출처 검증 리서치: Crypto Exchange Websocket Heartbeat

Verified source facts

1. Binance says a coin-futures market-stream connection is valid for 24 hours and its server sends a ping frame every three minutes. 2. OKX says a connection may break after more than 30 seconds without subscription or pushed data and recommends client ping, pong verification and reconnect logic. 3. Coinbase Advanced Trade says heartbeats arrive every second and heartbeat counters can help identify missed messages while keeping sparse subscriptions open. 4. Coinbase Exchange says sequence gaps or out-of-order messages can occur and consumers may need logic or guaranteed-delivery channels to restore correct state.

Comparison at a glance

1. Control test: Connection age

A trading-control disclosure is meaningful only when converted into a testable rule. For connection age, inspect time since socket establishment. Use a sandbox, non-production context, or the smallest reversible test available, then rotate before forced expiry. Capture configuration and event evidence without recording credentials, and verify the documented cancel, reject, decrement, or history behavior.

Model the failure path, not just the setup path. Ask which strategy owns the maker and taker orders, which account boundary the venue evaluates, which message reveals intervention, and how reconciliation behaves after a partial fill or disconnect. Platform documentation describes supported settings; it cannot prove that an operator configured them correctly. In this dimension, server policy change is therefore an explicit audit gap.

The connection age row should end with a concrete monitoring rule tied to time since socket establishment. Make the operator rotate before forced expiry, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; server policy change remains a separate production risk until observed.

2. Control test: Application silence

For application silence, inspect time since last useful message. Use a sandbox, non-production context, or the smallest reversible test available, then measure independently of TCP.

In this dimension, illiquid market is therefore an explicit audit gap.

The application silence row should end with a concrete monitoring rule tied to time since last useful message. Make the operator measure independently of TCP, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; illiquid market remains a separate production risk until observed.

3. Control test: Ping interval

For ping interval, inspect server or client liveness probe. Use a sandbox, non-production context, or the smallest reversible test available, then follow venue-specific timing.

In this dimension, library defaults is therefore an explicit audit gap.

The ping interval row should end with a concrete monitoring rule tied to server or client liveness probe. Make the operator follow venue-specific timing, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; library defaults remains a separate production risk until observed.

4. Control test: Pong deadline

For pong deadline, inspect maximum response wait. Use a sandbox, non-production context, or the smallest reversible test available, then raise a circuit-breaker alert.

In this dimension, network jitter is therefore an explicit audit gap.

The pong deadline row should end with a concrete monitoring rule tied to maximum response wait. Make the operator raise a circuit-breaker alert, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; network jitter remains a separate production risk until observed.

5. Control test: Heartbeat counter

For heartbeat counter, inspect monotonic liveness evidence. Use a sandbox, non-production context, or the smallest reversible test available, then detect skips and resets.

In this dimension, counter semantics is therefore an explicit audit gap.

The heartbeat counter row should end with a concrete monitoring rule tied to monotonic liveness evidence. Make the operator detect skips and resets, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; counter semantics remains a separate production risk until observed.

6. Control test: Sequence continuity

For sequence continuity, inspect product or channel ordering. Use a sandbox, non-production context, or the smallest reversible test available, then record and validate every transition.

In this dimension, cross-channel ordering is therefore an explicit audit gap.

The sequence continuity row should end with a concrete monitoring rule tied to product or channel ordering. Make the operator record and validate every transition, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; cross-channel ordering remains a separate production risk until observed.

7. Control test: Reconnect backoff

For reconnect backoff, inspect retry pacing after failure. Use a sandbox, non-production context, or the smallest reversible test available, then use bounded jitter.

In this dimension, thundering herd is therefore an explicit audit gap.

The reconnect backoff row should end with a concrete monitoring rule tied to retry pacing after failure. Make the operator use bounded jitter, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; thundering herd remains a separate production risk until observed.

8. Control test: Snapshot rebuild

For snapshot rebuild, inspect authoritative state after a gap. Use a sandbox, non-production context, or the smallest reversible test available, then queue deltas around snapshot.

In this dimension, REST delay is therefore an explicit audit gap.

The snapshot rebuild row should end with a concrete monitoring rule tied to authoritative state after a gap. Make the operator queue deltas around snapshot, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; REST delay remains a separate production risk until observed.

9. Control test: Deduplication

For deduplication, inspect replayed or repeated events. Use a sandbox, non-production context, or the smallest reversible test available, then use stable event identity.

In this dimension, venue-specific identifiers is therefore an explicit audit gap.

The deduplication row should end with a concrete monitoring rule tied to replayed or repeated events. Make the operator use stable event identity, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; venue-specific identifiers remains a separate production risk until observed.

10. Control test: Fail closed

For fail closed, inspect state confidence before new orders. Use a sandbox, non-production context, or the smallest reversible test available, then block decisions until reconciled.

In this dimension, missed opportunity is therefore an explicit audit gap.

The fail closed row should end with a concrete monitoring rule tied to state confidence before new orders. Make the operator block decisions until reconciled, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; missed opportunity remains a separate production risk until observed.

Decision scenarios

Scenario 1: when connection age becomes decisive

Consider a reader whose main constraint is time since socket establishment. The correct response is not to infer a universal platform or product winner. It is to rotate before forced expiry, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when application silence becomes decisive

Consider a reader whose main constraint is time since last useful message. It is to measure independently of TCP, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when ping interval becomes decisive

Consider a reader whose main constraint is server or client liveness probe. It is to follow venue-specific timing, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when pong deadline becomes decisive

Consider a reader whose main constraint is maximum response wait. It is to raise a circuit-breaker alert, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when heartbeat counter becomes decisive

Consider a reader whose main constraint is monotonic liveness evidence. It is to detect skips and resets, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when sequence continuity becomes decisive

Consider a reader whose main constraint is product or channel ordering. It is to record and validate every transition, retain the evidence, and define a stop condition before funds or permissions are committed.

Sources and editorial method

• Binance WebSocket Market Streams
• OKX WebSocket API Guide
• Coinbase Advanced Trade WebSocket Channels
• Coinbase Exchange WebSocket Overview