SECURITY
We only hold a key that can lend — never one that can withdraw or trade. Here's exactly how, checked against our own code.
The One-Sentence Version
Your money always stays in your own Bitfinex account. We only get a key that can lend it — nothing else.
HOW IT CONNECTS
Hahalend never touches your funds directly. It only talks to Bitfinex through a key that's allowed to place lending offers.
API PERMISSIONS
Every key is checked the moment you add it. Only two permissions are ever allowed.
Read
See your balance and history
Funding
Place and cancel lending offers
Withdraw
Move funds out of Bitfinex
Trading
Buy or sell on the exchange
KEY PROTECTION
Encrypted With AES-256-GCM
Your key is encrypted before it's ever saved. It sits in our database as ciphertext, not plain text.
Decrypted Only for a Moment, In Memory
Your key is decrypted only in memory, only at the moment it's needed — to check your balance or place and cancel lending offers. Your full key is never written to disk, logs, or the database in plain text.
IP Whitelist (Optional)
Optional extra protection you can turn on yourself: lock your key to our fixed IP addresses on Bitfinex. Even a leaked key couldn't be used from anywhere else.
See the exact IPs in the setup guideACCOUNT PROTECTION
2-Step Verification
Turn it on for an extra check at every login. Turn it back off anytime — it's always your choice.
Instant Session Shutdown
Turn on 2-step verification or close your account, and every device you're logged into is signed out immediately.
WORST CASE
Even if our whole server were compromised, the encrypted keys stored there still can't withdraw or trade — Bitfinex blocks those actions for any key that was never given the permission, no matter who's holding it. The honest edge case: if an attacker also got the encryption key, they could see your balances and history, and place or cancel lending offers in your account — but they still could never move your funds out.
Can Hahalend withdraw my money?
No. Every key is checked for Withdraw and Trading permissions. If either is on, we reject the key until you turn it off.
Where does my money actually sit?
In your own Bitfinex account, the whole time. Hahalend never moves it anywhere else.
How is my API key stored?
Encrypted with AES-256-GCM. It's decrypted only in memory, only at the moment it's needed — to check balances or place and cancel offers — and your full key is never written to disk, logs, or the database in plain text.
Can I turn 2-step verification off?
Yes, anytime. You'll confirm with one more code, and it turns off immediately.
What if Hahalend's own servers get hacked?
The encrypted keys stored there still can't withdraw or trade — Bitfinex blocks those actions no matter who is using the key. Honestly: an attacker who also got the encryption key could see balances and history, and place or cancel lending offers, but could still never move funds out.