DEV Community: Huzaifa Zahoor

Is That Canadian Crypto Exchange Actually Regulated? A Developer's Verification Checklist (Plus the $30K Limit in Python)

Huzaifa Zahoor — Mon, 26 Oct 2026 08:44:10 +0000

If you live in Canada and use a crypto app, there's a good chance its website says "licensed" or "compliant" somewhere near the footer. Those words can mean very different things. Some platforms are registered with securities regulators and supervised on how they hold client assets. Others only have an anti-money-laundering registration, which says nothing about custody.

As developers we already know this pattern: a badge in a README isn't the same as a passing test. This post treats "is this exchange regulated?" as a verification problem, and ends with a small Python model of the $30,000 purchase limit that registered Canadian platforms enforce.

For the full, up-to-date list of registered platforms and what each label means, see this guide to regulated crypto exchanges in Canada and how to check one.

Two registrations that look alike but aren't

Canada has no single national securities regulator. Each province runs its own, and they coordinate through the Canadian Securities Administrators (CSA). When a platform holds your coins and you only hold a claim on them, regulators treat that as a securities matter, so the platform has to register as a dealer.

There's a second, separate registration with FINTRAC, Canada's financial intelligence agency, as a money services business. That one is about anti-money-laundering checks and KYC. It doesn't mean anyone is reviewing how customer coins are stored.

So "registered" is ambiguous until you know which registry. If you're building anything that routes users or funds to an exchange, that distinction belongs in your design notes.

The status labels, decoded

On provincial lists you'll mostly see two categories:

Restricted dealer: an interim category. The platform can only do what its specific terms and conditions allow.
Investment dealer: the same category traditional brokerages use, with membership in CIRO, the national self-regulatory body, and its capital, audit and conduct rules.

Since 2024 the direction of travel has been for crypto platforms to move toward investment dealer status. Both labels mean a regulator has looked at the business. Neither means your crypto is insured.

Verification as a checklist, not a vibe

Here's the process, written the way I'd write a runbook:

Resolve the legal entity. The brand name isn't what gets registered. Look in the terms of service for the operating company.
Query the source of truth. Search that entity on the CSA's list of authorized crypto trading platforms or its National Registration Search, then check your own province's page. Never trust a "regulated" badge on the company's own site.
Check for province scope. Registration is granted province by province. A platform can be fine in Ontario and absent elsewhere.
Search the warnings lists. Regulators publish investor alerts about unregistered firms. A match there is a hard stop.
Diff the offering against the rules. If an app offers high-leverage derivatives to Canadian retail users, that's a strong signal it isn't on the registered list.

Lists also drift. The NutshellCrypto guide points out a platform shown as an investment dealer on one provincial page and a restricted dealer on another. Treat any cached copy as stale and re-check the live page.

Modeling the $30,000 limit in Python

Registered platforms apply an investment limit for many retail clients: a net maximum of $30,000 CAD over 12 months on coins outside a "specified" set. Bitcoin, Ether, Bitcoin Cash, Litecoin and approved stablecoins are excluded, and sales count back toward your room. Provinces and platforms apply it a bit differently, so treat this as a simplified model, not your platform's exact formula.

from datetime import date, timedelta

LIMIT_CAD = 30_000
EXEMPT = {"BTC", "ETH", "BCH", "LTC", "USDC"}  # check your platform's own list

trades = [  # (date, asset, side, CAD amount)
    (date(2026, 1, 10), "SOL", "buy", 12_000),
    (date(2026, 3, 2), "BTC", "buy", 25_000),   # exempt, doesn't count
    (date(2026, 5, 20), "LINK", "buy", 15_000),
    (date(2026, 7, 1), "SOL", "sell", 4_000),   # sales free up room
]

def remaining_room(trades, today):
    start = today - timedelta(days=365)
    net = 0
    for d, asset, side, cad in trades:
        if asset in EXEMPT or not (start < d <= today):
            continue
        net += cad if side == "buy" else -cad
    return LIMIT_CAD - max(net, 0)

print(remaining_room(trades, date(2026, 10, 26)))  # 7000
print(remaining_room(trades, date(2027, 1, 15)))   # SOL buy aged out -> 19000

The interesting part is the rolling window: room comes back as old buys age past 12 months. If you're reconciling your own exports, this also explains why a purchase that was blocked last month might go through today.

What registration doesn't cover

Crypto held at a member firm isn't eligible for CIPF coverage (cash and crypto funds can be, the coins themselves can't).
Deposit insurance doesn't cover crypto either.
No regulator stops a coin from dropping 50%, and a transfer to the wrong address usually can't be reversed.

That's why many people keep only what they actively trade on any exchange and move long-term holdings to a wallet they control.

Takeaways

"Licensed" is meaningless until you know which registry it refers to.
Verify the legal entity on the CSA and provincial lists, not the company's site.
Registration is per province, and lists change often.
The $30,000 limit is a rolling 12-month net figure on non-specified coins.
Registration reduces some risks but doesn't insure your crypto.

Read the full guide on NutshellCrypto

This is educational content, not financial or legal advice.

This post was written with AI assistance.

What Failed Crypto Exchanges Teach Developers About Custody Risk (Plus a Merkle Proof Check in Python)

Huzaifa Zahoor — Sun, 25 Oct 2026 08:42:39 +0000

Every few years a crypto exchange stops processing withdrawals, and a lot of people learn the same lesson the hard way: a balance on an exchange is a number in someone else's database, not coins you control.

Mt. Gox, QuadrigaCX, Cryptopia, Thodex, FTX and Bittrex's US business all failed for different reasons. Read their histories side by side, though, and the failure modes start to look like bugs in a system design. That's the angle of this post: what went wrong, why it matters if you build or use crypto products, and one small verification you can actually run.

For the full list of collapses, dates and recovery figures, see this list of failed crypto exchanges and what customers got back.

The failures were mostly not about price

It's tempting to think exchanges die in crashes. Most of the big ones didn't. They failed because of:

Theft. Mt. Gox lost around 850,000 BTC (about 200,000 were later found). Cryptopia lost roughly a tenth of its assets in a 2019 hack.
Insider misuse of funds. Canada's securities regulator found QuadrigaCX's collapse came from its founder's fraud, with fake accounts and made-up balances. At FTX, an $8 billion hole appeared once withdrawals spiked.
Regulators or law enforcement stepping in. BTC-e was seized by US authorities. Bittrex shut its US business weeks after an SEC complaint.

In engineering terms: the single source of truth (the exchange's internal ledger) diverged from reality, and nobody outside could see it until withdrawals stopped.

Withdrawals are the health check

In almost every case, the first public symptom was paused or slow withdrawals, usually explained as "technical issues" or "market conditions." If you run anything that holds funds on an exchange, such as a trading bot, a treasury, or a payment flow, it's worth treating withdrawal latency as a metric. Alert on it the way you'd alert on API error rates.

Recovery is also slow. Mt. Gox creditors waited about a decade, Cryptopia users nearly six years, and FTX customers more than two. FTX paid claims in US dollars at November 2022 prices, so people got dollars back, not the coins they'd held. In the US, FDIC deposit insurance doesn't cover crypto at all.

Proof of reserves: what you can verify yourself

After FTX, many exchanges started publishing "proof of reserves," often with a Merkle tree of customer balances. The idea: the exchange hashes every account balance into a tree and publishes the root. You get a proof showing your leaf is part of that tree.

Here's a minimal, self-contained version of that inclusion check:

import hashlib

def h(data: bytes) -> bytes:
    return hashlib.sha256(data).digest()

def leaf(account_hash: str, balance_sats: int) -> bytes:
    return h(f"{account_hash}:{balance_sats}".encode())

def build_tree(leaves):
    levels = [leaves]
    while len(levels[-1]) > 1:
        cur = levels[-1]
        if len(cur) % 2:
            cur = cur + [cur[-1]]  # duplicate last node on odd levels
        levels.append([h(cur[i] + cur[i + 1]) for i in range(0, len(cur), 2)])
    return levels

def proof_for(levels, index):
    proof = []
    for level in levels[:-1]:
        if len(level) % 2:
            level = level + [level[-1]]
        sib = index ^ 1
        proof.append((level[sib], "left" if sib < index else "right"))
        index //= 2
    return proof

def verify(my_leaf, proof, published_root):
    node = my_leaf
    for sibling, side in proof:
        node = h(sibling + node) if side == "left" else h(node + sibling)
    return node == published_root

if __name__ == "__main__":
    accounts = [("a1f3", 50_000), ("b7c2", 1_200_000), ("c9d0", 75_000),
                ("me42", 310_000), ("e5aa", 9_000)]
    levels = build_tree([leaf(a, b) for a, b in accounts])
    root = levels[-1][0]
    proof = proof_for(levels, 3)
    print("my balance included:", verify(leaf("me42", 310_000), proof, root))
    print("tampered balance included:", verify(leaf("me42", 31_000), proof, root))

Running it prints True for the real balance and False for a tampered one. Real exchanges use their own leaf formats (often with salts and per-asset balances), so read their docs before adapting this.

Know the limits, too. An inclusion proof shows your balance was counted. It doesn't prove the exchange has no hidden debts, that the reserve wallets weren't borrowed for the snapshot, or that things are still fine a week later. It's a useful signal, not a guarantee.

Lowering your own exposure

The original guide's advice translates well to how developers think about risk:

Minimize blast radius. Keep only what you're actively trading on an exchange. Long-term holdings belong in self-custody, and moving funds to a cold wallet is a one-time setup.
Prefer regulated venues. Licensing adds custody and disclosure rules. It doesn't remove risk.
Question yield. Celsius and Voyager paid interest by lending out customer crypto. If a return appears, ask where it comes from.
Keep your own records. Export statements and trade history regularly. If a platform fails, you'll need them for a claim and for taxes.

Takeaways

Exchange balances are IOUs; the ledger can diverge from reality.
Slow withdrawals have preceded nearly every major collapse, so monitor them.
Merkle proofs of reserves are verifiable, but they only prove inclusion.
Recovery usually takes years and may be paid in dollars, not coins.
Self-custody and good record-keeping shrink your exposure.

Read the full guide on NutshellCrypto

This is educational content, not financial or legal advice.

This post was written with AI assistance.

Fake Volume Is a Data Quality Bug: Spotting Crypto Wash Trading With a Few API Calls

Huzaifa Zahoor — Sat, 24 Oct 2026 08:39:24 +0000

If you've ever built a dashboard on top of crypto market data, you've probably sorted something by 24-hour volume. It's the default "is anyone actually using this?" signal. The uncomfortable part is that volume is one of the easiest numbers in crypto to fake.

The technique is called wash trading: one person or group trades with themselves, again and again, so a market looks busy. No ownership really changes hands. If you treat volume as ground truth in your app, scanner, or trading bot, you are ingesting manipulated data.

This post looks at wash trading the way a developer would: as a data quality problem you can partly detect.

What wash trading actually is

The CFTC describes wash trades as trades made to give the appearance of buying and selling without taking on market risk or changing the trader's position. You're on both sides, so nothing really happens except fees and a bigger volume number.

A toy version: a team controls Wallet A and Wallet B. A sells 100,000 tokens to B, then B sells them back a few seconds later. A bot loops that a couple of thousand times a day and the token suddenly "trades" tens of millions of dollars. The team still holds the same coins.

Why bother? Higher volume moves a token up trending and top-volume lists, can help with exchange listings, sets up pump-and-dumps, inflates exchange rankings, and farms volume-based rewards or airdrop points.

For the full breakdown of motives, real enforcement cases, and the legal side, see this plain-English guide to crypto wash trading and fake volume.

CEX vs DEX: different plumbing, same trick

On a centralized exchange, the manipulator uses multiple accounts or a market maker's bot to place matching buy and sell orders. You only see the exchange's reported numbers, so you're trusting their data feed.

On a DEX, every trade is on-chain and costs gas, which makes faking volume more expensive but not impossible. A common pattern is one controller wallet funding many fresh wallets, which then trade in the same pool so activity looks spread out.

One caution for anyone writing detection code: fast back-and-forth trading is not automatically wash trading. Arbitrage and MEV bots also hammer the same pairs within seconds, for legitimate (if competitive) reasons. That's why external heuristics produce red flags, not verdicts.

A quick red-flag check in Python

Here's a small script using CoinGecko's public API. It doesn't prove anything; it flags tokens where the numbers don't hang together.

import json
import urllib.request

def get(url):
    req = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(req, timeout=20) as r:
        return json.load(r)

def red_flags(coin_id):
    data = get(f"https://api.coingecko.com/api/v3/coins/{coin_id}"
               "?localization=false&tickers=true&community_data=false&developer_data=false")
    md = data["market_data"]
    vol = md["total_volume"].get("usd") or 0
    mcap = md["market_cap"].get("usd") or 0
    flags = []

    # 1. Volume far larger than the whole market cap
    if mcap and vol / mcap > 1:
        flags.append(f"24h volume is {vol / mcap:.1f}x market cap")

    # 2. Volume concentrated on one venue
    tickers = data.get("tickers", [])
    by_venue = {}
    for t in tickers:
        name = t["market"]["name"]
        by_venue[name] = by_venue.get(name, 0) + (t.get("converted_volume", {}).get("usd") or 0)
    total = sum(by_venue.values())
    if total:
        top_venue, top_vol = max(by_venue.items(), key=lambda kv: kv[1])
        if top_vol / total > 0.8:
            flags.append(f"{top_vol / total:.0%} of ticker volume on {top_venue}")

    return flags

if __name__ == "__main__":
    for coin in ["bitcoin", "ethereum"]:
        print(coin, red_flags(coin) or "no obvious red flags")

Swap in any CoinGecko coin ID. Note that the tickers list is paginated and the free API is rate-limited, so treat this as a sketch, not a production monitor.

The two checks mirror classic warning signs, and a third is worth doing by eye:

Volume vs market cap. A small token trading several times its entire value daily, with few holders, deserves suspicion.
Venue concentration. If nearly all activity sits on one small exchange and big regulated venues show little, the "demand" may not be real.
Pair trust scores. CoinGecko's Trust Score on its website looks at things like spread, order book depth and trade patterns. In my testing the free API returned no trust score on tickers, so check it on the coin's markets page. Lots of volume on red or unrated pairs is worth noticing.

Other checks worth adding if you go further: compare volume to ±2% order book depth, look for volume spikes with no price movement, and on DEXs, cluster wallets by common funding source.

Don't confuse it with the wash sale rule

Different thing entirely. A wash sale is a tax rule about claiming a loss and rebuying within 30 days. If you're scripting tax tooling, that's a separate rabbit hole.

Takeaways

Treat reported crypto volume as untrusted input, especially for small tokens on small venues.
Combine several heuristics; no single one proves wash trading.
Don't flag arbitrage and MEV activity as manipulation by default.
Regulated, larger venues tend to show much cleaner data.
If your product ranks or alerts on volume, show users the caveats.

Read the full guide on NutshellCrypto

This is educational content, not financial advice.

This post was written with AI assistance.

Stablecoin Depegs for Developers: Why 1 USDT Isn't Always $1 (Plus a Python Peg Monitor)

Huzaifa Zahoor — Fri, 23 Oct 2026 08:41:17 +0000

If you've ever built anything that touches crypto payments, a treasury wallet, or a DeFi integration, you've probably treated stablecoins as "basically dollars." That's a reasonable default most of the time. But a stablecoin is a promise to be worth $1, and promises can break. When they do, it's called a depeg, and it's worth understanding before your code (or your savings) assumes 1 USDT always equals $1.

This post looks at depegs the way an engineer would: what holds the peg up, the failure modes, and a small script to watch prices yourself. For the full plain-English breakdown, with a history table and a safety checklist, NutshellCrypto has a guide on whether stablecoins are safe and why they depeg.

The peg is a feedback loop, not a constant

Fiat-backed coins like USDT and USDC live in two markets. In the primary market, approved firms mint new tokens by sending dollars to the issuer, or redeem tokens for dollars. In the secondary market, everyone else trades existing tokens on exchanges and DeFi apps.

Arbitrage connects the two. If the token trades at $0.99, someone buys it cheaply and redeems it for $1. If it trades at $1.01, someone mints at $1 and sells. That pressure pulls the price back toward $1.

The catch is that this loop only works while people trust the issuer can actually pay. If that trust cracks, holders race to redeem first, which looks a lot like a bank run. So the peg is less like a hard-coded constant and more like a control system that can saturate.

Four ways the loop breaks

Most depegs trace back to one of these:

Doubts about the reserves. Unclear reports or risky assets make people sell first and ask questions later.
Reserves that are stuck. Good assets don't help if they're frozen at a failed bank. USDC dipped to around $0.88 in March 2023 when part of its cash sat at Silicon Valley Bank, then recovered once depositors were protected.
Crypto collateral that crashes. Crypto-backed coins are over-collateralized, but fast price drops trigger forced sales, the same mechanism behind liquidations in leveraged trading.
Design with no real backing. Algorithmic coins hold the peg with code and a companion token. When confidence drops, the two drag each other down. TerraUSD in 2022 is the textbook case.

Venue depeg vs backing depeg

This distinction matters for anyone building on top of price feeds. A venue depeg happens when one exchange runs out of buyers: the coin dips there but stays near $1 everywhere else, and redemptions keep working. A backing depeg happens everywhere at once, because the market believes the reserves are worth less than $1.

If your app reads a price from a single exchange, a venue depeg can look like a disaster that isn't one. If you average across many venues, you'll smooth out real signals too. Knowing which kind you're looking at is half the battle.

Watch the peg yourself with a few lines of Python

You don't need a paid data feed to keep an eye on the big coins. DefiLlama's public stablecoins endpoint returns prices and circulating supply. Here's a minimal checker:

import requests

URL = "https://stablecoins.llama.fi/stablecoins?includePrices=true"
WATCH = {"USDT", "USDC", "DAI", "USDE"}
WARN, ALERT = 0.005, 0.02  # 0.5% and 2% away from $1

coins = requests.get(URL, timeout=20).json()["peggedAssets"]
for c in coins:
    sym, price = c["symbol"].upper(), c.get("price")
    if sym not in WATCH or c.get("pegType") != "peggedUSD" or price is None:
        continue
    gap = abs(price - 1.0)
    status = "ALERT" if gap >= ALERT else "warn" if gap >= WARN else "ok"
    supply = c["circulating"]["peggedUSD"] / 1e9
    print(f"{sym:5} ${price:.4f}  gap {gap:.2%}  supply ${supply:,.1f}B  {status}")

When I ran it on October 23, 2026, all four coins were within about 0.1% of $1. A few ideas to extend it:

Run it on a schedule and send a message only when the status changes.
Track supply over time. A fast drop in circulating supply means heavy redemptions, which often comes before or alongside a backing depeg.
Compare against a second source (an exchange ticker, an on-chain DEX pool) to tell a venue depeg from a broad one.

Treat any single feed as one opinion, not ground truth.

Practical habits

Don't hard-code 1 stablecoin == $1 in accounting or risk logic. Read a price and handle the edge case.
Spread large balances across more than one issuer if they matter to you.
Know how you'd exit: which venue, which pair, and how fast.
Remember stablecoins aren't bank deposits and aren't covered by deposit insurance.

If you're newer to the basics, start with this explainer on what stablecoins are and how the main types work, then compare the two biggest coins in USDT vs USDC.

Key takeaways

A stablecoin's peg is held by arbitrage and trust, and both can fail.
Depegs come from reserve doubts, stuck reserves, collateral crashes, or flawed design.
A venue depeg is local; a backing depeg is everywhere. Your data source decides which one you see.
A small script on a public API is enough to monitor the big coins.

Read the full guide on NutshellCrypto

This is educational content, not financial advice. Do your own research before holding any stablecoin.

This post was written with AI assistance.

Before You Ship a Crypto Trading Bot: API Key Scopes, Kill Switches, and Honest Backtests

Huzaifa Zahoor — Thu, 22 Oct 2026 08:39:09 +0000

Every developer who gets into crypto eventually has the same thought: "I could write a bot for this." And you can. Most big exchanges expose an API, and the core loop of a trading bot fits on one screen. The hard part isn't the loop. It's everything around it: the key you hand the bot, what happens when it misbehaves at 3 a.m., and whether the backtest that convinced you was ever honest.

This post looks at automated trading the way you'd look at any production service that can spend money. For the plain-English background on bot types and their risks, NutshellCrypto has a full explainer on how automated crypto trading and trading bots work.

A bot is just a loop with a wallet attached

Strip away the marketing and nearly every bot does the same four things: read data (prices, the order book, or just the clock), compare it against rules, place or cancel orders, then repeat. It has no idea where the price is going. A recurring buy, a grid bot and a moving-average crossover bot are all variations on that loop with different rules.

That framing matters because it tells you where the risk lives. The rules can be wrong, the code can be buggy, and the credentials can leak. None of those risks shrink because the bot calls itself "AI".

Treat the API key like a production secret

Your bot talks to the exchange with an API key and secret. Whoever holds that pair can do whatever its permissions allow, so scope it the way you'd scope a cloud IAM role:

Trade-only. The bot needs to place and cancel orders. It almost never needs withdrawal permission, so leave that off.
IP allowlist. If the exchange supports it, lock the key to the server your bot runs on. A leaked key that only works from one IP is far less useful to a thief.
One key per bot. Separate keys make it obvious what to revoke when something goes wrong.
No secrets in the repo. Load them from environment variables or a secrets manager, rotate them, and delete keys you no longer use.

Even a trade-only key isn't harmless. Someone with it can still place terrible trades on your account, so 2FA on the exchange account and a quick revocation path still matter.

Put guardrails outside the strategy

The strategy decides what to do. Guardrails decide what the bot is never allowed to do, no matter what the strategy says. Keep them in a separate layer so a bug in one doesn't disable the other. Here's a minimal sketch with a dry-run mode (no exchange calls, illustrative limits):

import os

MAX_ORDER_USD = 25.0       # hard cap per order
MAX_DAILY_USD = 100.0      # hard cap per day
DRY_RUN = os.getenv("DRY_RUN", "1") == "1"

class GuardrailError(Exception):
    pass

class Guardrails:
    def __init__(self):
        self.spent_today = 0.0

    def check(self, side, usd_amount):
        if os.path.exists("KILL_SWITCH"):
            raise GuardrailError("kill switch file present, refusing to trade")
        if side not in ("buy", "sell"):
            raise GuardrailError(f"unknown side {side!r}")
        if usd_amount <= 0 or usd_amount > MAX_ORDER_USD:
            raise GuardrailError(f"order size {usd_amount} outside limits")
        if self.spent_today + usd_amount > MAX_DAILY_USD:
            raise GuardrailError("daily limit reached")

    def place(self, side, usd_amount, send_order):
        self.check(side, usd_amount)
        if DRY_RUN:
            print(f"[dry run] would {side} ${usd_amount:.2f}")
        else:
            send_order(side, usd_amount)
        self.spent_today += usd_amount

g = Guardrails()
g.place("buy", 25.0, send_order=None)   # prints a dry-run line

A few habits worth copying: default to dry run, make the kill switch something you can trigger without a deploy (a file, a flag, a revoked key), and log every intended order before it's sent so you can reconstruct what happened.

Backtests lie politely

A backtest replays your rules over historical data. It's useful, and it's also the easiest place to fool yourself. If you tweak parameters until the equity curve looks great, you've likely fitted noise rather than found an edge. That's overfitting, and it tends to fall apart on new data.

To keep it honest, test across different market conditions, include every cost (maker/taker fees, spread, slippage), hold out a period you never tuned on, and then paper trade before going live. A bot that trades often can hand most of its gross gains back in fees.

The simplest bot is often the sensible one

The lowest-risk automation is a plain recurring buy: a fixed amount on a fixed schedule, no prediction involved. If you want to see what that looks like with your own numbers before writing any code, NutshellCrypto has a free crypto DCA calculator and a guide to dollar cost averaging in crypto.

Leverage is the opposite end. A bot trading futures or margin can get a position force-closed after a short run of small mistakes, which is why spot-only is the safer place to learn.

Spotting the scams

Regulators such as the CFTC, SEC and FTC repeatedly warn that "trading bot" is a favorite cover story for fraud. Red flags: guaranteed or fixed returns, being asked to deposit funds into the bot company's own wallet, surprise "fees" before withdrawals, and "AI" claims with no explanation of the actual strategy. Real automation runs against your exchange account with a key you control.

Takeaways

A bot follows rules; it can't predict prices.
Scope API keys to trade-only, add an IP allowlist, and keep secrets out of your repo.
Keep guardrails (order caps, daily caps, kill switch) separate from strategy code.
Count fees and slippage, hold out data, and paper trade before risking money.
Guaranteed returns are a scam signal, not a feature.

Read the full guide on NutshellCrypto

This is educational content, not financial, investment or tax advice. Automated strategies can lose money.

This post was written with AI assistance.

OTC Crypto Desks for Developers: Order-Book Slippage, RFQ Quotes, and Who Sends First

Huzaifa Zahoor — Wed, 21 Oct 2026 08:38:45 +0000

If you've only ever bought crypto through an exchange UI, every trade looks like the same thing: pick an amount, hit buy, done. Large trades often don't work that way. Funds, companies and big holders frequently go "over the counter" (OTC), asking a trading desk for one private price instead of hitting the public order book.

As a developer, the interesting part is that OTC exists because of a mechanical problem you can model in a few lines of code. This post walks through that problem, how a request-for-quote (RFQ) flow behaves, and the risks that live outside the code. For the complete explainer, see NutshellCrypto's guide on how OTC crypto trading desks work.

The problem: a big market order walks the book

An exchange order book only holds so much size at each price. A large market buy eats the cheapest asks first, then keeps paying more for whatever is left. That gap between the price you expected and the price you actually got is slippage.

Here's a toy model with made-up numbers (not real market data):

# Illustrative numbers only, not real market data.
asks = [(100.0, 10), (101.0, 10), (103.0, 10)]  # (price, size) best first

def walk_book(asks, qty):
    cost, left = 0.0, qty
    for price, size in asks:
        take = min(size, left)
        cost += take * price
        left -= take
        if left == 0:
            return cost
    raise ValueError("not enough liquidity on the book")

qty = 30
book_cost = walk_book(asks, qty)
best = asks[0][0]
avg = book_cost / qty
print(f"order book: total ${book_cost:,.2f}, avg ${avg:.2f}, "
      f"slippage vs best ask {100 * (avg - best) / best:.2f}%")

otc_quote = 101.0  # one all-in price for the full size
print(f"OTC quote:  total ${otc_quote * qty:,.2f}, "
      f"saves ${book_cost - otc_quote * qty:,.2f}")

Output:

order book: total $3,040.00, avg $101.33, slippage vs best ask 1.33%
OTC quote:  total $3,030.00, saves $10.00

On a real book the levels thin out much faster for large sizes, and everyone watching sees the price jump while you buy. An OTC desk instead quotes one firm price for the whole block and takes on the job of sourcing the coins across venues and over time.

RFQ: a quote with a very short TTL

The OTC flow is basically an RFQ protocol:

Onboard. KYC and anti-money-laundering checks first. Legit desks don't skip them.
Request. "Buy 20 BTC with USD", by chat or through an RFQ screen or API.
Quote. The desk returns one all-in price for the full size.
Accept or expire. Quotes are short-lived. Coinbase Prime, for example, documents holding an RFQ price for 3 seconds in its interface and 1 second via API, and its RFQ orders are fill-or-kill: all or nothing.
Settle. Coins and cash (or stablecoins) move between the two sides.

If you're building anything on top of an RFQ API, treat the quote like a lease with an expiry timestamp: check it locally before you accept, never retry an accept blindly, and handle the "expired" and "rejected" paths as normal outcomes rather than exceptions.

Minimums are real too. Kraken's OTC desk, for instance, lists a $50,000 USD-equivalent minimum, so this isn't a route most retail buyers need.

Principal vs agency, in code terms

Principal desk: the desk is your counterparty. It sells you its own inventory at a firm price and keeps the market risk. Its margin is inside the spread.
Agency desk: the desk is a router. It works your order across markets for a commission, so the price can move while it's filling, and more of that risk stays with you.

When comparing, compute the all-in cost: quoted price times amount, plus any commission, wire, network or withdrawal fees. NutshellCrypto has a separate breakdown of crypto exchange fees and spreads if you want to model the exchange side properly.

The risks your code can't fix

Counterparty risk. You depend on one company to deliver. Genesis, once a major institutional trading provider, froze lending redemptions in November 2022 and later stopped offering trading services entirely.
Settlement risk. Whoever sends first is exposed until the other side delivers. Know exactly who sends what, when, and to which verified account or wallet.
Fake "OTC brokers". Telegram and social media are full of them, offering below-market coins or "private allocations" and then demanding extra fees before you can withdraw. Reach desks only through a firm's official website, verify payment details through a second channel, and never share a recovery phrase.
Taxes. An OTC trade is taxed like any other crypto trade, so keep records of each one.

Takeaways

OTC exists because large market orders walk the book and slip.
An RFQ quote is a short-lived, often fill-or-kill price; design for expiry.
Principal desks take the risk and earn the spread; agency desks route and charge a fee.
Counterparty and settlement risk matter as much as the price.
For small buys, a normal exchange order book is usually enough.

Read the full guide on NutshellCrypto

This is educational content, not financial, investment or tax advice.

This post was written with AI assistance.

Polkadot Staking in 2026, Straight From the Chain: Minimums, 2-Day Unbonding, and a Python Check

Huzaifa Zahoor — Tue, 20 Oct 2026 08:45:34 +0000

If you search for how DOT staking works, a lot of what comes back is stale. Older tutorials still talk about a 28-day lock-up, slashing risk for nominators, and double-digit yields. Polkadot changed most of that through on-chain governance in 2025 and 2026, so the safest habit is the one developers already have: read the live state instead of trusting a blog post, including this one.

This post covers what changed, what the numbers mean, and a short Python script that pulls the key staking values from Polkadot Hub yourself. For the full walkthrough (wallets, pools vs direct nominating, unstaking steps, US and Canada taxes), see NutshellCrypto's Polkadot staking guide on how to stake DOT, rewards and risks.

The model in one paragraph

Polkadot uses Nominated Proof-of-Stake. Validators run the nodes. Nominators bond DOT and pick up to 16 validators to back, and the protocol decides which of those picks your stake actually supports each era (about 24 hours). Your DOT never leaves your account; bonding locks it, it doesn't send it anywhere. You can nominate directly from 250 DOT, or join a nomination pool from 1 DOT and let the pool operator choose validators.

What's different now

A few changes matter if your mental model is from 2024:

Staking moved to Polkadot Hub. In November 2025, balances, staking and governance migrated from the Relay Chain to Asset Hub (now Polkadot Hub). Wallets and the Staking Dashboard read your position from there.
Nominators can't be slashed. Since July 6, 2026, nominator slashing is switched off by governance. Validators still carry slashing risk and must self-bond at least 10,000 DOT.
Unbonding is about 2 days. Nominator unbonding dropped from 28 days to 2 eras. Requests started before the change stay on the old schedule unless you rebond and unbond again.
Commission is 0% and issuance is lower. Validator commission was set to 0%, and yearly issuance was cut sharply in March 2026, so yields are now low single digits. The NutshellCrypto guide worked it out to roughly 2.8% a year before any pool fee on October 20, 2026.

Those are governance settings, not permanent laws of physics. That's exactly why checking the chain is worth a few lines of code.

Reading the live values with Python

Polkadot exposes storage through public RPC nodes, and the substrate-interface package decodes it using the chain's own metadata. Install it in a virtual environment:

python3 -m venv .venv && . .venv/bin/activate
pip install substrate-interface

Then query the values a new staker actually cares about:

from substrateinterface import SubstrateInterface

PLANCK = 10**10  # 1 DOT = 10^10 planck
hub = SubstrateInterface(url="wss://polkadot-asset-hub-rpc.polkadot.io")

def dot(value):
    return int(value) / PLANCK

def q(pallet, item):
    return hub.query(pallet, item).value

print("Current era:       ", q("Staking", "CurrentEra"))
print("Min nominator bond:", dot(q("Staking", "MinNominatorBond")), "DOT")
print("Min active stake:  ", dot(q("Staking", "MinimumActiveStake")), "DOT")
print("Min pool join bond:", dot(q("NominationPools", "MinJoinBond")), "DOT")
print("Nominators:        ", q("Staking", "CounterForNominators"))
print("Validator count:   ", q("Staking", "ValidatorCount"))

When I ran it on October 20, 2026, it printed era 2329, a 250 DOT nominator minimum, a minimum active stake of about 191 DOT, a 1 DOT pool minimum, about 28,300 nominators, and 600 validators. Your output will differ, and that's the point.

How to read the output

Min nominator bond vs min active stake. These are easy to confuse. The first is what you need to start nominating. The second is set by the smallest nominator who made it into the last election, and it moves every era. The election only considers about 22,500 nominators, and there are more registered than that, so a nomination below the active threshold can sit there earning nothing. If you're close to the line, a pool is usually the simpler choice.

Pool minimum. One DOT gets you into a pool, but pools charge their own commission (0% to 10%) and the pool itself has to stay active to earn.

Units. Everything on-chain is in planck. Forgetting the 10^10 divisor is the classic off-by-a-lot bug when you build dashboards or alerts on top of this data.

A few security notes

The Staking Dashboard is a staking app, not a wallet. Your recovery phrase belongs offline and never goes into a website, a "support" DM, or a form.
Direct nominators' rewards must be claimed within 84 eras or they're lost. Validators usually trigger payouts, but if you're building a monitor, this is a good thing to alert on.
Liquid staking tokens skip the unbonding wait but add smart-contract and depeg risk. Know which risk you're taking on.

If you want a contrast, NutshellCrypto's Cosmos Hub staking guide covers a chain where delegators can still be slashed and unbonding takes 21 days. If the whole concept is new, start with what staking in crypto means.

Takeaways

Nominate from 250 DOT, or join a pool from 1 DOT.
Nominators are currently unslashable, and unbonding takes about 2 days.
Yields are low single digits after the 2026 issuance cut.
The minimum active stake moves every era, so check it before you bond.
Query the chain yourself; older guides are often out of date.

Read the full guide on NutshellCrypto

This is for education only and is not financial, tax, or investment advice.

This post was written with AI assistance.

Scripting Your Kraken Tax Exports: Proceeds, Missing Basis, and a Python Sanity Check

Huzaifa Zahoor — Mon, 19 Oct 2026 08:39:34 +0000

Every tax season, someone who writes code for a living opens a folder of exchange exports and thinks, "I'll just script this." That is a good instinct, as long as you know what each file actually means before you start summing columns. Kraken is a useful case study because it hands you several different documents, and they do not all answer the same question.

This post covers the data side: which Kraken files exist, what the IRS receives versus what only you see, and a small Python sanity check you can run on your exports. For the click-by-click download steps, Canada notes, and FAQ, see NutshellCrypto's Kraken tax report guide to the Tax Center, 1099-DA, and CSV exports.

Two places to look, and both are web-only

Kraken splits tax data across two areas, and per Kraken Support neither is available in the mobile apps:

Tax Center (profile icon, then Settings, then Tax Center): IRS forms plus three CSV reports for the selected year.
Document Center (profile icon, then Documents): raw exports such as ledger, trades, balances, and account statements.

The Tax Center CSVs are summaries. The Document Center files are closer to raw events. If your goal is reproducible numbers, keep both, because large exports can take a while to generate and Kraken says finished exports stay downloadable for only about 14 days. Save local copies the day you get them.

Know what each CSV is for

The Tax Center gives you three reports:

Income Report: staking rewards, airdrops, referral bonuses, and similar earnings.
Gain/Loss Report: realized disposals with proceeds, cost basis, and short- or long-term splits.
Transaction History Report: everything for the year, which is the file you want for reconciliation or importing into tax software.

Treat the Gain/Loss Report as a worksheet, not a final answer. Its math depends on the lot method and on whether Kraken actually knows your cost basis.

Proceeds are not profit

This is the part that trips up anyone who "just sums the 1099." For tax year 2025, Kraken reports gross proceeds to the IRS on Form 1099-DA. The cost basis and gain figures on your copy are calculated with FIFO for convenience and were not reported to the IRS for that year. Kraken says that starting with tax year 2026 it will also report basis, acquisition date, and gain or loss for positions acquired on or after January 1, 2026.

So the number on the form is a sales total, not your taxable gain. Your gain is proceeds minus basis, and basis is the field most likely to be wrong or missing.

Missing basis is not zero basis

If you moved coins into Kraken from another wallet or exchange, Kraken often cannot see what you paid. Those rows show blank or unknown basis. Kraken's own FAQ is explicit that missing basis does not mean $0, and treating it as zero overstates your tax. A move between your own wallets is usually not a sale either, which NutshellCrypto covers in its guide to whether transferring crypto is taxable.

A quick sanity check in Python

Here is a small script that flags the two most common data problems before you import anything: disposals with no basis, and trades close enough to midnight on New Year's Eve that a UTC timestamp could push them into a different tax year. Column names differ between export versions, so open your file first and edit the three constants to match its header row.

import csv
import sys
from datetime import datetime, timezone

# Edit these to match the header row of YOUR export.
DATE_COL = "date"
PROCEEDS_COL = "proceeds"
BASIS_COL = "cost_basis"

def parse_time(value):
    dt = datetime.fromisoformat(value.replace("Z", "+00:00"))
    return dt if dt.tzinfo else dt.replace(tzinfo=timezone.utc)

def check(path):
    total, missing, edge = 0.0, [], []
    with open(path, newline="") as f:
        for i, row in enumerate(csv.DictReader(f), start=2):
            total += float(row[PROCEEDS_COL] or 0)
            if not (row.get(BASIS_COL) or "").strip():
                missing.append(i)
            ts = parse_time(row[DATE_COL])
            if (ts.month, ts.day) in ((12, 31), (1, 1)):
                edge.append((i, ts.isoformat()))
    print(f"Total proceeds: {total:,.2f}")
    print(f"Rows with blank basis (fill in, don't assume 0): {missing or 'none'}")
    print(f"Dec 31 / Jan 1 UTC rows to double-check: {edge or 'none'}")

if __name__ == "__main__":
    check(sys.argv[1])

Run it with python check_kraken.py gain_loss_2025.csv. If the total proceeds roughly line up with the 1099-DA, your export is complete. If they don't, pull ledger history from the Document Center before going further.

What the exchange files won't cover

Kraken notes that Kraken Wallet and other DeFi activity are outside the first wave of exchange 1099-DA reporting, and that a 1099-MISC only appears for rewards of $600 or more. Small rewards are still income. If you also use other platforms, keep each one's CSVs separate and label transfers so your software doesn't count a move as a sale.

Takeaways

Download from the web, and save Document Center exports before they expire.
For 2025, the 1099-DA shows gross proceeds, not your gain.
Blank basis means "unknown," never zero.
Watch for UTC date shifts around December 31.
Rewards under $600 and DeFi activity still need your own records.

Read the full guide on NutshellCrypto

This is for education only and is not financial, tax, or investment advice. Talk to a qualified tax professional about your situation.

This post was written with AI assistance.

USDT and USDC Are Not the Same Integer: What Developers Should Check Before Accepting Either

Huzaifa Zahoor — Sat, 17 Oct 2026 08:45:37 +0000

If you build anything that touches payments, a wallet, or a trading bot, you will eventually see code like if token in ("USDT", "USDC"): value = amount. Both read $1.00 on a screen, so it is tempting to treat them as the same dollar. They are not. They come from different issuers, hold different reserves, follow different rules, and on-chain they are separate contracts with their own admin powers.

This post is the developer checklist: what actually differs, and a small Python script that reads both contracts directly. For the full side-by-side (issuers, reserve breakdowns, ratings, chains), see NutshellCrypto's USDT vs USDC comparison of reserves, rules, and risks.

Two issuers, two balance sheets

USDT is issued by Tether, launched in 2014, and is the bigger coin: about $183.5B market cap versus about $72.6B for USDC, per CoinGecko on October 16, 2026. USDC is issued by Circle, whose parent is listed on the NYSE.

The backing is where they split:

USDT reported $187.75B in reserves against $183.64B in liabilities on June 30, 2026. Most of it is Treasury bills and repos, but it also holds gold, bitcoin, and secured loans. Checks are quarterly attestations.
USDC reported $73.40B in reserves for $73.32B in circulation on August 31, 2026, almost all in a BlackRock-managed government money market fund plus bank cash. Checks are monthly.

So USDT has a bigger cushion made partly of volatile assets; USDC has a thin cushion made of very liquid ones. If your app holds large balances for users, that difference belongs in your risk notes, not just your UI.

Don't hardcode 1.00

Both coins have broken the peg briefly. USDT fell to about $0.92 in October 2018 and around $0.95 during the TerraUSD collapse in May 2022. USDC dropped to about $0.88 in March 2023 when Circle had reserves stuck at Silicon Valley Bank. Each recovered, but a bot or accounting system that assumed exactly $1 would have mispriced positions during those windows.

Practical rule: price stablecoins from a feed like any other asset, and alert when the price drifts outside a band you choose.

Same ticker, different contracts per chain

USDT and USDC both live on many networks, and every version is a separate token contract. USDT is mostly on Tron and Ethereum; USDC is mostly on Ethereum, with Circle listing native USDC on dozens of chains. Sending USDT on Tron to an address that only watches Ethereum is a classic way to lose funds.

For developers that means:

Key your token registry by (chain, contract_address), never by ticker.
Read decimals() from each contract instead of assuming. Both use 6 on Ethereum, but bridged or chain-specific versions don't have to match.
Show users the network clearly before they send. NutshellCrypto's guide to wallet addresses and networks covers the user side of this.

Both can freeze your tokens

This surprises people who assume self-custody means nobody can touch their balance. Both issuers can blacklist addresses at the contract level, usually for law enforcement or sanctions requests. Your keys still control the address, but the token contract can refuse to move the balance.

You can check this yourself. The script below calls the Ethereum mainnet contracts over plain JSON-RPC (standard library only) and reads decimals, total supply on that chain, and whether a given address is blacklisted. Note the two contracts even spell the function differently: USDT uses isBlackListed, USDC uses isBlacklisted.

import json, urllib.request

RPC = "https://ethereum-rpc.publicnode.com"
TOKENS = {
    "USDT": ("0xdAC17F958D2ee523a2206206994597C13D831ec7", "0xe47d6060"),  # isBlackListed(address)
    "USDC": ("0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", "0xfe575a87"),  # isBlacklisted(address)
}
DECIMALS, TOTAL_SUPPLY = "0x313ce567", "0x18160ddd"

def eth_call(to, data):
    body = json.dumps({"jsonrpc": "2.0", "id": 1, "method": "eth_call",
                       "params": [{"to": to, "data": data}, "latest"]}).encode()
    req = urllib.request.Request(RPC, body, {"Content-Type": "application/json",
                                             "User-Agent": "stable-check/0.1"})
    with urllib.request.urlopen(req, timeout=15) as r:
        return int(json.load(r)["result"], 16)

def check(wallet):
    arg = wallet.lower().removeprefix("0x").rjust(64, "0")
    for name, (token, blacklist_sel) in TOKENS.items():
        dec = eth_call(token, DECIMALS)
        supply = eth_call(token, TOTAL_SUPPLY) / 10**dec
        frozen = bool(eth_call(token, blacklist_sel + arg))
        print(f"{name}: decimals={dec}  supply on Ethereum={supply:,.0f}  frozen={frozen}")

check("0x000000000000000000000000000000000000dEaD")

Swap in any address you want to inspect. Public RPCs rate-limit, so use your own node or provider for anything beyond a quick check.

Rules decide what you can list

Regulation now shapes which coin a product can offer. USDC is an authorized e-money token under the EU's MiCA rules, and major exchanges restricted USDT trading for EU users. Canada's registered platforms offer USDC but not USDT. In the US, the GENIUS Act sets up licensing for stablecoin issuers, and Tether's US-regulated option is a separate token, USAT. If you ship to multiple regions, your supported-asset list may need to vary by jurisdiction.

Takeaways

Treat USDT and USDC as different assets with different issuers and reserve profiles.
Never hardcode a $1 price; monitor drift like any other asset.
Identify tokens by chain and contract address, and read decimals() per contract.
Both issuers can freeze addresses at the contract level, so check before you rely on a balance.
Regional rules (MiCA, Canada, the GENIUS Act) can decide which coin you're allowed to offer.

New to the basics? NutshellCrypto's explainer on what stablecoins are and how the peg works is a good starting point.

Read the full guide on NutshellCrypto

This is for education only and is not financial or investment advice.

This post was written with AI assistance.

Cosmos Hub Staking for Developers: Voting Power, 21-Day Unbonding, and an LCD Check in Python

Huzaifa Zahoor — Fri, 16 Oct 2026 08:40:04 +0000

Most proof-of-stake guides talk about "locking coins with a validator." On the Cosmos Hub that framing is half right and half misleading. When you stake ATOM you are not handing custody to an operator. You are bonding voting power to one of the top 180 validators. Your keys stay yours. What you share is revenue after commission, and proportional slashing if that operator double-signs or stays offline too long.

This post is the developer mental model: what a MsgDelegate actually changes, why exit takes 21 days, how redelegation skips that wait, and a short Python check against a public LCD before you pick a validator. For the full beginner walkthrough (Keplr, Ledger, taxes, Liquid Staking Module), see NutshellCrypto's Cosmos staking guide on how ATOM delegation, rewards, and risks work.

Voting power, not custody

A Cosmos Hub validator cannot withdraw your ATOM. Official docs are clear: delegation moves voting power, not ownership. Your real risks are different:

Slashing. Double-signing is a 5% slash of the validator's total stake (yours included). Prolonged downtime is a 0.01% slash, then jail, if they miss more than 95% of the last 10,000 blocks.
Illiquidity. Undelegating starts a 21-day unbonding period with no rewards. Stake can still be slashed for faults that happened before you started unbonding.
Governance inheritance. If you do not vote on Hub proposals, you inherit your validator's vote. If you do vote, you override it.

That last point is easy to miss if you treat staking like a savings product. On Cosmos, your chosen operator is also your default ballot until you cast your own.

The numbers that actually matter

Live Hub params (they can change via governance):

Item	Typical Hub value
Active set	Top 180 validators by total stake
Unbonding	21 days (`1814400s`)
Bond denom	`uatom` (1 ATOM = 1,000,000 uatom)
Min commission	5% protocol floor (when last checked)
Redelegate	Immediate, with limits on in-flight entries

Rewards come from block provisions and fees after commission. There is no fixed APY. Hub rewards usually sit as claimable until you withdraw them, or until you authorize a restake-style app. Those grants are useful and also a trust boundary: read the permissions and revoke unused ones.

Redelegation is the Hub's pressure valve. If uptime collapses or commission max looks scary, you can move stake without waiting three weeks. Undelegate only when you want liquid ATOM again.

Check Hub params and a validator in Python

Public LCD endpoints expose the staking module. This script prints unbonding time, max validators, min commission, bonded pool size, and basic fields for validator operator addresses (cosmosvaloper...):

import sys
import requests

LCD = "https://cosmos-rest.publicnode.com"  # any reliable Hub LCD
UATOM = 1_000_000


def staking_params():
    p = requests.get(f"{LCD}/cosmos/staking/v1beta1/params", timeout=20).json()["params"]
    return {
        "unbonding_days": int(p["unbonding_time"].rstrip("s")) / 86400,
        "max_validators": p["max_validators"],
        "min_commission": float(p["min_commission_rate"]),
        "bond_denom": p["bond_denom"],
        "max_redelegation_entries": p["max_entries"],
    }


def pool_snapshot():
    pool = requests.get(f"{LCD}/cosmos/staking/v1beta1/pool", timeout=20).json()["pool"]
    return {
        "bonded_atom": int(pool["bonded_tokens"]) / UATOM,
        "not_bonded_atom": int(pool["not_bonded_tokens"]) / UATOM,
    }


def check_validator(valoper: str):
    v = requests.get(
        f"{LCD}/cosmos/staking/v1beta1/validators/{valoper}", timeout=20
    ).json()["validator"]
    rates = v["commission"]["commission_rates"]
    flags = []
    if v["jailed"]:
        flags.append("jailed")
    if v["status"] != "BOND_STATUS_BONDED":
        flags.append(f"status={v['status']}")
    if float(rates["max_rate"]) >= 0.2:
        flags.append(f"max commission can rise to {float(rates['max_rate']):.0%}")
    return {
        "moniker": v["description"]["moniker"],
        "commission": float(rates["rate"]),
        "max_commission": float(rates["max_rate"]),
        "tokens_atom": int(v["tokens"]) / UATOM,
        "flags": flags or ["bonded and not jailed"],
    }


if __name__ == "__main__":
    print(staking_params())
    print(pool_snapshot())
    for op in sys.argv[1:]:
        print(op[:20], check_validator(op))

When I ran this on October 16, 2026, Hub params reported 21-day unbonding, max_validators 180, a 5% min commission floor, and about 338 million ATOM in the bonded pool. Pass real cosmosvaloper... addresses from Mintscan or your wallet. Also check self-bond, uptime, and governance participation. Spreading stake across a few solid operators beats parking everything on one large name.

Caveats: the bonded-pool figure is not the same as percent of circulating supply. A low current commission with a high max can jump later. Double-signing is rare but severe, so reputation and infra matter more than a 1% fee difference.

Exchange staking vs Hub delegation

Exchanges often advertise ATOM staking as a product. That is usually custodial: they hold the coins, pick validators, and set their own lock rules. Self-custody Hub delegation keeps keys with you and matches protocol unbonding. Simpler UX on an exchange is real; so is exchange credit risk. Neither path has a promised yield.

Takeaways

Hub staking delegates voting power; validators cannot withdraw your ATOM, but slashing still hits your bonded share.
Undelegate = 21 days with no rewards. Redelegate = switch validators immediately (within Hub entry limits).
Claim rewards yourself, or review restake grants carefully.
If you skip Hub votes, you inherit your validator's vote.
Query LCD params and validator status before you bond; treat advertised APYs as estimates.

New to staking concepts? NutshellCrypto's explainer on what staking in crypto means covers the shared vocabulary across chains.

Read the full guide on NutshellCrypto

This is for education only and is not financial, investment, or tax advice.

This post was written with AI assistance.

Cardano Staking for Developers: Delegation Is a Certificate, Not a Transfer (Plus a Pool Check in Python)

Huzaifa Zahoor — Thu, 15 Oct 2026 08:49:27 +0000

Most proof-of-stake chains make you lock coins, hand them to a validator, and accept that a misbehaving operator can get part of your stake slashed. Cardano works differently, and if you think in terms of state and permissions it is a neat design: delegating ADA does not move your coins at all. It just attaches a certificate to your stake key that says "count my balance toward this pool."

This post walks through that model the way a developer would look at it, then shows a short Python script that checks a stake pool's numbers through the public Koios API before you delegate. For the full beginner walkthrough, including exchange options and US and Canada tax notes, see NutshellCrypto's ADA staking guide on how rewards and risks work.

The mental model: permissions, not custody

A Cardano address has two parts that matter here: a payment part (who can spend the coins) and a stake part (who gets credit for that stake). Delegation only touches the stake part. You sign one transaction that registers your stake key and submits a delegation certificate pointing it at a pool.

That has some useful consequences:

No lock-up. Your ADA stays spendable the whole time. Spending some just lowers the stake counted in the next snapshot.
No minimum. Any balance counts, and the wallet delegates the whole balance tied to that stake key.
No slashing. A bad pool can cost you rewards, but the protocol never takes delegated ADA.
A refundable deposit. Registering a stake key for the first time costs a 2 ADA deposit, which you get back when you deregister it.

The operator never gets your keys. If anyone, whether a "pool support" account or a wallet pop-up, asks for your recovery phrase to stake, it's a scam.

Why the first reward takes 15 to 20 days

Cardano runs in 5-day epochs, and pools are chosen to make blocks based on a stake snapshot. So a new delegation moves through a pipeline: you delegate in epoch N, the snapshot picks it up at the next boundary, the stake is active in N+2, rewards are calculated in N+3, and they're paid in N+4. After that first wait, rewards land every epoch as long as the pool makes blocks, and they compound automatically because the reward account counts toward your stake.

One recent change catches people out. Since the Plomin hard fork, you can only withdraw rewards once your stake key also has a vote delegation (a DRep, Abstain, or No Confidence). Rewards keep piling up without it; you just can't move them.

Checking a pool with Python before you delegate

Pool choice is the one decision you actually control, and the inputs are all on-chain. The things worth checking are the margin (the operator's percentage), the fixed cost per epoch, saturation (beyond it, rewards per ADA drop for everyone in the pool), and whether the owners are actually meeting their declared pledge. If live pledge falls below declared pledge, the pool's rewards for that epoch are zero.

Koios is a free community API for Cardano chain data. This script pulls the current protocol parameters and flags common red flags for one or more pool IDs:

import sys
import requests

KOIOS = "https://api.koios.rest/api/v1"
LOVELACE = 1_000_000  # 1 ADA = 1,000,000 lovelace


def protocol_params():
    p = requests.get(f"{KOIOS}/cli_protocol_params", timeout=20).json()
    return {
        "stake_key_deposit_ada": p["stakeAddressDeposit"] / LOVELACE,
        "k": p["stakePoolTargetNum"],
        "min_fixed_cost_ada": p["minPoolCost"] / LOVELACE,
    }


def check_pool(pool_id):
    r = requests.post(f"{KOIOS}/pool_info",
                      json={"_pool_bech32_ids": [pool_id]}, timeout=20)
    pool = r.json()[0]
    flags = []
    if pool["pool_status"] != "registered" or pool["retiring_epoch"]:
        flags.append("pool is retiring or not registered")
    if int(pool["live_pledge"]) < int(pool["pledge"]):
        flags.append("live pledge below declared pledge (rewards can be zero)")
    if (pool["live_saturation"] or 0) > 90:
        flags.append(f"near saturation ({pool['live_saturation']}%)")
    if pool["margin"] > 0.05:
        flags.append(f"margin is {pool['margin']:.1%}")
    return {
        "margin": pool["margin"],
        "fixed_cost_ada": int(pool["fixed_cost"]) / LOVELACE,
        "live_stake_ada": int(pool["live_stake"]) / LOVELACE,
        "saturation_pct": pool["live_saturation"],
        "lifetime_blocks": pool["block_count"],
        "flags": flags or ["no obvious red flags"],
    }


if __name__ == "__main__":
    print(protocol_params())
    for pid in sys.argv[1:]:
        print(pid[:16], check_pool(pid))

Run it with one or more pool1... IDs copied from a pool explorer or your wallet. When I ran it on October 15, 2026, Koios reported a 2 ADA stake key deposit, a target of 500 pools (the k parameter), and a 170 ADA minimum fixed cost per epoch. The 5% margin and 90% saturation cutoffs are my own arbitrary picks for the example, so adjust them to taste.

A couple of caveats. One epoch of low blocks doesn't mean a pool is bad, since small pools get picked less often and their rewards vary more, so look at performance over many epochs. And treat the script as a filter, not a ranking: a pool with low fees that is often offline will still pay you less.

Exchange staking vs delegating yourself

Exchanges like Coinbase offer ADA staking in some regions. It's simpler, but it's custodial: the exchange holds the coins, chooses the pool, and takes a cut. With native delegation, the worst a pool can do is earn you nothing. With an exchange, you're also exposed to frozen withdrawals or the exchange failing. Either way, there's no fixed APY: rewards depend on pool performance, fees, and total stake.

Takeaways

Delegation on Cardano is a certificate on your stake key, not a transfer, so there's no lock-up and no slashing.
Expect the first reward about 15 to 20 days in, then every 5-day epoch.
Set a vote delegation, or you won't be able to withdraw rewards.
Check margin, fixed cost, saturation, and pledge before choosing a pool; the Koios API makes that scriptable.
In the US and Canada, staking rewards are generally treated as income when you receive them, so log each payout.

Comparing chains? NutshellCrypto's guide to how staking works in crypto covers the basics behind all of this.

Read the full guide on NutshellCrypto

This is for education only and is not financial, investment, or tax advice.

This post was written with AI assistance.

Crypto.com Dropped Its Tax Calculator: Build Your File From CSVs and 1099-DA Instead

Huzaifa Zahoor — Wed, 14 Oct 2026 08:45:17 +0000

Crypto.com used to ship a built-in Tax calculator that spat out a yearly capital-gains style report. That product was deprecated in June 2024. For 2026 filing you are back to the boring path every serious exchange workflow already uses: export complete CSVs from the App and Exchange, save any IRS information returns Crypto.com emails you, then reconcile in software or your own ledger.

This post is a developer-oriented map of what those exports give you, where the 1099-DA trap sits, and a small Python sketch to sanity-check App Token Wallet CSVs. For click-by-click paths and a Canada note, see NutshellCrypto's guide to the Crypto.com tax report.

What replaced "Crypto.com Tax"

Crypto.com's Tax site and Help Center say the legacy calculator is no longer operational for new reports, and that past reports from that tool are no longer applicable. They point users toward partner tax services and toward exporting transaction history yourself.

Practical takeaway: do not wait for a fresh Crypto.com Tax PDF. Treat App + Exchange CSVs (plus any Forms 1099) as the source of truth.

What to download (App vs Exchange)

From the Crypto.com App, Help documents three CSV sources:

Token Wallet — crypto activity; usually the primary import for tax software
Cash Wallet — fiat
Crypto.com Visa Card — card spend history

App exports can cover up to about three years per report, and downloads typically expire after 30 days. For a US calendar year, export at least January 1–December 31 of the tax year, plus earlier years if you still hold coins bought then (cost basis often lives in older buys).

If you also use Crypto.com Exchange, App CSVs alone are incomplete. Exchange exports cover wallet transactions, deposits/withdrawals, order and trade history, and related sets — with date-range caps and a ~65,000-row limit on some files. Shorten the range and stitch months if an export truncates.

Keep App and Exchange files separate and mark internal transfers so software does not invent a taxable sale when you moved coins between Crypto.com products.

The 1099-DA gap: proceeds ≠ profit

US persons may receive Forms 1099-DA, 1099-MISC, and/or 1099-B by email from no-reply@crypto.com (check spam). Crypto.com's FAQ for recent tax years states that cost basis is not required on Form 1099-DA during the transitional period, and that they chose not to report basis to avoid unintended error.

That means:

Proceeds on 1099-DA are not your taxable gain
You still need acquisition cost for Form 8949 when the broker form is proceeds-only
No 1099-MISC under the $600 rewards threshold does not automatically mean Earn / lockup / referral income is non-taxable

If you also use Coinbase, keep each platform's CSVs separate. NutshellCrypto's Coinbase tax report walkthrough covers the parallel 1099-DA pattern on that venue.

A tiny App CSV sanity check

Crypto.com Token Wallet CSV column names can vary by export year. Inspect the header row first. This sketch counts disposal-like rows without a usable basis field — a cheap red flag before you file.

import csv
from collections import defaultdict
from decimal import Decimal
from pathlib import Path

DISPOSAL_HINTS = {"sell", "trade", "convert", "exchange"}

def d(x: str) -> Decimal:
    return Decimal((x or "0").replace(",", "").strip() or "0")

def scan_token_wallet(path: Path) -> dict:
    missing_basis = 0
    by_type = defaultdict(int)
    proceeds_total = Decimal(0)

    with path.open(newline="", encoding="utf-8") as f:
        reader = csv.DictReader(f)
        fields = {h.lower().strip(): h for h in (reader.fieldnames or [])}

        def get(row, *names):
            for n in names:
                key = fields.get(n.lower())
                if key and row.get(key) not in (None, ""):
                    return row[key]
            return ""

        for row in reader:
            t = get(row, "Transaction Kind", "Type", "transaction_type").lower()
            by_type[t or "unknown"] += 1
            if not any(h in t for h in DISPOSAL_HINTS):
                continue
            proceeds_total += d(get(row, "Native Amount", "Amount (USD)", "USD Value"))
            if not get(row, "Cost Basis", "cost_basis_usd", "Basis"):
                missing_basis += 1

    return {
        "by_type": dict(by_type),
        "disposal_rows_missing_basis": missing_basis,
        "rough_proceeds_sum": str(proceeds_total),
    }

print(scan_token_wallet(Path("crypto_com_token_wallet.csv")))

Tune aliases against your header row. This is not a tax engine — it catches empty basis fields and odd type mixes before they become Form 8949 mistakes.

Import workflow that usually works

Export Token Wallet (plus Cash/Card if needed) for the tax year and prior years for basis.
Export every relevant Exchange history set; split ranges if you hit caps.
Save 1099 PDFs from Crypto.com's email link.
Import into crypto tax software or enter disposals on Form 8949 with your own basis where the broker form is proceeds-only.
Report rewards income even when no 1099-MISC arrived; reconcile 1099-DA proceeds to your Form 8949 lines.
Do not forget on-chain / DeFi Wallet activity outside Crypto.com's custodial App and Exchange.

Takeaways

Crypto.com's built-in Tax calculator is gone; CSVs + 1099s are the workflow now.
Export both App and Exchange if you used both.
Treat 1099-DA proceeds as proceeds, not profit — basis is still your job in the transitional years.
Watch App download expiry, Exchange row/date caps, and rewards below the 1099-MISC threshold.
Preserve inbound transfer basis across venues in a personal ledger or software profile.

Read the full guide on NutshellCrypto: Crypto.com Tax Report: How to Download and Use It (2026).

Not financial, tax, or investment advice. Educational only — rules depend on your facts and jurisdiction; talk to a qualified professional before filing.

This post was written with AI assistance.