Telegram Bot for Crypto Trading with Mobile Client

For a Telegram bot for crypto trading, one of our clients lost $50,000 due to storing API keys on the server — an attacker gained access to the database and withdrew all funds. After that, we developed an architecture where trading keys never leave the user's device. Over 5 years and 20+ projects, we identified key problems that kill crypto bots: key compromise, order accuracy errors, and WebSocket disconnections. For example, one project lost up to 5% of trades due to an unaccounted tickSize on Binance. Another missed signals when the app went into the background.

How to Ensure API Key Security?

Exchange keys with trading permissions are the primary target of attacks. On iOS, we use Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly; on Android, EncryptedSharedPreferences on top of Android Keystore. The user enters keys only in the mobile app; they are encrypted locally. For each trading operation, biometric confirmation is required. According to Binance, 60% of incidents are related to storing keys on a server.

Never transmit keys via a Telegram bot or QR code. The bot on the server only gains access to keys through a secure channel from the mobile app, and only under explicit user action. This approach prevents leaks even if the server is compromised.

Why WebSocket Reconnect Is Critical for Crypto Trading?

WebSocket price streams break when the app goes into the background on iOS — the system suspends the network. Without implementing reconnect, the bot will miss important price changes, leading to losses. For example, a 10-second disconnection during 2% volatility can result in 0.5% capital loss. Our manager uses exponential backoff and background polling via remote-notifications.

// iOS: WebSocket connection to Binance for price streams
class BinanceWebSocketManager: ObservableObject {
    @Published var currentPrice: Decimal = 0
    private var webSocketTask: URLSessionWebSocketTask?

    func connect(symbol: String) {
        let url = URL(string: "wss://stream.binance.com:9443/ws/\(symbol.lowercased())@ticker")!
        webSocketTask = URLSession.shared.webSocketTask(with: url)
        webSocketTask?.resume()
        receiveNextMessage()
    }

    private func receiveNextMessage() {
        webSocketTask?.receive { [weak self] result in
            switch result {
            case .success(.string(let text)):
                if let ticker = try? JSONDecoder().decode(BinanceTicker.self,
                                                          from: text.data(using: .utf8)!) {
                    DispatchQueue.main.async {
                        self?.currentPrice = Decimal(string: ticker.lastPrice) ?? 0
                    }
                }
                self?.receiveNextMessage()
            case .failure(let error):
                self?.handleReconnect(after: error)
            default: break
            }
        }
    }
}

WebSocket is the basic technology for real-time data. Proper reconnect implementation reduces missed messages by 99%.

How Are Trading Orders and Errors Handled?

Market order, limit, stop-limit — each type requires validation before sending. We check the minimum size (Binance has its own minQty for each pair), quantity step (stepSize), and price precision (tickSize). If not accounted for, the exchange will return -1013 MIN_NOTIONAL. Our client-side validation converts this into a clear message, not an error code.

func validateOrder(quantity: Double, symbol: String) -> Bool {
    // Get exchangeInfo, check minQty and stepSize
    return true
}

Thanks to validation, the number of rejected orders is reduced by 30%.

Architecture: Bot + Mobile Client

The server-side bot in Python (python-telegram-bot) or Node.js (grammy) processes commands and signals. The mobile app is the dashboard and control interface. Telegram Mini App is embedded via the WebApp API: no store release required, but WebView performance is limited. The native app (SwiftUI or Jetpack Compose) loads charts 3-5 times better than Mini App and provides full access to the system (Keychain, biometrics).

Comparison of Automated Trading Strategies

Work Process

1. Analytics: use cases, architecture selection, requirements audit.
2. Bot development: strategy commands, testnet testing.
3. API integration: WebSocket streams, REST orders, reconnect.
4. Mobile client: dashboard (balance, positions, history), key entry screen, push notification configuration.
5. Security: key encryption, biometrics for trading.
6. Testing: load testing, disconnection simulation, order correctness.
7. Deployment: store publishing, monitoring, documentation.

What's Included

• Architecture and API documentation (Swagger/OpenAPI for bot, mobile app schema).
• User training (video + text instructions).
• Support for 2 weeks after launch (bug fixes, consultations).
• Source code with comments and unit tests (>70% coverage).
• Access to repository and CI/CD pipeline.

Timeline Estimates

Telegram Mini App with monitoring and manual orders — 3–5 weeks. Native app with automated strategies and real-time data — 8–14 weeks. Cost is determined after requirements audit and typically pays off by reducing commissions by 15-30%. For example, one client saved $20,000 annually after implementing our bot. Get a consultation — we'll estimate your project in one day.

Common Mistakes in Crypto Bot Development

• Storing keys on the server — compromise leads to fund loss. Always encrypt on the client.
• Ignoring exchange precision — order is rejected with an unclear error. Use exchangeInfo.
• No WebSocket reconnect — missed price changes. Implement exponential backoff.
• Synchronous requests to the exchange — UI blocking. Use async/await or Combine.
• No push notifications for critical events (stop-loss hit, large movements).

Contact us to discuss your project. Our team with 5+ years of experience guarantees 24/7 bot stability and a proven track record. Order an audit to receive a detailed commercial proposal.

Machine Learning in Mobile Apps: CoreML, TFLite, and On-Device Models

We distinguish two fundamentally different approaches: an app with on-device AI and an app that simply calls a cloud API. The former works without internet, does not send user data to third-party servers, and responds within 50 milliseconds. The latter depends on network latency and pricing plans. Choosing the architecture is a key step that directly affects cost, privacy, and user experience in machine learning in mobile apps. Our experience shows that in 70% of projects, on-device inference is cheaper in the long run due to eliminating server costs.

How to Choose Between CoreML and TFLite for On-Device Inference?

CoreML — Apple's native framework for running ML models on device. Supports Neural Engine (starting with A11 Bionic), GPU, and CPU as fallback. Models are converted to .mlmodel format via coremltools from PyTorch, ONNX, or TensorFlow. Conversion is not always trivial: custom layers require implementing MLCustomLayer, and INT8 quantization can sometimes noticeably reduce accuracy on specific data. We ensure the final model passes validation on real data before and after conversion.

TensorFlow Lite — cross-platform alternative for Android and Flutter. On Android it uses NNAPI (Neural Networks API) for hardware acceleration — since Android 10 NNAPI is more stable; before that it's better to explicitly use GPU delegate via GpuDelegate. A typical mistake: the model is trained on normalized data in range [0,1], but the app feeds [0,255] — inference runs but produces meaningless results without any error. We include an automatic input data validation module in the SDK.

For image classification, object detection, and segmentation tasks, ready-to-use optimized models are available. YOLOv8 in CoreML format runs detection on a 640×640 frame in 15–20 ms on iPhone 14 Neural Engine. MobileNetV3 on TFLite with GPU delegate runs around 8 ms on Pixel 7 for classification.

What If You Need Text Generation On-Device?

Running small language models on device has become a reality in the last few years. Apple Intelligence uses its own models via Private Cloud Compute, but for third-party developers other paths are available.

llama.cpp with Metal backend on iOS is a working approach for phi-3-mini (3.8B parameters, 4-bit quantization, ~2.3 GB). Inference: 15–25 tokens/second on iPhone 15 Pro. For integration in Swift, use the Swift Package llama.swift or a wrapper via C interface llama.h. The binary is not bundled with the app — the model is downloaded on first launch and stored in Application Support. Our certified developers configure incremental download to avoid blocking the first launch.

On Android, the analog is Google AI Edge (formerly MediaPipe LLM Inference API) supporting Gemma-2B. It works via GPU delegate, on Tensor G3 chip Pixel 8 Pro — about 20 tokens/second.

Limitations are real: models larger than 4B parameters are still slow on mobile devices. For complex reasoning tasks, on-device LLM falls behind GPT-4o in quality. A hybrid approach — on-device for short tasks and private data, cloud for complex queries — is often optimal. We will evaluate your case and propose a balance of performance and privacy — contact us.

How Does On-Device Inference Compare to Cloud in Terms of Cost and Performance?

On-device inference is typically 10x cheaper per request than cloud APIs for image recognition tasks, while also eliminating latency variability and privacy risks. The table below summarizes the trade-offs.

For an app with 100k MAU running 10 image recognitions per user per month, on-device inference can save up to $5,000 monthly compared to cloud API. Get a free consultation on your ML architecture today.

Integrating OpenAI API and Other Cloud Models

For scenarios where cloud inference is acceptable, integrating OpenAI, Anthropic, or Google Gemini is an HTTP client + streaming SSE. In Swift, AsyncThrowingStream is convenient for streaming responses. In Kotlin, use Flow.

Critically: API keys must never be stored in the app bundle. Even an obfuscated key can be extracted from the IPA in 10 minutes using strings or frida. Correct architecture: mobile app → your own backend → OpenAI API. The backend controls rate limiting, logs requests, and protects the key.

What Is Included in the Work (Deliverables)

• Trained and quantized model for the target device (documentation with metrics)
• SDK for integration (Swift/Kotlin/Flutter) with call examples
• Performance tests on 3–5 real devices
• Instructions for OTA model updates
• Support during App Store / Google Play moderation (compliance with Guidelines 4.2, 5.1)
• 2 weeks of technical support after release

Typical Project Pipeline

1. Task analysis — measure latency, privacy, size, supported devices.
2. Model prototyping — in Python, evaluate accuracy on target data.
3. Conversion and quantization — for CoreML/TFLite with validation.
4. Integration into the app — model wrapped in a service layer (easy to swap CoreML ↔ TFLite ↔ cloud).
5. Testing — on real devices, measure FPS, RAM, battery.
6. Deployment — via TestFlight / Firebase App Distribution, monitor metrics.

Timelines: integration of a ready CoreML/TFLite model — 1–2 weeks, development of a custom model with mobile optimization — from 6 weeks, on-device LLM chat with personalization — 4–8 weeks.

Why We Take on Complex Cases?

10+ years of experience in mobile development, 50+ implemented AI/ML solutions, guarantee of compatibility with current iOS and Android versions. All projects undergo code review and load testing. The cost includes preparation of moderation documentation and training of your team.

Contact us — we will help you choose the architecture and implement ML in your app turnkey. Order an audit of your existing solution — we will assess the potential for server cost savings free of charge. In some projects, savings can reach significant amounts per month.