No keys to your wallets: what Burokku keeps, what it refuses and what it costs

Burokku sees everything you hold, which makes it a target. So one question shaped most of what we built: if someone did get in, what could they do with your money?

As little as we can make it. Burokku keeps no private key to any wallet of yours, won't store an exchange key that can withdraw, and never acts for you on a signed-in session alone. Here's how, and what it costs.

Watching needs no keys

You add a wallet by pasting its address or ENS name, on 60+ chains including Solana and Bitcoin; Hyperliquid, Lighter and Aster accounts are read the same way. That's enough to read balances, positions and history. Nothing signs from a watched address, so there's nothing there to take.

To act from one, you connect it and sign each transaction yourself; a hardware wallet signs on the device.

The one kind of key we keep

Exchanges have no address to watch, so reading one takes an API key. It's the only secret Burokku stores, with rules:

• Read-only to connect. Before saving anything, Burokku asks the exchange what the key can do, and refuses one that can trade or withdraw. This guide shows how to make the right one on Binance.
• Sealed to your account. It's encrypted on our servers in a space that belongs to your account alone. A browser, ours or yours, only ever sees its last four characters.
• Checked again every day. A read-only key that later gains trading or withdrawal rights is deleted, and you get an email.

To trade on one of 10+ exchanges from Burokku, you connect a trading key instead. It may trade but must not withdraw or transfer, and it must be locked to the one fixed IP address Burokku's calls leave from, so a copy is useless anywhere else. One that gains withdrawals or loses its lock is deleted too. Trading covers how each order is priced and checked.

A session is never enough

Signing in proves it was you then, not that it's still you now. So anything that lets Burokku act for you takes a fresh check with your passkey (or your authenticator app): turning automations on, connecting a key for trading, raising a limit, setting up a recurring buy, arming a trade to run while you're away. Each check is for that one action, and an armed rule that's edited waits until you confirm it again.

Lowering risk never asks: pausing automations, lowering a limit, closing a position. If you think someone has your session, locking your account pauses automations and signs out every session. Every security change and anything that moves money goes in your audit log; how security works covers each of these.

Trading wallets: yours, with Burokku as a limited signer

Automations that trade while you're away, like a recurring buy or a guard that repays a loan before it's liquidated, need something that can sign without you. We didn't want that to be a key we hold. So Burokku sets up a trading wallet, one for EVM chains and one for Solana, owned by one of your passkeys.

• Your passkey is the owner. Only it can change the rules, remove Burokku, export the key or withdraw. Your browser signs those requests; our servers only pass them on.
• Burokku signs only what the rules allow: same-chain swaps paid back into the wallet, and, for a loan guard, repaying or adding collateral for wallets you've listed, each of which first signs a message proving it's yours. Anything else, including sending funds to another address, is refused. The service that keeps the wallet checks the rules before every signature, and since your passkey owns them, we can't loosen them from our side.

The rules can't stop a stolen Burokku signer making bad-price swaps between the wallet's own tokens. So the wallet holds only what you move into it, and Burokku's own checks come first: your per-trade and daily limits, and a quote that can't fall far below the market. Automations shows how runs are limited.

Perp DEX keys stay in your browser

For Hyperliquid, Aster and Lighter, we went the other way. When you turn trading on, Burokku makes a new key in your browser and your wallet approves it once on the venue. The key never reaches our servers, and none of these keys can send your funds to another address. It's kept encrypted, but script on the page could still use it, which is why Hyperliquid and Aster keys expire after 30 days, trading turns off in one tap, and every order is checked against the same price rules as on an exchange.

What this costs

Some of these fall on you:

• Watched wallets can't act. Burokku can warn you a loan is near liquidation; fixing it from that wallet means signing yourself. While you're away, Burokku acts only from a trading wallet you've funded or with an exchange trading key.
• A trading key is still a key we hold. Our server opens it to place orders. The IP lock, the no-withdrawal rule and our checks limit what it can do; they don't make the risk zero.
• Perp DEX orders come from your browser. There are no automations there yet: a key our server could use is a different kind of trust. When a stop fires, Burokku sees the position close but can't say whether a take-profit, stop-loss or liquidation did it. Each browser approves its own key, and smart wallets can't approve one.
• Trading wallets do less than your own wallets: same-chain swaps on a few chains, no bridging, and some tools can't use them. Anything new needs your passkey to approve new rules.
• More prompts, and after you change your second steps, automations can't be turned on for 24 hours.

We think that's the right trade: a tool that reads all your money shouldn't be an easy way to take it.