Skip to content
PROTOCOL RESEARCH

Hyperliquid risk

Still the deepest perp book with no core exploit, but HIP-3 delegates oracle control to outside deployers who now carry 36% of platform open interest, and one of them liquidated $57.4M of positions on 2026-07-27. The draft's central claim is wrong: the deployer voluntarily repaid the roughly $17.4M of realized losses, which is exactly what no protocol mechanism could have done.
CautionResearched Aug 5, 2026

Scorecard

watch: Audits & contractsDocs audits page names one firm, Zellic, on the bridge contract only, with two reports (First and Final). No external audit named for HyperBFT, HyperCore or HyperEVM. Re-checked 2026-08-05, unchanged.
weak: Admin control27 active validators; five Hyper Foundation validators hold 48.91% of stake and the top three alone hold 37.45%, past the one-third threshold that blocks a 2/3 quorum. This set has force-settled a market before (JELLY, 2025).
weak: OracleHIP-3 gives oracle price control to third-party deployers, now $3.89B of open interest (36% of the platform). Trade.xyz routes ~105 markets through one setOracle key. Slashed stake burns rather than repaying users; the 2026-07-27 SK Hynix cascade was cured by a voluntary payment, not by any protocol mechanism.
strong: Liquidity & exit$6.99B core open interest plus $3.89B on HIP-3 dexes, roughly two-thirds of all perp-DEX open interest; nearest competitor is under $2B. Bridge withdrawals need 2/3 stake-weighted signatures and have never been hacked.
watch: Yield (real vs emission)Paid from funding and trading fees rather than emissions, but HLP's reported APR is 0.34% and the vault shrank about 17% in a month on redemptions, not losses.
watch: Holder concentrationFoundation-operated validators hold 48.91% of staked HYPE, but that is 212.9M HYPE against a 60M foundation genesis budget, so most is delegated third-party stake, not foundation-owned. Wallet-level concentration still needs an agent run.
watch: Track recordNo core protocol or bridge exploit since 2023. The platform now carries a $57.4M liquidation cascade from 2026-07-27 on a market it hosted and did not operate; realized losses of about $17.4M were reimbursed by the deployer, not by Hyperliquid.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

TL;DR

Hyperliquid is its own Layer-1: HyperCore runs the perp DEX, HyperEVM runs contracts, and an Arbitrum bridge custodies the USDC. The core venue is in good shape. Core open interest is $6.99B, the book is the deepest in perp DEX land by a wide margin, the bridge has never been hacked, and the yield is real revenue rather than token printing.

The verdict stays caution, and the oracle dimension is red. Under HIP-3, outside teams deploy their own perp markets on Hyperliquid's order book, margin engine and liquidation engine, and those teams set their own oracle prices. This is no longer a side experiment. Nine builder-deployed dexes now carry $3.89B of open interest, about 36% of everything open on the platform, and one deployer, Trade.xyz, is 99.6% of that.

On 2026-07-27 at 23:01 UTC a pre-market print on Korea's NXT venue fed the Trade.xyz SK Hynix market and liquidated $57.4M of positions across 960 accounts. Get the second half right, because it is the part that most write-ups drop: Trade.xyz reimbursed the roughly $17.4M of realized losses, and has already paid the smaller claims. That matters, and so does the reason it matters. The protocol could not have done it. The docs say a slashed deployer's stake is burned rather than distributed to affected users, so the maximum penalty available returns nothing to anyone. Users got money back because a company chose to pay, and that company explicitly called it a one-time discretionary decision it is not committing to repeat.

The older red is unchanged. The validator set that voted JELLY out of existence in about two minutes in March 2025 still exists, still holds that power, and foundation-run validators still control just under half the stake.

Checklist

Audits and contracts. Re-checked this run, and nothing moved. The Hyperliquid docs audits page names exactly one firm: "The Hyperliquid bridge contract has been audited by Zellic," with two reports linked, labelled First and Final. There is no external audit named for HyperBFT consensus, HyperCore, or HyperEVM, and the matching engine is still not fully open-source. No other firm is named anywhere on that page. This is a confirmed absence this run, not an unknown.

Admin control. Pulled live from the validator API rather than taken from a write-up. There are 27 active validators, 7 inactive, and 435,384,584 HYPE staked. The five Hyper Foundation validators hold 48.91% of that, and 22 non-foundation validators hold 51.09%. Two thresholds matter. Bridge withdrawals need 2/3 of stake-weighted signatures, so the foundation cannot move funds alone. But the top three validators, all foundation, hold 37.45% between them, which is past one third and therefore a unilateral block on anything needing a two-thirds quorum. In the other direction, eight of the 27 clear that quorum together at 67.82%.

Two corrections to the usual telling of this. First, the delisting power is used routinely, not only in emergencies: validators voted on OM in February 2026, on a nine-token batch in April 2026, and on IP on 2026-06-26, all scheduled and announced in advance. That is ordinary exchange housekeeping. JELLY was the emergency use, and it is the one that shows the teeth: positions were settled at a chosen price of $0.0095 and the vote took roughly two minutes with every validator approving. Second, after JELLY the chain was upgraded so that delisting votes run fully onchain and execute automatically once a quorum of stake has voted. That is a real improvement in process. It does not change who holds the stake.

Oracle. This is the dimension that decides the verdict, so here is the mechanism before the anecdote. Core Hyperliquid prices are validator-signed. HIP-3 prices are not. The docs are explicit that the deployer owns "Market definition, including the oracle definition and contract specifications" and "Market operation, including setting oracle prices, leverage limits, and settling the market if needed." Reading the live dex registry, that authority resolves to ordinary keys: every builder dex carries deployer-controlled setOracle addresses, and Trade.xyz's roughly 105 markets route through a single one.

The size of this surface is the part the numbers settle. HIP-3 open interest is $3.89B against $6.99B on core, so about 36% of the platform. Trade.xyz alone is $3.88B of that; the other eight dexes are effectively dormant, with the largest under $10M. Concentration inside HIP-3 is close to total.

A deployer posts 500,000 HYPE, about $28.6M at the live mark, for at least 183 days, and validators may slash up to 100% for irregular inputs causing invalid state transitions, up to 50% for brief downtime, and up to 20% for degradation. Then the sentence that sets the color: "the slashed stake by the deployer is burned instead of being distributed to affected users." Validators only conduct a manipulation review when a price moves more than 50% against the start of day.

The SK Hynix event ran that machinery in public and every safeguard sat out. A print on NXT valued one SK Hynix share at 1,272,000 won against a prior close of about 1,816,000 won, roughly 30% below. The perp fell from about $1,128 to $917 by CoinDesk's and CryptoTimes' marks, near 19%, or to $927 and 17.9% by crypto.news's. Either way it was nowhere near the 50% review trigger, so no validator review was ever due. $57.4M of positions across 960 accounts were closed out, with realized long losses of about $17.4M. Note that the underlying really did fall that day: SK Hynix closed the Seoul regular session down 14.65%, and the perp recovered above $1,100, ending the day down 13.7%. So this was not a price that never existed. It was a real executed trade on a thin pre-market venue, relayed by multiple data providers, that moved roughly twice as far as the asset actually did.

Trade.xyz's own position is that "the oracle system worked as intended according to its specification" and that nothing malfunctioned. Take them at their word and the finding gets worse, not better: if the design performed to spec and still produced this, the same thing recurs by design. The deployer stake was not slashed. Instead Trade.xyz reimbursed, recalculating each liquidation against a reference price of about $1,115.50, paying claims under 10,000 USDC automatically with no claim form, and crediting larger claimants an initial 9,999 USDC pending a review process that closes 2026-08-15. Red here is not a claim that users lost money and stayed lost. It is that a fund-loss surface with third-party price authority has no protocol-level backstop, and its one live test was resolved by goodwill that was explicitly not promised again.

Liquidity and exit. Unchanged and genuinely strong. Core open interest is $6.99B across 177 live markets, with BTC at $2.25B, ETH at $1.85B, HYPE itself at $1.26B and SOL at $296M. Add HIP-3 and the platform carries $10.88B, close to two-thirds of all perp-DEX open interest, with the nearest competitor under $2B. Open interest is larger than the TVL figure, which is the clearest argument that TVL is the wrong headline number for a venue like this. Bridge withdrawals need 2/3 stake-weighted validator signatures, followed by a dispute period during which the bridge can be locked against a withdrawal that does not match Hyperliquid state, and cold wallet unlocks need 2/3 stake-weighted signatures too. No bridge hack to date. In normal conditions you get out fast; the tail risks are a bridge lock or an intervention, not thin liquidity.

Yield: real versus emission. The character of the yield has not changed. HLP and HYPE staking pay out of funding and trading fees, not token emissions, so nothing here is inflationary. The size has changed a lot. HLP's own API reports an APR of 0.34%, and the median predicted staking APR across the active validator set is 2.18%. HLP shrank from $260.6M on 2026-07-05 to $216.7M on 2026-08-05, about 17%. Read the cause before assuming the worst: HLP's PnL over that window was positive, about $64,000, essentially flat. The vault did not lose the money, depositors withdrew roughly $44M. The shape is informative. Nearly half of the month's decline landed in a single 24-hour step of $20.2M between 2026-07-24 and 2026-07-25, which DeFiLlama's independent series shows in the same place. That step predates the SK Hynix event by two days, so do not connect them. Real yield near zero with sustained redemptions is not a solvency problem, but it is not a green either.

Holder concentration. Genesis split 1 billion HYPE as 31% community distribution, 23.8% core contributors, 6% Hyper Foundation budget, 38.888% future emissions and rewards, 0.3% community grants and 0.012% HIP-2, with no private-investor, CEX or market-maker allocation. Core-contributor tokens were locked for a year after genesis and mostly vest across 2027 and 2028, some later.

One distinction the stake number hides and it is worth stating plainly. Foundation-operated validators hold 212.9M HYPE, which is 48.91% of stake and 21.3% of all HYPE in existence. The Hyper Foundation's entire genesis budget was 6%, or 60M. So the large majority of that 48.91% is stake delegated by other people, not tokens the foundation owns. For admin control it still counts, because a validator votes with its delegated stake. For ownership concentration it does not, and delegators can move. Wallet-level concentration for the free float still needs a Nansen or agent run.

Track record. The core protocol record is clean. Live since 2023, no bridge exploit, no consensus exploit, no contract hack. JELLY in March 2025 was manipulation handled by intervention, with HLP facing about $13.5M of unrealized loss and the Hyper Foundation making users whole apart from flagged addresses. The December 2024 DPRK scare drove a record $502M single-day outflow but was never an exploit; Hyperliquid stated there had been no exploit and all user funds were accounted for, which held up.

What is no longer accurate is calling the whole platform record uneventful. On 2026-07-27, 960 accounts were liquidated for $57.4M on Hyperliquid's order book, using Hyperliquid's margin and liquidation engine. The market was somebody else's and the losses were made good by that somebody else. Both facts are real, and yellow rather than green is the honest reading: the incident happened on these rails, and the recovery did not come from them.

Worst case

Two separate scenarios, and they do not share a mitigation.

The one that has actually happened: you hold a position in a HIP-3 market, the deployer's oracle ingests a real but unrepresentative print from a thin venue, and your position is liquidated at a price the asset never traded at in size. The protocol offers you nothing. Validators can burn the deployer's 500,000 HYPE, which pays you nothing by explicit design, and the manipulation review only triggers past a 50% daily move, well above the roughly 19% that did the damage here. In July the deployer chose to pay and called it one-time. Assume the next one does not. The mitigation is simple and total, which is to check the ticker prefix and stay in core markets. Note the surface is not small: $3.89B of open interest sits on builder dexes today, and the SK Hynix market itself still carries $333M.

The older one: a large coordinated position pushes HLP into a deep loss, the validator set intervenes again, a market is delisted, and your open trade is force-settled at the one-hour time-weighted spot oracle price before the vote rather than at the market. The docs are clear that when an asset is delisted all positions are settled and open orders are cancelled. Beyond that sits bridge custody, where 2/3 stake-weighted signatures gate withdrawals while three foundation validators hold 37.45% and can therefore block any two-thirds quorum on their own. No insurance fund covers a directional HLP drawdown or a settlement you disagree with. Position sizing is the only mitigation.

Bottom line

Caution. Core Hyperliquid remains the best perp venue on the board: $6.99B of core open interest, roughly two-thirds of the sector, a bridge that has never been broken, and yield that comes from actual fees rather than emissions. Two dimensions are red. Admin control is red because a 27-validator set with foundation validators at 48.91%, and three of them past the one-third blocking threshold, has already voted a market out of existence in two minutes. Oracle is red because HIP-3 delegated price authority to third parties who now carry over a third of the platform's open interest, the penalty for abusing it burns rather than repays, and the first serious failure was repaired only by a discretionary payment the deployer said it would not promise again.

Be precise about what went wrong in July, because the sloppy version of this story is circulating. Users were made whole. The problem is that the mechanism that made them whole was a company's decision, not the protocol, and the protocol has no equivalent.

The practical rule this month is narrower than a verdict: use the core markets, check the ticker prefix and stay out of builder-deployed ones, and keep HLP and HYPE sized for an intervention rather than for a hack. Since we hold HYPE and read our funding rates off this venue, the funding data remains fine to trust; it comes from the core validator-signed markets, not from HIP-3 feeds.

Data appendix

  • TVL: about $6.27B (DeFiLlama "hyperliquid", 2026-08-05, verified by orchestrator). Note the basis, because the API and the site differ: api.llama.fi/protocol/hyperliquid returns $6.052B (Hyperliquid L1 $5.63B plus Arbitrum $421.8M), and the $6.269B headline is that parent total plus the $216.6M HLP child. Do not add the HLP line below to the TVL figure or you will count it twice. On the same parent-plus-HLP basis, 2026-07-01 was about $5.97B, so roughly +5% on the month. TVL is a poor headline metric here; open interest is larger.
  • Open interest, core: $6.99B live (Hyperliquid API metaAndAssetCtxs, 2026-08-05). BTC $2.25B, ETH $1.85B, HYPE $1.26B, SOL $296M. Across 177 live markets: the universe returns 232 entries, but 55 are flagged isDelisted and all carry zero open interest.
  • Open interest, HIP-3: $3.89B across nine builder-deployed dexes, about 36% of the $10.88B platform total. Trade.xyz (xyz) is $3.88B over 105 markets, 99.6% of all HIP-3 open interest; largest are xyz:SP500 $652M, xyz:SKHX $333M, xyz:GOLD $267M. The remaining eight dexes (Felix, Ventuals, HyENA, Markets by Kinetiq x2, ABCDEx, dreamcash, Paragon) are each under $10M and several are at zero.
  • HIP-3 oracle authority: the perpDexs registry shows each dex carrying deployer-controlled setOracle sub-deployer addresses. Trade.xyz's roughly 105 markets route through a single one, 0x1234567890545d1df9ee64b35fdd16966e08acec.
  • HLP vault: $216.7M (Hyperliquid API vaultDetails, 2026-08-05 11:09 UTC), cross-checked against DeFiLlama "hyperliquid-hlp" at $216.6M the same day. Down from $260.6M on 2026-07-05, about 17%, roughly $44M. Month PnL over that window was positive, about +$64,000, so the decline is redemptions and not losses. Nearly half of it was a single $20.2M step between 2026-07-24 and 2026-07-25, visible in the DeFiLlama series in the same place, two days before the SK Hynix event. All-time PnL positive, about +$136.9M. Reported APR 0.34%.
  • Validator set: 27 active, 7 inactive, none jailed (Hyperliquid API validatorSummaries, 2026-08-05). Total active stake 435,384,584 HYPE, about $24.9B at the live mark. Five Hyper Foundation validators hold 212,930,871 HYPE, 48.91%; 22 non-foundation hold 51.09%. Top three, all foundation, hold 37.45%, above the one-third threshold that blocks a two-thirds quorum. Eight validators reach 67.82%. Median predicted staking APR 2.18% (day, week and month periods all 2.178%). Count and foundation share both confirm the prior report's figures 35 days later.
  • Consensus: HyperBFT (HotStuff-family BFT, HYPE-staked validators). Source: Hyperliquid docs.
  • Bridge: USDC custody on Arbitrum. Docs: deposits "are credited when more than 2/3 of the staking power has signed the deposit"; withdrawals require that "2/3 of the staking power has signed the withdrawal," followed by "a dispute period during which the bridge can be locked for a malicious withdrawal that does not match the Hyperliquid state"; and "Cold wallet signatures of 2/3 of the stake-weighted validator set are required to unlock the bridge." No bridge hack to date.
  • Audits: Hyperliquid docs audits page (re-checked 2026-08-05) names only Zellic, on the bridge contract, two reports (First and Final). No external audit named for HyperBFT, HyperCore or HyperEVM; matching engine still not fully open-source. Unchanged this month.
  • Admin and governance: validators can delist markets and force-settle. Docs: "the perps will settle to the 1 hour time weighted spot oracle price before the scheduled delisting voting time" and "When an asset is delisted, all positions are settled and open orders are cancelled." JELLY (2025-03-26): all validators approved within about 2 minutes, positions settled at $0.0095, HLP unrealized loss about $13.5M, Hyper Foundation made users whole apart from flagged addresses. Since JELLY, delisting votes run fully onchain and execute automatically on quorum. Routine votes in the past year include OM (February 2026), a nine-token batch (April 2026) and IP (2026-06-26, before this review window).
  • Oracle / HIP-3: deployer owns "the oracle definition and contract specifications" and "setting oracle prices, leverage limits, and settling the market if needed" (Hyperliquid docs, HIP-3). Deployer stake 500,000 HYPE, about $28.6M at the live mark, minimum 183 days. Slashing by stake-weighted validator vote: up to 100% for irregular inputs causing invalid state transitions, up to 50% for brief downtime, up to 20% for degradation. Docs: "the slashed stake by the deployer is burned instead of being distributed to affected users." Manipulation review only when externalPerpPx "moves more than 50% relative to the start of day price."
  • SK Hynix incident (2026-07-27, 23:01 UTC; 2026-07-28 08:01 Korea time, which is why outlets split on the date): the Trade.xyz SK Hynix perp, deployed and operated under HIP-3, fell from about $1,128 to $917.25 (near 19% per CoinDesk and CryptoTimes) or to $927 (17.9% per crypto.news), after a pre-market print on NXT (Nextrade), Korea's alternative trading venue, valued one share at 1,272,000 won against a prior close of about 1,816,000 won, roughly 30% below. $57.4M of positions liquidated across 960 accounts; realized long losses about $17.4M across 900-plus accounts. The contract recovered above $1,100 and closed the day down 13.7%; SK Hynix itself closed the Seoul regular session down 14.65%. Deployer stake was not slashed and no validator review was triggered, the move being far under 50%. Trade.xyz maintains "the oracle system worked as intended according to its specification." It announced reimbursement on 2026-07-29 as "a one-time discretionary decision," recalculating liquidations against a reference price of about $1,115.50, paying claims under 10,000 USDC automatically and crediting larger claimants an initial 9,999 USDC pending review, with a 2026-08-15 deadline. Hyperliquid's position: "Hyperliquid is a permissionless blockchain. Different teams can deploy and operate markets on Hyperliquid, using it as the infrastructure layer."
  • HYPE price: $57.215 mark, $57.236 oracle, 24h volume $267.9M, prior day $55.434 (Hyperliquid API, 2026-08-05). These tick continuously; treat as a snapshot.
  • Token distribution: 1,000,000,000 HYPE total supply (the genesis airdrop of 310M was 31% of supply; the spot API reports total supply about 999.06M). Genesis distribution 31%, core contributors 23.8%, Hyper Foundation budget 6%, future emissions and rewards 38.888%, community grants 0.3%, HIP-2 0.012%. No private-investor, CEX or market-maker allocation. Core-contributor tokens locked one year post-genesis, most vesting 2027-2028 and some later. Wallet-level holder concentration: refresh (Nansen agent run).
  • Peer context: Hyperliquid holds close to two-thirds of all perp-DEX open interest; nearest competitor Aster is about $1.84B, Lighter about $830M (third-party ranking data, July 2026; DeFiLlama's derivatives overview endpoint is paywalled and returned HTTP 402 this run).
  • Recent-news scan (2026-07-01 to 2026-08-05): the SK Hynix HIP-3 oracle failure on 2026-07-27 is the material event of the window, along with the reimbursement that followed on 2026-07-29 and the payouts since. HIP-3 and HIP-4 deployer economics drew scrutiny in July over the stake requirement. No validator intervention, delisting or force-settlement on core markets inside the window: the IP delisting vote is dated 2026-06-26 and falls outside it. No exploit, no bridge incident, no depeg found.

Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols