Algos For Cryptos

Adventures in crypto trading

Show menu Hide menu

MonthApril 2018

Crypto Algo & Trading Jobs at Top Trading Firms

April 26, 2018 /

Computer running an algo to prints easy money

Updated on October 14, 2018.

Do you work at a prop trading firm and want to know what is your competition doing in the crypto trading markets?

Or perhaps you made your own crypto trading bot in Python or Java and want to find out if your skills are a match for a job in the “big-leagues”?

Consider These Open Positions

Akuna Capital: has multiple crypto related positions

Belvedere Trading: NO crypto jobs found on careers pages

Chimera Securities: NO crypto jobs found on careers pages

CTC (Chicago Trading Company): NO crypto jobs found on careers pages

D.E. Shaw: NO crypto jobs found on careers pages

DRW (incl. subsidiary Vigilant): has a crypto trading / OTC subsidiary Cumberland Mining and numerous crypto related positions

DV Trading: has a crypto trading division DV Chain with a few crypto related jobs

Five Rings: NO crypto jobs found on careers pages

Flow Traders: NO crypto jobs found on careers pages

Gelber Group: NO crypto jobs found on careers pages

Geneva Trading: NO crypto jobs found on careers pages

GTS Securities: NO crypto jobs found on careers pages but is mentioned in articles about trading firms in cryptos (see below)

HC Technologies: NO crypto jobs found on careers pages but is mentioned in articles about trading firms in cryptos (see below)

Hudson River Trading: NO crypto jobs found on careers pages but is mentioned in articles about HFT firms in cryptos (see below)

IMC: NO crypto jobs found on careers pages

Jane Street: NO crypto jobs found on careers pages but has been mentioned in articles about trading in the crypto markets

Jump Trading: NO crypto jobs found on careers pages but has been mentioned in articles about investments in the crypto companies and is also named in articles about HFT firms in cryptos (see below)

Optiver: NO crypto jobs found careers pages but the former head of ETF expansion founded the crypto trading firm Wintermute which has open position(s)

PEAK6: NO crypto jobs found on careers pages

Point72: NO crypto jobs found on careers pages but a former manager launched a crypto fund

SALT Lending: has a few crypto algo / trading jobs
FYI: not strictly a “prop trading firm” but I have included them for their postings

Simplex Investments: NO crypto jobs found on careers pages

Susquehanna International Group: NO crypto jobs found on careers pages but is mentioned in articles about HFT firms in cryptos (see below). Recently, SIG expanded services for their clients by allowing access to their prop crypto-trading facilities.

Teza: NO crypto jobs found on careers pages

3Red Trading: NO crypto jobs found on careers pages

Tower Research: NO crypto jobs found on careers pages but is mentioned in articles about HFT firms in cryptos (see below)

TwoSigma: NO crypto jobs found on careers pages

Vatic Labs: NO crypto jobs found on careers pages

Virtu Financial (incl. KCG): NO crypto jobs found on careers pages

Volant Trading: NO crypto jobs found on careers pages

Wolverine: NO crypto jobs found on careers pages

XR Trading: NO crypto jobs found on careers pages but is mentioned in this article to be hiring crypto positions

Major Investors

Also of note is that Goldman Sachs hired the head of its new digital assets division. Moreover they are invested in Circle Trade, which acquired Poloniex, the #4 of the top US exchanges (GDAX, Bittrex, Kraken, Poloniex, Gemini).

Similarly, ICE (Inter Continetal Exchange) is invested in GDAX (Coinbase) via ICE’s subsidiary NYSE.

Relevant “Rumors”

Jump Trading, Tower Research, Hudson River Trading and Susquehanna International are said to be trading bitcoin, while “GTS Securities, Virtu Financial, and HC Technologies are among the electronic traders sizing up opportunities”.

Subscribe to monthly email about crypto exchanges, data feeds, APIs for automated bots, algos and trading tools:

API Key+secret vs. Name+password: Which is More Secure?

April 2, 2018 /

Bitcoin hacker

Background

At least 40 top crypto exchanges provide API access to their trading systems. For these exchanges, users can choose to access their accounts in two ways:

Manually login to the exchange website with their username+password each time they want to access their account.

Or, users can configure their account to permit access from external applications using a set of 2 values specific to their account and defined by the exchange for use with the exchange API: a.k.a. API key+secret.

On March 8th 2018, we’ve learned that Binance was able to thwart a phishing+API attack by an unidentified individual or group.

According to reports, the attacker(s) phished out regular user credentials (name+password); then created API keys in those cracked accounts (key+secret); and finally attempted to use these API keys to execute their attack.

Binance did not detect compromised accounts nor the unauthorized creation or API keys. Instead, Binance detected unusual trading activity in their market for the target coin and then Binance suspend all withdrawals until they were able to neutralize the attack.

The crux of the attack was that real users GAVE AWAY their own usernames & passwords to a site running on a very similar domain name. Their credentials were later used by the attackers to manually login into accounts and configure them to be accessible via Binance’s API.

API Key+secret Is More Secure

Theoretically speaking, this attack would have been more unlikely if the uses were accessing their accounts exclusively via the API key+secret protocol:

  • API keys are used with an endpoint domain which is almost always hardcoded in the client application. Therefore, API domain is much less susceptible to domain-name phishing attacks than the exchange website “home” domain. Moreover, users might type the web domain name and end up on a phishing site by their own error or click on a malicious link in a spam email.
  • Even if the API endpoint is compromised, the attacker can not use the API information to hijack the actual user account on the exchange server. API based communication uses the key-secret to sign the message cryptographically but the key-secret value is never sent in the message in any form. Therefore, the attacker inspecting the messages between the user and the exchanges is not able to reconstruct the key-secret it would need to generate “impostor” messages to make bad trades or transfer assets. On the other hand, username+password communication protocols do send the password value itself which can be copied and stored by the attacker in the middle for later malicious use.
  • Assuming that exchanges’ own iOS and Android apps use API key+secret protocols, is it safe to say that they are more secure than accessing the accounts via exchanges’ websites.

Subscribe to monthly email about crypto exchanges, data feeds, APIs for automated bots, algos and trading tools:

© 2024 Algos For Cryptos

Theme by Anders Norén — Up ↑