TL;DR
Kinetiq issues kHYPE, the liquid staking token for HYPE on HyperEVM. This is the second look, six weeks after the first. The control surface is identical, nothing broke, and the accounting still reproduces to the wei. Two things moved, and both moved the wrong way.
Start with the headline, because on its own it lies. Parent slug kinetiq reads about $1.315B today against $892,122,255 on 2026-08-05, and the kHYPE child reads $1,192,209,371 against $814,312,212. That is up about 47%. Over the same six weeks HYPE went from about $57.12 to about $92.15, up 61%. In HYPE units the protocol shrank: backing fell from 14,033,123 HYPE to 12,507,378, and kHYPE supply fell from 13,723,433 to 12,202,237, both about 11%. Delegated stake fell 13%. Kinetiq did not grow. Its collateral got more expensive.
The gate question this run was exit capacity against supply, and the answer is worse. The instant pool holds 65,071 HYPE where it held 85,967. The four meaningful kHYPE/WHYPE pools are bigger in dollars and about 19% smaller in HYPE. Same-day capacity is now about 1.36% of backing against 1.54% in August, while the withdrawal queue went from 1.48% of supply to 3.68%. Nothing here is a run. The direction is the point.
On admin control, the September file is worth more than any amount of reasoning about what a multisig could do. On 2026-09-15 the Safe paused the sKNTQ vault at 15:18:24 UTC, replaced its implementation at 15:39:36, and unpaused it at 16:09:11. Fifty-one minutes, four signatures, no delay of any kind, with two further calls into the vault by 16:53:57 closing a ninety-five minute operation. That is the same Safe that holds the upgrade key to the token our PT redeems into.
Checklist
Audits and contracts. I re-read Kinetiq's contracts page rather than trusting the August summary of it, and the audit table is unchanged: eight reports from four firms, Pashov 2025-03-06, Zenith 2025-03-17, Code4rena 2025-04-16, Spearbit 2025-06-24, Pashov 2025-11-23 on instant unstake, Zenith 2025-11-24 and Spearbit 2025-11-27 on kmHYPE, Spearbit 2026-01-15 on sKNTQ. Four firms, one of them a competitive audit, no invented names, and nothing new in eight months.
The bounty moved, and the movement is now half-explained rather than a mystery. Today's Cantina page reads Live and Cantina-Triaged, start date 15 Sep 2025, a $1,000,000 total reward pool and a severity ladder of $1,000,000 for a Critical, $50,000 High, $5,000 Medium, $500 Low, with 414 findings submitted and the right seven contracts in scope. The August report recorded a $5,000,000 maximum, and that figure traces to Cantina's own launch announcement, titled "Kinetiq Launches $5M Bug Bounty, The Largest on HyperEVM with Cantina". So the August read matched Cantina's marketing at the time and the live page today reads one fifth of it. That post now returns 404 on Cantina's current domain, so I could not re-read it directly, and I am not going to guess whether the terms were cut or the headline was always larger than the payout table. Today's page is the operative number. A bounty maximum that quietly falls fivefold is the kind of thing worth noticing on a protocol whose main defence is that many eyes have looked.
Two things keep this yellow, and both are the same ones as last time. Every core contract is a transparent proxy, so an audit certifies bytecode that a multisig can swap, and that swap happened again this month on sKNTQ, eight months after the only audit covering it. And the two address divergences on the contracts page are still there, six weeks after they were found. The kHYPE table still displays PauserRegistry as 0xac03CABA51e17c86c921E1f6CBFBdC91F8BB2E6b, which I re-checked and which still has zero code, zero balance and nonce 0, while the live registry that StakingManager actually returns is 0x752e76ea.... And DefaultOracle and OracleAdapter are still both listed as 0xefbcCc6E33DA1C1ef638cBc0F044968D0f590fED, which still returns false from both isAuthorizedOracle and isActiveOracle, while the one authorized and active adapter, 0x26fe3019..., still does not appear on the page at all. Neither is a fund risk. Both are on the page whose only job is letting an outsider check who controls the pause. The Operator row on that page, for what it is worth, does match the live OPERATOR_ROLE holder.
Elysium is new and unaudited as far as the page shows. On 2026-08-24 Kinetiq announced an Arbitrum Orbit chain settling to HyperEVM and co-located with HyperCore, with HYPE as gas and sequencer fees split 25% to builders, 25% to treasury and 50% to KNTQ buyback and burn. Launch is described as imminent with specs and partners still to come. That is a large new surface for a team already running a $1.19B LST, and it is not in the audit table.
Admin control. Read from the chain again, not from docs. 0x18a82c968b992d28d4d812920eb7b4305306f8f1 returns VERSION 1.3.0, getThreshold() 4 and getOwners() eight addresses, and the owner set is byte-for-byte the same eight as in August, with the same nonces. All eight are still EOAs with zero code. getModulesPaginated still returns an empty array, so there is no side door around the threshold.
Everything else is unchanged too. That Safe still owns the ProxyAdmin of the kHYPE token, StakingManager, ValidatorManager, StakingAccountant, OracleManager and the InstantUnstakePool, each owner() returning the Safe directly. It is still the only DEFAULT_ADMIN_ROLE and only MANAGER_ROLE holder on all four managers, one member each, and on the InstantUnstakePool too. It still holds DEFAULT_ADMIN_ROLE, PAUSER_ROLE, UNPAUSER_ROLE and PAUSE_ALL_ROLE on the live PauserRegistry, alone. It still holds DEFAULT_ADMIN_ROLE on kHYPE itself, and getRoleAdmin(MINTER_ROLE) returns the zero bytes32, which is DEFAULT_ADMIN_ROLE, so four signatures can grant minting rights in one transaction with no upgrade. MINTER_ROLE and BURNER_ROLE each still have exactly one member, the StakingManager. There is still no TimelockController anywhere in that chain.
What is new is evidence that the power gets used, and this time the evidence does not depend on arithmetic. The Safe's transaction list on chain 999 shows its previous transaction before September was on 2026-08-01 02:44 UTC, four days before the last report, and then nothing at all until 2026-09-15. Asking the explorer for the earliest and the latest transactions after 2026-08-05 15:50 UTC returns the identical five rows, which is how you know the list is complete rather than truncated. The Safe's nonce() has gone 62 to 67 over the same period, agreeing independently.
All five landed on 2026-09-15 and all five are on the KNTQ side. pauseContract(0x696238e0) at 15:18:24 UTC, sent to a second PauserRegistry at 0x572df040, 1,876 bytes of code, whose sole DEFAULT_ADMIN_ROLE holder is the same Safe. upgradeAndCall(0x696238e0, 0x581deea8..., "") at 15:39:36, sent to ProxyAdmin 0x53e4b50b, whose owner() is the same Safe. unpauseContract(0x696238e0) at 16:09:11. Then two calls into 0x696238e0 itself at 16:22:46 and 16:53:57 with selector 0x8d9f6a93, which resolves in no public signature database, carrying an address argument of 0xfefe...fefe and raw amounts of 100,000,000 and 85,099,000,000,000. 0x696238e0ca31c94e24ca4cbe7921754e172e4d0f returns name() "Staked KNTQ" and symbol() "sKNTQ", and its implementation slot now holds 0x581deea8, so the upgrade landed. Not one of those five went near a kHYPE ProxyAdmin, so the six core contracts were not upgraded in the window.
The history is the sharper point. The kHYPE ProxyAdmin's own transaction list shows two direct calls ever: an upgradeAndCall on 2025-07-05 installing implementation 0x210461fc... with the "Kinetiq Staked HYPE" initialiser, then transferOwnership to the Safe on 2025-07-15 15:57 UTC. The implementation running today is 0xfe3216d4..., created 2025-11-14, four months after the Safe took ownership. StakingAccountant tells the same story: initial implementation 0xecaa7cd7... on 2025-07-05, ownership to the Safe on 2025-07-15 16:00 UTC, live implementation 0x1bbfe538... created 2026-04-05 00:39 UTC, alongside fresh StakingManager and ValidatorManager implementations at 00:36 and 00:38 that same morning and a new InstantUnstakePool implementation at 01:22. So the Safe has already replaced the token contract and the contract that computes the exchange rate, in production, at least once each. Add the sKNTQ upgrade four days ago and the pattern is a team that ships upgrades through a hot multisig on a routine basis. That is a competent operator and an unmitigated key risk at the same time.
Oracle. Unchanged and still not a price oracle. reportSlashingEvent is still gated on ORACLE_MANAGER_ROLE, still held by the OracleManager contract rather than a key. Exactly one adapter is authorized and active. The ValidatorSanityChecker, read off the OracleManager, is still set and live with 4,467 bytes of code, and maxPerformanceBound reads 10000. totalSlashing() reads exactly 0, so the negative term in the exchange rate has never been touched, and Hyperliquid still implements no automatic slashing. The two openings are the same two: OPERATOR_ROLE is a single hot EOA that can widen the bound its own reports are measured against, and setSanityChecker is admin-only with code that skips the check rather than failing closed when the address is zero. That operator key is busier than it was, nonce 16,176 against 13,974 in August, which is consistent with a running report loop and nothing else.
Liquidity and exit. This is the dimension the gate asked about, and it got thinner relative to the thing it has to absorb.
The queue is unchanged and still works. withdrawalDelay() reads 604800 and the documented path is still about 8 to 9 days including the 1-day delegation lockup. Neither leg is Kinetiq's to shorten. What changed is how many people are standing in it: totalQueuedWithdrawals() is 449,094.66 kHYPE, 3.68% of supply, against 203,730.60 and 1.48% in August, and the L1 shows 348,569.64 HYPE pending across four withdrawals against 62,372.68 six weeks ago. That is a two and a half fold increase in queued exits as a share of the token. It is still an orderly 3.7%, not a run, but it is the largest single change in the protocol's operating picture this month.
The fast doors both shrank in the unit that matters. The InstantUnstakePool holds 65,071.13 HYPE at a 10bp fee, down from 85,967.32. The four meaningful kHYPE/WHYPE pools hold about $9.73M (nest $6.38M, prjx $2.62M, ramses $0.65M, hyperswap $0.08M), which looks like growth against August's $7.42M until you divide by a HYPE price that rose about 61%: about 105,600 HYPE now against about 129,912 then. Nine more kHYPE/WHYPE pairs exist and add roughly $114k between them, so counting all thirteen moves nothing. Combined same-day capacity is about 170,650 HYPE, roughly $15.7M at today's mark, against 12,507,378 HYPE of backing. That is 1.36% of the protocol, where August measured 1.54%. Note the caveat that carries over from last time: pool liquidity as reported is both sides of each pair, so executable depth at tolerable slippage is a good deal less than the headline. The dollar figures in this paragraph tick with HYPE; the HYPE figures are the ones to hold onto.
The peg itself is fine. Native quotes run 1.02412 to 1.02421 kHYPE per WHYPE against an on-chain redemption rate of 1.0250070, so the market sits about 0.08% under redemption. Wider than the 0.012% measured in August, still effectively par. Fifty daily marks of kHYPE against HYPE from DeFiLlama's charts give a ratio range of 1.00757 on 2026-08-19 to 1.03862 on 2026-08-14. The high end is 1.3% above the redemption rate, which is impossible as a market fact and therefore measures the feed rather than the token, so the series carries one to two percent of noise in both directions and shows nothing resembling the September 2025 event. Intraday lows in the window were not measured.
For our own position the exit is a non-question. The Pendle kHYPE market holds $6,235,183 of liquidity against our 69.275 PT at $92.2631, about $6,392, or 0.10% of the pool, and maturity is 2026-09-24, five days out. We will be out of this leg before any of the above matters.
Yield: real versus emission. Still real, and it still closes from two directions. Pendle reports underlyingApy 1.9971% with underlyingRewardApy 0. Hyperliquid's median predicted validator APR across the 27 active validators is 2.1637%, and 2.1637 times 0.9, for Kinetiq's documented 10% fee, gives 1.9473%. Five basis points apart. Nothing is printed to produce that number. The fee still routes 70% to KNTQ buybacks and 30% to treasury, so 7% of gross staking yield leaves kHYPE holders for KNTQ holders. Elysium adds a second buyback channel out of sequencer fees, which changes the KNTQ story and not the kHYPE one. Absolute yield of about 2% is a return question, not a risk question.
Holder concentration. Validator concentration is what can cost an LST holder money, so it goes first, and the shape is the same as August with the numbers slightly improved.
At network level Kinetiq spreads stake. It delegates 12,001,914.98 HYPE across 14 validators, 2.72% of the 442,012,355 HYPE of active stake, down from 3.17%. All 14 are active and none is jailed, which is not a given: six validators on the network are jailed today, including Kraken and Figment, and not one of them is in Kinetiq's set. The stake-weighted commission is 2.36%, the highest being Anchorage By Figment at 10%. Not one unit goes to any of the five Hyper Foundation validators, which between them hold 47.96% of active stake. That remains a deliberate counterweight to the concentration our Hyperliquid report marks worst.
Internally it still concentrates on two names. HyperStake takes 32.36% and Kinetiq x Hyperion, a validator carrying the protocol's own brand, takes exactly 25.00%. Together 57.36%, with the top three at 61.35% and the top five at 68.57%. Slightly better than August's 59.02, 63.24 and 70.09, and still a quarter of user stake sitting on a house validator chosen by a multisig call, under a ValidatorManager that contains no per-validator cap.
Token-holder concentration is the hole I could not close, same as last time and for the same reason twice over: the Etherscan top-holders endpoint returns a Pro-subscription error on chain 999, and so does Nansen's. Spot balances only: Pendle's SY-kHYPE holds 393,262 kHYPE, 3.22% of supply, the StakingManager withdrawal escrow holds 438,508, 3.59%, the Safe holds nothing and the treasury holds 279.53. That is a sample, not a ranking, and I am not presenting it as one.
Track record. About fourteen months since the first DeFiLlama datapoint on 2025-07-17. In the six weeks since the last report I found no exploit, hack, contract incident, emergency pause or slashing. DeFiLlama's hacks list runs to 1,273 entries and contains no Kinetiq or kHYPE row of any date. totalSlashing() reads 0, stakingPaused() and withdrawalPaused() both read 0, and an X search bounded to 2026-08-05 through 2026-09-19 for incident, pause, depeg, slashing, queue and governance terms returned nothing on any Kinetiq product. The only Kinetiq chatter in that window is Elysium, and it is neutral to positive.
The one confirmed event on the board is still the old one: PeckShield reported kHYPE deviating from peg between 24 and 27 September 2025, bottoming at 0.8802 against WHYPE before recovery, an episode contemporaneous coverage attributed to liquidity fragmentation around a Hyperliquid NFT drop rather than protocol failure. That is a secondary-market dislocation on thin pools, not a redemption failure, and it is still the best available description of what the exit risk above looks like when it fires.
Two trend facts belong here rather than in the TVL line. The protocol shrank about 11% in HYPE units over six weeks while its dollar headline rose 47%, and parent TVL sits 50.4% below its 2025-10-04 peak of $2,653,266,457, with the kHYPE child 48.1% below its own peak. Steady outflow, no cliff, and a dollar number that hides it completely.
Worst case
The one that costs principal is unchanged and now has a dress rehearsal in the record. Four of the eight signers are compromised or collude. There is no timelock, so the next block carries whatever they sign. They do not need an upgrade for the fastest version: the Safe already holds DEFAULT_ADMIN_ROLE on kHYPE and can grant MINTER_ROLE to any address in one call. Or it does what it did on 2026-09-15 to sKNTQ, pause, replace the implementation, unpause, except pointed at StakingAccountant, and then kHYPEToHYPE returns whatever the new code says. Everything downstream that prices kHYPE off the protocol's own rate is then priced off a number an attacker wrote. There is no insurance fund and no warning step. Position sizing is the only mitigation, and for us it is already in place at about $6.4k of PT with five days left on it.
The likelier one has already happened once. HYPE sells off, leveraged kHYPE positions on HyperEVM unwind, the 65,071 HYPE instant pool drains, and roughly $9.7M of DEX depth absorbs the rest at a discount. September 2025 printed 0.8802 doing exactly that against a book that was, in HYPE terms, larger than today's. The redemption path keeps paying 1.0250 and keeps taking eight or nine days. Anything marked off secondary price, which is what a Pendle PT is before maturity, marks down with it. With the queue already carrying 3.68% of supply, there is less slack in that system than there was in August.
The slow one is unchanged: a bad slashing figure reaches totalSlashing through the operator key, a widened performance bound, or a sanity checker set to zero, and the exchange rate steps down permanently for every holder. Hyperliquid implements no automatic slashing today, so a genuine slash is not on the table. A reported one is a software path, and software paths do not need the underlying event to be real.
Bottom line
Caution, unchanged, and for the same single reason. Worst-flaw-wins means one red on a fund-loss surface sets the verdict, and admin control is red: one 4-of-8 Safe, eight EOA signers with undisclosed custody, no timelock, upgrade rights over all six core contracts, every management and pause role, and a one-call path to minting kHYPE. The rest of the protocol keeps earning its good marks. The exchange rate reproduced to the wei again from independent components. The yield reconciles to the validator APR net of the disclosed fee. Four audit firms, a live bounty, a working queue, a working instant pool, a secondary market 0.08% off redemption, and fourteen months with nothing broken.
What this refresh adds is that the multisig risk is no longer hypothetical in its mechanics. It is a documented operating procedure, executed four days ago, on a production contract, pause to unpause in fifty-one minutes. That does not make Kinetiq worse than it was rated. It does mean the August sentence "everything good above is revocable by four signatures in one block" should now be read as a description of how this team actually deploys, not as a thought experiment.
Practical notes for the showcase. The PT matures 2026-09-24, five days out, and at about $6.4k against $6.24M of Pendle liquidity the exit is trivial. If we roll this leg rather than let it settle, do it knowing that the underlying got thinner, not thicker: same-day exit capacity is down to about 1.36% of backing and the queue has more than doubled as a share of supply. Do not size up here. And carry the unit discipline from last time: one kHYPE is 1.0250 HYPE today and rising, so PT units, kHYPE units and HYPE units remain three different things, and any comparison of raw counts across them will be wrong.
Data appendix
- TVL: live
api.llama.fi/tvl/kinetiq$1,315,227,935 and the/protocol/kinetiqlast datapoint $1,315,381,645, with an orchestrator read of $1,315,645,893 the same day; the childkinetiq-khype$1,192,209,371. Children sum to the live parent tick almost exactly: kHYPE $1,192,209,370.90 + Earn $63,973,370.69 + kmHYPE $54,519,735.10 + Launch $4,525,460.23 = $1,315,227,936.92 against $1,315,227,935, a difference of $2. Against 2026-08-05: parent $892,122,255 and kHYPE child $814,312,212, so +47.4% and +46.4% in dollars. DeFiLlama's own series gives parent 7d $1,158,240,564 (2026-09-13, +13.6%), 30d $1,151,406,236 (2026-08-21, +14.2%), 90d $1,113,200,898 (2026-06-22, +18.2%). Parent ATH $2,653,266,457 on 2025-10-04, now 50.4% below. Child ATH $2,295,572,171 on 2025-09-19, now 48.1% below. First datapoint 2025-07-17 at $458,111,649. Our watchlist slug is the parent andPARENT_AGGREGATEinservices/scanner/protocol_facts.pymapskinetiqtokinetiq, so our board sums the children correctly; our exposure is to the child. - TVL in HYPE terms (the correction the dollar figure needs): backing 12,507,377.83 HYPE today against 14,033,122.68 on 2026-08-05, so minus 10.9%. kHYPE supply 12,202,236.52 against 13,723,433.37, minus 11.1%. Delegated stake 12,001,914.98 against 13,817,998.57, minus 13.1%. HYPE about $92.1451 at the time of writing (DeFiLlama coins, confidence 0.99) against about $57.12 on 2026-08-05, plus 61.3%. Backing times the live HYPE mark gives about $1.152B, roughly 3% under DeFiLlama's child figure, which is price-source variance and moves with the mark.
- Exchange rate, reproduced exactly:
StakingAccountant.kHYPEToHYPE(1e18)= 1,025,006,998,266,564,252. Recomputed from components as integers: totalStaked 52,213,218,146,227,060,000,000,000 + totalRewards 555,419,892,150,146,000,001,010 - totalClaimed 40,261,260,209,626,228,820,459,284 - totalSlashing 0 = 12,507,377,828,750,977,179,541,726 wei over a supply of 12,202,236,521,216,704,043,679,497 wei, which gives 1,025,006,998,266,564,252. Exact match, not approximate. InverseHYPEToKHYPE(1e18)= 975,603,095,092,175,254. August rate was 1.022566459451159247, so the rate rose 0.24% in six weeks, consistent with roughly 2% annualised. - Admin and governance (all read on-chain this run): Safe
0x18a82c968b992d28d4d812920eb7b4305306f8f1,VERSION()1.3.0,getThreshold()4,getOwners()8,nonce()67 (62 in August),getModulesPaginatedempty. Owner set identical to August, all eight zero-code EOAs (nonces 0, 28, 3, 12, 13, 23, 12, 12). It owns the ProxyAdmin of kHYPE (0x9c1e8db0), StakingManager (0x8194aa9e), ValidatorManager (0xf8b427d3), StakingAccountant (0x7957de69), OracleManager (0x4c0a83d7) and InstantUnstakePool (0x1ab8a96e), eachowner()returning the Safe directly with no timelock in between. Sole DEFAULT_ADMIN_ROLE and sole MANAGER_ROLE on StakingManager, ValidatorManager, StakingAccountant, OracleManager and the InstantUnstakePool, one member each. Sole DEFAULT_ADMIN_ROLE, PAUSER_ROLE, UNPAUSER_ROLE and PAUSE_ALL_ROLE on the live PauserRegistry0x752e76ea.... Sole DEFAULT_ADMIN_ROLE on kHYPE;getRoleAdmin(MINTER_ROLE)returns0x00...00, so the Safe can grant MINTER_ROLE in one call. kHYPE MINTER_ROLE and BURNER_ROLE each have one member, the StakingManager. OPERATOR_ROLE on StakingManager, OracleManager and the InstantUnstakePool is one EOA0x23a4604cdfe8e9e2e9cf7c10d7492b0f3f4b4038, zero code, nonce 16,176, 2.17 HYPE. ORACLE_MANAGER_ROLE on ValidatorManager is the OracleManager contract. TREASURY_ROLE and SENTINEL_ROLE on StakingManager still have zero members. Treasury0x64bd7769..., confirmed byStakingManager.treasury(). - Safe activity, bounded directly rather than by nonce arithmetic: the explorer's ascending and descending listings from block 42,383,867 (2026-08-05 15:50:27 UTC) return the identical five rows, which is how the set is known to be complete rather than capped; widening the start to block 41,000,000 adds exactly one earlier transaction, on 2026-08-01 02:44:34 UTC to
0x1d89b868..., which is not one of the six core ProxyAdmins. So the Safe did nothing at all between 2026-08-01 and 2026-09-15. The five: 15:18:24pauseContract(0x696238e0)to0x572df040...; 15:39:36upgradeAndCall(0x696238e0, 0x581deea8..., "")to ProxyAdmin0x53e4b50b...whoseowner()is the Safe; 16:09:11unpauseContract(0x696238e0); 16:22:46 and 16:53:57 two calls to0x696238e0with unresolved selector0x8d9f6a93, arguments0xfefe...fefeand raw amounts 100,000,000 and 85,099,000,000,000. Selectors0xadb99c8aand0xd97b9bd5were confirmed by keccak againstpauseContract(address)andunpauseContract(address).0x696238e0ca31c94e24ca4cbe7921754e172e4d0fis the sKNTQ vault,name()"Staked KNTQ",symbol()"sKNTQ", implementation slot now0x581deea8...(15,053 bytes). Its pause registry0x572df040(1,876 bytes) has the Safe as sole DEFAULT_ADMIN_ROLE holder. No transaction in the window touched any of the six kHYPE ProxyAdmins. - Prior upgrades of the kHYPE stack (evidence that the power is exercised): kHYPE ProxyAdmin
0x9c1e8db0has two direct transactions ever,upgradeAndCallon 2025-07-05 installing implementation0x210461fc...with a "Kinetiq Staked HYPE" / "kHYPE" initialiser, andtransferOwnershipto the Safe on 2025-07-15 15:57 UTC. The live kHYPE implementation is0xfe3216d4..., created 2025-11-14 05:10 UTC, after that handover, so the Safe replaced it. StakingAccountant ProxyAdmin0x7957de69shows the same pattern: initial implementation0xecaa7cd7...on 2025-07-05, ownership to the Safe on 2025-07-15 16:00 UTC, live implementation0x1bbfe538...created 2026-04-05 00:39 UTC. StakingManager0x23fda3b9...(00:36 UTC) and ValidatorManager0x7576dfe1...(00:38 UTC) implementations were created the same morning, and InstantUnstakePool's0xbda05e70...at 01:22 UTC. All five by deployer0xb05cb1a8.... Post-handover ProxyAdmin calls arrive as internal calls from the Safe and do not appear in the ProxyAdmin's normal-transaction list, which is why the Safe's own list is the authority for the recent window. - Live implementations and proxy admins: kHYPE impl
0xfe3216d46448efd7708435eeb851950742681975, StakingManager0x23fda3b9f944dbeaf2dcd5e7b9f8207b102c933f, ValidatorManager0x7576dfe1f86cb38048cc6a6dd68c5d5a9c28df14, StakingAccountant0x1bbfe538ccebe1df35c2ebe35203d40cb18fdae0, OracleManager0xe6cc74e00103585eb5982086cd06a247642f0767, InstantUnstakePool0xbda05e701aadb24b0586ca70f67e63f38763ffdc, all read from the EIP-1967 slots. - Core contracts: kHYPE
0xfD739d4e423301CE9385c1fb8850539D657C296D, StakingManager0x393D0B87Ed38fc779FD9611144aE649BA6082109, ValidatorManager0x4b797A93DfC3D18Cf98B7322a2b142FA8007508f, StakingAccountant0x9209648Ec9D448EF57116B73A2f081835643dc7A, OracleManager0x192826e470bd65FDC2CB472eDd834D096233049b, InstantUnstakePool0x665b67793594fc5c251a3c95cbeb4b6245cd2123, live PauserRegistry0x752e76ea71960da08644614e626c9f9ff5a50547, live oracle adapter0x26fe3019b55f65f454c6b5f8baeea1ed405544c9, ValidatorSanityChecker0x8b641d61f1e8811038bc99ada1685b261da2797d(4,467 bytes). - Documentation divergences, still open after six weeks: the contracts page still displays PauserRegistry as
0xac03CABA51e17c86c921E1f6CBFBdC91F8BB2E6b, re-verified today as zero code, zero balance, nonce 0, whileStakingManager.pauserRegistry()returns0x752e76ea.... The page still lists DefaultOracle and OracleAdapter as the same0xefbcCc6E33DA1C1ef638cBc0F044968D0f590fED, re-verified today as returning false from bothisAuthorizedOracleandisActiveOracle, while0x26fe3019...returns true for both and is absent from the page. The page's Operator row,0x23A4604cDFe8e9e2e9Cf7C10D7492B0F3f4B4038, does match the live role holder. The page still does not list the InstantUnstakePool, sKNTQ or KNTQ in the kHYPE deployment table. - Parameters:
withdrawalDelay()604800,unstakeFeeRate()0 (source caprequire(newRate <= 1000)read in August, so 10% maximum),minStakeAmount()5 HYPE,stakingLimit()0,stakingPaused()0,withdrawalPaused()0,totalQueuedWithdrawals()449,094.658971239991 kHYPE,InstantUnstakePool.instantUnstakeFeeRate()10bp,OracleManager.maxPerformanceBound()10000. Documented fee unchanged: 10% of staking rewards, 70% to KNTQ buybacks and 30% to treasury. - Exit capacity: InstantUnstakePool native balance 65,071.13 HYPE, about $6.00M at $92.1451 (85,967.32 HYPE in August). kHYPE/WHYPE pools, DexScreener: nest $6,377,662 (v24h $948,749), prjx $2,621,112 ($1,582,472), ramses $654,314 ($2,875,145), hyperswap $75,634 ($21,242), those four $9,728,722, about 105,581 HYPE; all thirteen kHYPE/WHYPE pairs $9,843,072, about 106,821 HYPE, so the tail adds roughly 1,240 HYPE. August measured $7,420,597 and about 129,912 HYPE. Combined same-day capacity about 170,652 HYPE, roughly $15.7M, which is 1.36% of the 12,507,378 HYPE of backing. August measured about $12.3M, about 215,880 HYPE, 1.54% of backing. Pool liquidity as reported counts both sides of each pair, so executable depth is materially less.
- Withdrawal queue:
totalQueuedWithdrawals()449,094.66 kHYPE, 3.68% of supply (203,730.60 and 1.48% in August). HyperliquiddelegatorSummaryfor the StakingManager: delegated 12,001,914.9798831996 HYPE, undelegated 0.00000544, totalPendingWithdrawal 348,569.63510973, nPendingWithdrawals 4 (62,372.68 and 4 in August). - Secondary peg: kHYPE/WHYPE native quotes 1.02412 (nest), 1.02414 (prjx), 1.02421 (ramses), 1.02415 (hyperswap) against a redemption rate of 1.0250070, so 0.078% to 0.087% under redemption. Fifty daily kHYPE and HYPE marks (DeFiLlama coins charts, 2026-07-31 to 2026-09-18) give a ratio range of 1.00757 (2026-08-19) to 1.03862 (2026-08-14); the high side is 1.3% above redemption and therefore feed noise, so the series carries roughly 1 to 2% of noise in both directions and shows nothing approaching the 2025 event. The low end is 1.7% under today's redemption rate, inside that noise band, uncorroborated by a second source, and not called a depeg. Intraday lows not measured.
- Audits and bounty: eight reports, re-verified on kinetiq.xyz/docs/contracts-and-audits today, unchanged from August: Spearbit 2026-01-15 (sKNTQ), Spearbit 2025-11-27 (kmHYPE), Zenith 2025-11-24 (kmHYPE), Pashov Audit Group 2025-11-23 (kHYPE LST Instant Unstake), Spearbit 2025-06-24 (kHYPE LST), Code4rena 2025-04-16 (kHYPE LST), Zenith 2025-03-17 (kHYPE LST), Pashov Audit Group 2025-03-06 (kHYPE LST). Cantina bounty
a98129d7-dd15-4c16-b2cb-d8cc42f87de4, status "Live, Cantina-Triaged", start date 15 Sep 2025, total reward pool "$1,000,000", severity ladder Critical "$1,000,000", High "$50,000", Medium "$5,000", Low "$500", $20 deposit, 414 findings submitted, scoped to kHYPE, StakingManager, StakingAccountant, ValidatorManager, PauserRegistry, OracleManager and OracleAdapter (DefaultOracle). The August read of a $5,000,000 maximum matches Cantina's own launch post, "Kinetiq Launches $5M Bug Bounty, The Largest on HyperEVM with Cantina", which states "$5,000,000 in rewards" but now returns 404 on Cantina's current domain; the live page reads one fifth of that and the reason is unresolved. - Yield: Pendle
underlyingApy1.9971%,underlyingRewardApy0,impliedApy2.8329%,ptDiscount0.0327%,swapFeeApy0.0115%,aggregatedApy2.2281%. HyperliquidvalidatorSummariesmonthly predicted APR across 27 active validators: median 2.1637%, range 2.0072% to 2.2290%. 2.1637 times 0.9 gives 1.9473% against an observed 1.9971%, a gap of 4.98bp. - Validator set (Hyperliquid API, 2026-09-19): 35 validators, 27 active, 442,012,354.65 HYPE of active stake. Kinetiq delegates 12,001,914.98 HYPE to 14 of them, 2.72% of active stake. HyperStake 3,883,578.66 (32.36%, 0% commission), Kinetiq x Hyperion 3,000,478.74 (25.00%, 4%), Nansen x HypurrCollective 479,595.56 (4.00%), Purrposeful x HyBridge x PiP 444,894.22 (3.71%), infinitefield.xyz 420,672.61 (3.51%), Bitwise 419,314.25 (3.49%), then Liquid Spirit x Hydromancer x Rekt Gang, ASXN, Anchorage By Figment, B-Harvest, USDT0 x Luganodes, CMI, HypurrCorea Spacebar x DeSpread and Hyperdash at about 3.49% each. Top two 57.36%, top three 61.35%, top five 68.57%. Stake-weighted commission 2.3637%, highest Anchorage By Figment at 10%. None of the 14 jailed or inactive; six other network validators are jailed (HyperCN X hlscan, Red Pond, cp0x by STAKR.space, Kraken, Falcon Capital, Figment). Zero delegation to the five Hyper Foundation validators, which hold 211,978,498.71 HYPE, 47.96% of active stake.
- Holder concentration: kHYPE supply 12,202,236.52. Etherscan
tokenTopHoldersreturned "API Pro endpoint" and Nansentoken_current_top_holdersreturned HTTP 403 "premium_labels=true requires a Pro subscription" on chain 999 this run, so no ranking. Spot balances: Pendle SY-kHYPE 393,262.46 (3.22%), StakingManager withdrawal escrow 438,508.34 (3.59%), governance Safe 0, treasury 279.53, InstantUnstakePool 0. Wallet-level ranking: refresh. - Our exposure (Pendle, chain 999): market
0xb48b0c95b2ddc464484305b7363fad5bd5b7a683, PT-kHYPE-24SEP20260x50fc4edc6346f36993bb30fe60e932504ed17391at $92.2631, YT0xe45162d03e0475dab556ef1cccefeea2ec27ade2at $0.030161, SY-kHYPE0x57fc55dff8ceca86ee94a6bf255af2f0ed90eb9e, maturity 2026-09-24, five days out. Market liquidity $6,235,183, total TVL $35,542,343, 24h volume $2,878,354. Our 69.275069951 PT is about $6,392, roughly 0.10% of pool liquidity. kHYPE marked at $94.6012 on Pendle the same minute. - Incident scan (2026-08-05 to 2026-09-19): DeFiLlama's hacks list, 1,273 entries, contains no Kinetiq or kHYPE row of any date. No exploit, hack, pause, slashing, depeg or governance dispute found in web search or in an X search bounded to the window.
totalSlashing()0,stakingPaused()0,withdrawalPaused()0. One material non-incident: on 2026-08-24 Kinetiq announced Elysium, an Arbitrum Orbit (Nitro/ArbOS) L2 settling to HyperEVM and co-located with HyperCore, with HYPE as gas and sequencer fees split 25% builders, 25% treasury, 50% KNTQ buyback and burn, launch described as imminent with specs and partners pending. No audit for it appears on the contracts page, and X discussion on 18 Sep 2026 notes the absence of both a mainnet date and an audit. - Name collision, unchanged: kHYPE (Kinetiq,
0xfD739d4e...) is not stHYPE (StakedHYPE / Thunderhead), not vkHYPE, not haHYPE, not wstHYPE and not kmHYPE, and kmHYPE is a second Kinetiq LST rather than a typo. Chain 999 carries live pools for several of them, including a vkHYPE/kHYPE pair at $712,113, two kmHYPE/kHYPE pairs and a wstHYPE/kHYPE pair. No figure above is sourced from any of them.
Second report on this protocol; first was 2026-08-05. Maintained monthly. Methodology: DeFi Research Instruction v2.