# Open source crypto trading bot: licenses, status, checks URL: https://fincodelabs.com/en/blog/open-source-crypto-trading-bot · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Trading bots · Published: 2026-11-06 · Updated: 2026-11-06 Open source crypto trading bot reference: license, language, last release and paper mode for seven projects, read 5 November 2026, and how to check a repo. **Short answer:** An **open source crypto trading bot** is software whose code you can read, run and change under its license, while hosting, keys and results stay your responsibility. As read on 5 November 2026, Freqtrade and OctoBot are GPL-3.0, Hummingbot, LEAN and Superalgos are Apache-2.0, Jesse is MIT and NautilusTrader is LGPL-3.0. Before running any repository, read it, run it in a container with no real keys, and pin the version; trading with any of them can lose money. This is a reference, not a ranking: alphabetical, no star counts, no strategy, preset or performance figure. The components a production system needs are in [trading bot development](https://fincodelabs.com/en/blog/trading-bot-development), and how three of these projects are built is in [trading bot architecture](https://fincodelabs.com/en/blog/trading-bot-architecture). Which venues you may trade on depends on your jurisdiction and each platform's terms, and no exchange is recommended here. Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized. ## Open source trading bots on GitHub: seven projects compared by fact All seven repositories showed commits in 2026 when read, but the last formal GitHub releases of the six that publish them range from 30 October 2026 back to 2017. **Read 5 November 2026 from GitHub, PyPI, READMEs and project documents (alphabetical)** | Project | License | Language | Last release | Latest commit | Paper or dry-run | Calls itself | | --- | --- | --- | --- | --- | --- | --- | | Freqtrade | GPL-3.0 | Python | 2026.10, 30 Oct 2026 | 5 Nov 2026 (`develop`) | Dry-run | "free and open source crypto trading bot" | | Hummingbot | Apache-2.0 | Python | v2.17.0, 22 Sep 2026 | 4 Nov 2026 (`development`); 22 Sep 2026 (`master`) | Paper trade connector, such as `binance_paper_trade` | "open-source framework" | | Jesse | MIT | Python | No GitHub release; 3.6.0 on PyPI, 3 Nov 2026 | 3 Nov 2026 | Paper, through an official plugin | "advanced algorithmic trading framework" | | LEAN | Apache-2.0 | C#, Python | v2.4.0.1, 8 Aug 2017 on GitHub Releases; numbered tags to 18233, 5 Nov 2026 | 5 Nov 2026 | QuantConnect Paper Trading, through its CLI | "event-driven" algorithmic trading platform | | NautilusTrader | LGPL-3.0 | Rust, Python | v1.231.0, 2 Aug 2026; pre-release 2.0.0rc8, 29 Oct 2026 | 5 Nov 2026 (`develop`) | Sandbox execution client in 1.231.0: simulated fills on a live node | "Rust-native engine" | | OctoBot | GPL-3.0 | Python | 3.0.0-beta3, 8 Oct 2026, marked Latest; 2.1.1 the latest stable on PyPI | 2 Nov 2026 (`dev`); 7 Oct 2026 (`master`) | Paper trading simulator | "free open-source crypto trading bot" | | Superalgos | Apache-2.0 | JavaScript | 1.6.1, 2 Nov 2024; daily snapshots to 30 Sep 2026 | 7 May 2026 (`master`) | Paper trading session, per its repository docs | "community-owned open-source project" | Read the release and commit columns together. LEAN's last GitHub Release is old while its numbered tags and commits are current, and its README points to its CLI, Docker Hub and NuGet. These dates will age; recheck them. ## Python trading bot framework or ready-made bot: what differs Which project wins has no useful answer; compare scope, runtime and conditions, as the projects state them. **What the projects' own pages add to the license, read 5 November 2026 (alphabetical)** | Project | Scope as stated | Runtime and conditions | | --- | --- | --- | | Freqtrade | README lists 12 spot and 7 futures exchanges; others "potentially" through CCXT, with no guarantee | 2026.10 needs Python 3.12 or later | | Hummingbot | "many centralized or decentralized exchanges" | Source install with conda and `make install` | | Jesse | Keeps a supported-exchanges page in its documents | Python 3.10 or later; paper and live modes use a plugin that needs a license key from its website (pricing page unreadable on 5 November 2026) | | LEAN | "multiple financial markets" | Its CLI page says the CLI needs membership of an organization on a paid QuantConnect tier | | NautilusTrader | 21 entries in its README, available or planned: crypto venues, a brokerage, data providers, a betting exchange and prediction markets | PyPI says 1.231.0 needs Python 3.12 to 3.14; the `develop` README lists 3.13 to 3.15 (3.15 from source) | | OctoBot | "15+ exchange integrations" including Binance, Coinbase, MEXC and Hyperliquid | 2.1.1 needs Python 3.12 or later; the README also points to a hosted service | | Superalgos | Tutorial uses Binance; others set up later | Node install with a fork and a GitHub token; README describes a native SA token distributed among contributors | Some also say where they can fall short. Freqtrade's README says to use it at your own risk and to start in dry-run. NautilusTrader's says live execution brings behavior "a simulation may not reproduce". A library such as CCXT is a different thing again, a connector rather than a bot; see the [CCXT Python guide](https://fincodelabs.com/en/blog/ccxt-python-trading-bot). ## What the license means if you build a product on it Running a bot for yourself is allowed under all four licenses; the differences start when you hand copies to someone else. This is a reading of the texts, not legal advice. **Four licenses in practice (GPL-3.0 and LGPL-3.0 texts in the Freqtrade and NautilusTrader repositories, Apache and MIT texts, read 5 November 2026)** | License | Projects | If you deliver or sell copies | Worth checking | | --- | --- | --- | --- | | GPL-3.0 | Freqtrade, OctoBot | You may charge, but recipients get the source under the GPL and may share it | Network interaction with no copy transferred is not conveying, so a copy you only run need not be released; ask a lawyer whether strategy files or plug-ins are part of the work | | LGPL-3.0 | NautilusTrader | Your own terms, if they allow changing the library parts and reverse engineering to debug that; plus notices, license copies and a way to relink | Changes to the library itself stay under the LGPL or GPL | | MIT | Jesse | Keep the copyright and permission notice | A plugin can carry separate terms | | Apache-2.0 | Hummingbot, LEAN, Superalgos | Keep the license and notices, and mark changed files | Includes a patent grant that ends if you bring a patent claim over the work | > **Hypothetical example.** You change a GPL bot and run it on your own server for your own account: nothing needs releasing. You install the same changed copy on a client's server: that is delivering a copy, so the client gets the source under the GPL and may pass it on. All four disclaim warranty, and a code license does not settle other rights. [OKX TR's API agreement](https://tr.okx.com/help/okx-api-agreement), for example, restricts SaaS, signal and managed services in clause 9.3 and redistribution of market data in clause 9.4 without written approval. Running software for other people's accounts raises separate questions, covered in [are trading bots legal](https://fincodelabs.com/en/blog/are-trading-bots-legal). ## How to check a trading bot from GitHub before running it Treat any repository as hostile until you have read it, because a polished page proves nothing about the code. Kaspersky's [GitVenom report](https://securelist.com/gitvenom-campaign/115694/) of 24 February 2025 describes hundreds of fake GitHub repositories with well-written READMEs, tags and commit counts inflated by a timestamp file. Python samples hid code after about 2,000 tab characters, JavaScript samples decoded a Base64 script, and C-family projects ran a script through a Visual Studio `PreBuildEvent`. Payloads stole credentials and wallet data, installed backdoors and swapped copied wallet addresses. Its named examples are an Instagram tool, a Telegram Bitcoin wallet bot and a game hack, not trading bots; a bot that asks for exchange keys looks like the same kind of target, though that is an inference. 1. **Find the real repository** from the project's own site or package page, not from a search result, and check the owner. 2. **Scan and read.** The script below looks for those three tricks. 3. **Run it locked down**, with no network at first, then only the hosts it needs. 4. **Use no real keys at first**, then a key with read and trade permission and no withdrawal right; see [API key security](https://fincodelabs.com/en/blog/api-key-security-trading-bots). 5. **Pin what you tested**: a tag and hash, or an image digest. ```python import pathlib, re, sys CHECKS = { "hidden off screen": re.compile(r"(?:^|[^ \t])[ \t]{200,}\S"), "decode and run": re.compile(r"^(?=.*(exec|eval|Function)\s*\()(?=.*(b64decode|base64|atob|decompress|[Ff]ernet))"), "runs at build or install": re.compile(r'PreBuildEvent|PostBuildEvent|"((pre|post)?install|prepare)"\s*:'), } SUFFIXES = {".py", ".js", ".ts", ".csproj", ".vcxproj", ".json", ".toml", ".sh", ".bat", ".ps1"} root = pathlib.Path(sys.argv[1]) if not root.is_dir(): sys.exit(f"not a folder: {root}") hits = 0 for path in sorted(root.rglob("*")): if path.is_file() and path.suffix.lower() in SUFFIXES: for n, line in enumerate(path.read_text(errors="ignore").splitlines(), 1): for name, pattern in CHECKS.items(): if pattern.search(line): hits += 1 print(f"{path.relative_to(root)}:{n}: {name}: {' '.join(line.split())[:40]}") print(hits, "hits; a hit means read that line, and no hit proves nothing") ``` On a synthetic fake repository built on 5 November 2026: ``` bot.csproj:1: runs at build or install: r index.js:2: decode and run: eval(atob('Y29uc29sZS5sb2coImhpIik=')); main.py:3: hidden off screen: time.sleep(0) ; import base64; exec(base main.py:3: decode and run: time.sleep(0) ; import base64; exec(base package.json:1: runs at build or install: {"name":"x","scripts":{"postinstall":"no 5 hits; a hit means read that line, and no hit proves nothing ``` The same script found 0 hits on a clean sample, the CCXT 4.5.92 package and Freqtrade's 2026.10 source; a quiet scan is not a safety verdict on any project. ## Run it in a container and read the network calls A container with no network and a read-only root limits what a surprise can do, and a Python audit hook shows what the code tries. ```python import runpy, sys WATCHED = {"socket.connect", "socket.getaddrinfo", "subprocess.Popen", "os.system"} def hook(event, args): dynamic = event == "compile" and args[1] in (None, "") if event in WATCHED or dynamic: print("AUDIT", event, repr(args)[:60], file=sys.stderr) sys.addaudithook(hook) runpy.run_path(sys.argv[1], run_name="__main__") ``` ``` docker run --rm --network none --read-only --cap-drop ALL \ --security-opt no-new-privileges --user 65534 --pids-limit 64 --memory 256m \ -v "$PWD:/repo:ro" python:3.12-slim python -I /repo/watch.py /repo/fake/main.py ``` Run on 5 November 2026 against the fake repository, whose hidden line ran a harmless payload aimed at a reserved documentation address (standard error only; three standard-library compile lines and the traceback body left out): ``` AUDIT compile (b'import socket, subprocess\nsubprocess.run(["echo", "paylo AUDIT subprocess.Popen ('echo', ['echo', 'payload ran'], None, None) AUDIT socket.getaddrinfo ('192.0.2.1', 443, 0, 1, 0) AUDIT socket.connect ( This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy). --- Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/open-source-crypto-trading-bot Cite as: Fincode, "Open source crypto trading bot: licenses, status, checks", updated November 6, 2026, https://fincodelabs.com/en/blog/open-source-crypto-trading-bot