dYdX vs KuCoin

dYdX 83

Read with the hosted lines on the indexer API and the chain endpoints the clients submit to. status.dydx.trade is an Atlassian Statuspage with Frontends, dYdX Chain, Indexer, Order Gateway and Client Libraries components and an RSS history (20). From 1 August to 3 November 2026 the feed has eight items, seven scheduled maintenance windows of 29 minutes to 2 hours (indexer on 9 September, 8 and 15 October, protocol v9.7 on 11 September and v9.8.0 on 12 October, WebSocket compression on 26 and 28 October) and one degraded instant-deposit path through an onboarding partner from 24 to 29 September, outside the trading API. Clean or trivial (30). Rate limits documented with numbers for the indexer, the block limits and the public nodes (15). No 429 shape or Retry-After for the indexer; short-term orders expire by goodTilBlock and client IDs let an agent find an order after a timeout (8 of 15). No SLA (0). Mainnet generally available; the Order Entry Gateway is marked testnet-only (10). 20 + 30 + 15 + 8 + 0 + 10 = 83.

KuCoin 45

Graded with the hosted lines on the API at api.kucoin.com. No status page found (status.kucoin.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per VIP level with per-endpoint weights and IP limits for public endpoints (15). Every response carries gw-ratelimit-limit, gw-ratelimit-remaining and gw-ratelimit-reset, 429000 is documented with a wait rule, and orders take a clientOid the docs recommend as a UUID (15). No SLA (0). The UTA V2 API is the production surface (10). 45.

dYdX 60

No machine payment protocol (0). Fees public per tier without login (20). Testnet with a faucet and no card anywhere (20). No signup; an agent with a funded wallet trades, subject to the geographic terms (20). Total 60.

KuCoin 35

No machine payment protocol (0). The spot base fee is stated in support articles without login, the futures base rate and the full tier table sit in images or behind script (15 of 20). Market data needs no key, no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 35.

dYdX 78

Orders are signed by the account key or by a permissioned key the owner adds as an authenticator, limited by message type, subaccount and market with AllOf or AnyOf, and revoked by remove_authenticator; no shared secret and nothing in a URL (28 of 30). A key can be confined to placing and cancelling orders on one subaccount with withdrawals and transfers excluded, though not to a position or order size, and the interface's default API wallet trades all cross-margin pairs (16 of 20). The API returns no untrusted content (10). Every action is a chain transaction and the indexer lists fills, orders and transfers per subaccount, and authenticators can be listed; no per-key log (10 of 15). A Cantina bug bounty up to $1,000,000 sponsored by dYdX Trading Inc. over the protocol, indexer, web client and SDKs, an Informal Systems audit; no security.txt and no certification (14 of 20). Total 78.

KuCoin 55

API key with a user-set passphrase, HMAC-SHA256 signing, nine permission groups, IP allow-lists required for Withdrawal and FlexTransfers, trading keys without an IP disabled after 30 days of inactivity, revocation on the management page; no OAuth and no expiry on General keys (24 of 30). A General-only key is a true read-only mode and withdrawals are a separate permission; no confirmation step for writes beyond the key scope (12 of 20). Tools return the exchange's own data (10). The API key info endpoint shows permissions and IP lists; no per-call audit log was found (5 of 15). No security.txt, no disclosure policy or bounty on a page we could read, a whistleblower notice on the legal page (4 of 20). 55.

dYdX 83

Read on the clients and the chain. v4-clients was pushed on 29 October 2026 and protocol v9.8.0 shipped on 12 October (30). Protocol v9.7 on 11 September, v9.8.0 on 12 October, v4-client-js tags 3.5.0 and 3.6.0, three or more in 90 days (20). A Discord, a help centre and 36 open issues on v4-clients whose replies couldn't be read (12 of 25). Official SDKs current, the TypeScript client at 3.6.0 and the Python client at 1.1.6 from February 2026 (12 of 15). CI workflows for lint, test, publish and audit, with trusted publishing and provenance on npm (9 of 10). Total 83.

KuCoin 73

Read as a closed hosted service. The changelog's newest past entry is 2 November 2026 and the universal SDK was pushed 15 September (30). Nine dated changelog entries since 5 August 2026 (20). A Telegram API group (t.me/KuCoin_API) and api@kucoin.com for limit requests, no public issue tracker for the API; the SDK repository's issues were not checked (10 of 25). Official SDKs current in five languages, no MCP registry presence (13 of 15). No package health signal checked (0 of 10). 73.