Bicrypto

Bicrypto is a self-hosted cryptocurrency trading and finance platform. Users register, pass KYC, fund a wallet through a payment gateway or an on-chain deposit, and trade. You run the whole thing on your own Linux server: there is no hosted tier, and nothing sits between you and your customers' balances.

The trade-off is that everything an exchange operator is responsible for is now yours — the database, the encryption keys, the withdrawal queue and the TLS certificate. Read Install before you buy a server.

What core ships with

Without a single addon installed, a fresh install gives you:

• Accounts and access control — four seeded roles (Super Admin, Admin, Support, User) over 715 permission keys, plus API keys and blocking.
• KYC — an application queue with configurable verification levels; every approve or reject runs through one decision path that emails the applicant.
• Wallets and money movement — spot, fiat and ecosystem wallets; deposits through 16 built-in payment providers (Stripe, PayPal, Adyen, Paystack, Mollie, PayU and others); a withdrawal queue you can leave manual or switch to auto-approve; internal transfers.
• Trading — spot markets against a connected exchange account (Binance, KuCoin or XT, through ccxt) and binary options.
• Investment plans with durations and payout tracking.
• Content and support — blog, media library, homepage sliders, a page builder for the landing page, and a support ticket desk.
• Operations — platform settings, notification templates for email, SMS, push and in-app, announcements, geo restrictions, an append-only audit trail, scheduled task monitoring and an update checker.

Everything else is a separately licensed addon: Ecosystem, Futures, P2P, Staking, NFT, ecommerce, MLM, Forex, copy trading, algo trading bots and more — 23 are registered in the extensions table by backend/seeders/20240403000503-extensions.js. They install into the same tree and appear under Extensions in the admin panel.

How the pieces fit

A running deployment is three PM2 processes over two data stores.

• Frontend — Next.js 16 / React 19 on port 3000. The port is fixed in production.config.js; setting NEXT_PUBLIC_FRONTEND_PORT does not move it. In production Next does not proxy /api to the backend, so your web server must.
• Backend — Node on uWebSockets.js, port 4000 by default (NEXT_PUBLIC_BACKEND_PORT). It speaks plain HTTP and binds every interface, so TLS terminates at your proxy and the port must be firewalled. All REST routes and all 30 WebSocket endpoints live under /api — nine of those sockets are core, the other twenty-one arrive with addons, so a box with nothing installed opens far fewer than the file count suggests.
• Cron — the same backend build with CRON_MODE=only, on port 4001. It serves no traffic; never point a load balancer at it.
• MySQL — accessed through Sequelize, with the schema auto-synced on boot. The installer does not install MySQL. A reachable server with credentials is a prerequisite, not a step.
• Redis — not optional. It holds sessions, CSRF tokens, rate limits, locks, job queues and the settings bus that keeps processes in agreement. If Redis is unreachable the backend exits at boot rather than starting degraded.
• Addons — the same repository tree, contributing their own routes, models and menus, switched on per row in the extensions table. Ecosystem and Futures add a third store, ScyllaDB, which nothing installs for you.

Where to start

Two reference pages sit behind all of them: Permissions explains how a permission key is derived and the five places it has to exist, and Processes and ports lists every process, port and lifecycle command.