servers or proxies), API requests will be rejected. Check whether the IP in the whitelist is still the address currently in use.
Agent OS connection succeeds but cannot place orders. Confirm that there is money in the sub-account. The initial balance of the sub-account is zero, and the AI cannot transfer funds from the main account by itself. You need to manually transfer funds from the web interface.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Boundaries to Remember
Agent OS built-in isolation currently only supports desktop configuration; mobile is not applicable. If you are used to operating on your phone, you need to complete the Agent connection and permission settings on a computer first.
In addition, Agent OS does not have a separate "maximum loss" or "maximum trading amount" setting. The actual effect of fund isolation depends on how much money you transfer into the sub-account. Binance officially also states that AI trading decisions happen outside the Binance system, and Binance can only see the results, not why the AI made a certain decision. This means you cannot rely on the platform to block a trade that is "logically wrong but permission-valid." The amount transferred into the sub-account is the final stop-loss line.
