TL;DR
Pacifica is a Solana perpetuals exchange with an off-chain matching engine and on-chain settlement. It is not self-custodial in the way that phrase is usually heard. You send USDC or SOL into an exchange-controlled bridge account, and from that point your balance is a row in Pacifica's engine, not a token in your wallet. That model can work. Hyperliquid runs a version of it. What decides whether it is acceptable is whether the controls around the deposit path are real and checkable. Pacifica's own Fund Security page makes that easy to test: it states that "the upgrade authority is distributed across multi-sig participants, not held by any individual or single organization," and it says you do not have to trust them because you can verify on-chain. So we verified. The deposit and withdrawal program PCFA5iYgmqK6MqPhWNKg7Yv7auX7VZ4Cx7T1eJyrAMH is upgradeable, and its upgrade authority is BzZgjpBFHb19vWjBRoM5eVy6qnUjbGH5tMJrnN7cA47a, an ordinary on-curve address. Squads multisig vaults are program-derived and off-curve, and Pacifica's own published bridge and vault addresses are all off-curve, so the test discriminates. The upgrade key does not look like the multisig the page describes. It could be an off-chain threshold or MPC key, which would present the same way. We cannot tell from the chain, and not being able to tell is the finding. Alongside that, the docs' Audits page holds a single link to a BlockSec PDF that returns 404, and BlockSec names Pacifica nowhere on its own site, neither in its public report index nor on its Solana audit page. The good news is real too. The hot and cold split exists on-chain, 94.6% of the USDC sits away from the engine, the deposit program has not actually been upgraded since roughly its launch deployment fourteen months ago, the record is clean, volume is large, and the founders are named. But custody is deposit-to-venue with no documented unilateral exit, and the one control that would make deposit-to-venue tolerable does not survive the venue's own verification invitation.
Checklist
Audits and contracts. Pacifica's docs have an Audits page. Its entire content is a link to "BlockSec audit report (PDF)". That file returns 404 on the documented path today. BlockSec's public audit-report index does not list Pacifica, and neither does BlockSec's own Solana audit landing page, which names a dozen other clients. So the firm name comes from Pacifica alone, and the date, the scope, the commit, the severity counts and the remediation status are all unknown. Third-party write-ups assert the audit covered "the bridge component," but that is secondary reporting with no document behind it. An audit you cannot open is not an audit you can lean on, and on a venue holding $25M of deposits that gap is not cosmetic. A separate Bug Bounty Program page does exist in the documentation. Whether the on-chain program is source-verifiable is unconfirmed.
Admin control. This is the crux. The program that receives deposits and pays withdrawals, PCFA5iYgmqK6MqPhWNKg7Yv7auX7VZ4Cx7T1eJyrAMH, runs under the BPF upgradeable loader with program data at FC5zcmPmqo5188fLVga2HN5QZ1T1ojhNneVkFdu6eF1E and an active upgrade authority, BzZgjpBFHb19vWjBRoM5eVy6qnUjbGH5tMJrnN7cA47a. That authority is a system-owned account with no data, and it is on the ed25519 curve, which means it is an ordinary public key rather than a program-derived address. We ran the same test against controls in both directions, and Pacifica's four published bridge and vault addresses all came back off-curve while the upgrade authority came back on-curve. A Squads-governed upgrade authority would be off-curve. Pacifica posted on X on 3 April 2026 that "from day one, our contracts/limits have been secured by 4/6 multisig," which sits oddly beside the Fund Security page's own statement that Pacifica "is transitioning to" this architecture. Threshold signing done off-chain would also present as a single on-curve key, so this is not proof of a lone signer at a laptop. It is proof that the multisig, the threshold, the members and the timelock cannot be verified on-chain, which is precisely what the Fund Security page promises they can be.
Two concrete findings sharpen the picture, one in each direction. Against: the hot USDC bridge token account is controlled by 9Gdmhq4Gv1LnNMp7aiS1HSVd7pNnXNMsbuXALCQRmGjY, and that account is owned by the Pacifica program itself, so whoever holds the upgrade key can reach the hot balance by redeploying. That is confirmed, not inferred. In favour: the program's last deployment is slot 343778047, roughly fourteen months ago by slot arithmetic, which puts it around mainnet launch. The upgrade key exists and is live, but it has not been exercised since. Separately, the operator can halt trading and applies an exchange-wide withdrawal cap, and vault managers can change whitelists, blacklists and per-symbol leverage caps at any time with, in the docs' own words, no notice period for depositors.
Oracle. There is no Pyth, Switchboard or Chainlink here. Pacifica computes its own oracle price every three seconds as a weighted average of USDT-denominated prices from Binance (weight 2), OKX, Bybit and Hyperliquid (weight 1 each). Mark price, which drives liquidations, margin and unrealised PnL, is the median of that oracle, the median of Pacifica's own best bid, best ask and last trade, and perpetual prices from major exchanges. As a design this is reasonable and hard to move with a single venue print. As a trust question it is the operator computing, publishing and applying its own numbers off-chain with no third-party attestation and no on-chain proof. For a SOL or HYPE short the practical exposure is that the number setting your liquidation price is produced by the same party holding your collateral.
Liquidity and exit. Two different things, and they land differently. Market liquidity is genuinely good. Pacifica's own API reports about $471M of 24h volume and about $103M of open interest across 75 markets, and CoinGecko independently shows the same, so closing 62 SOL or 69 HYPE is not a liquidity problem. Getting the money off the venue is the problem. Withdrawals are processed by the matching engine out of a hot account, and nothing in the docs describes a permissionless on-chain path that lets a user exit without the engine. Caps are disclosed and layered: $250k of account equity on deposit during Closed Beta, $250k per account per 24 hours on withdrawal for USDC and again per asset for spot, $50k daily per-user notional on spot deposits, plus an exchange-wide withdrawal cap whose value is not published. None of those bind at our size. The structural point does. On-chain, $1.36M of USDC sits in the engine-facing hot account and $24.0M sits in the cold vault, so a real exit wave needs approval to replenish, and a dead or hostile engine means no documented way out. The Fund Security page offers "$5 million USDC" as an illustrative hot-wallet daily limit, but it is framed as an example rather than a committed parameter.
Yield: real vs emission. Nothing here is a native protocol yield. The return is funding captured on the two delta-neutral shorts, which is real, plus money-market interest, plus points. Funding is charged hourly and the current prints are mixed: HYPE runs positive at 0.00000856 per hour, so longs pay our short, roughly 7.5% annualised, while SOL is negative at 0.00000378 per hour, so our short pays, roughly 3.3% annualised, with the next SOL print flipping positive. The money-market leg is smaller than it sounds. Auto-lending is on by default and our showcase account is lending, but pool utilisation is 0.109% and the lend rate is 0.00001106 APR, so the interest is rounding error and the practical lock-up is negligible today. That can change if utilisation rises, because lending is unsecured-in-practice credit exposure to leveraged traders. The points programme has run weekly since 4 September 2025 with 10,000,000 points a week and a formula the docs describe as "dynamic and opaque by design," and there is still no token. Read current TVL with that in mind: it is 45% below the January 2026 peak and about 17% lower than 90 days ago, which is what farming capital drifting away looks like while a TGE stays undated.
Holder concentration. Not applicable today, because there is no confirmed Pacifica token. CoinGecko's exchange page lists no native token, and an X scan through 2 and 3 August 2026 finds community posts still describing Pacifica as a perp DEX with no token and no TGE announcement. Third-party price-prediction and price-tracker pages already publish a "PACIFICA" ticker, so treat anything traded under that name as unverified until Pacifica says otherwise. Re-check at TGE, when the points-to-token conversion and insider allocation become the question.
Track record. Mainnet since June 2025, so about fourteen months, and its own documentation still calls the current phase Closed Beta in August 2026. Founders are named in third-party coverage as Constance Wang, formerly COO of FTX, with co-founders Jose from NFTperp and Tony from AsyncBlock. Named beats anonymous, and readers can weigh the FTX line themselves. Founding year is muddled across sources, with CoinGecko listing 2024 and press coverage saying January 2025, and we found no primary-source confirmation either way. We found no platform-level exploit, insolvency, socialised-loss event or extended outage in DefiLlama's 2026 hack coverage, general news scans, or an X scan going back to June 2025. One disclosure sits in the margin: on 21 January 2026 Pacifica said that Mithril, an external trading-bot builder, had a database breach exposing and decrypting user API keys, and that per Mithril this had not affected Pacifica users. Pacifica advised revoking API keys. Access is blocked for US persons and for Cuba, Crimea, Iran, Afghanistan, Syria and North Korea. Watch for name collisions when scanning: Pacifica is also a city in California and a life-insurance company, so most "Pacifica breach" and "Pacifica outage" hits are about neither.
Worst case
The clean version is a compromise or misuse of the program upgrade authority. Whoever controls BzZgjpBFHb19vWjBRoM5eVy6qnUjbGH5tMJrnN7cA47a can redeploy the program that handles deposits and withdrawals. We confirmed that reaches the hot USDC, because the hot bridge's controlling account is a PDA of that same program. Whether it reaches the $24.0M cold vault depends on which program derives 5kwCMKjE3Krvs7cHfcQ9kBkGyPQphd3oJ4KnsXcpMoVc, and that cannot be read off the chain: an uninitialised off-curve PDA is system-owned and dataless whether Squads derives it or Pacifica's own program does. If it is a Squads vault under a separate quorum, the blast radius is the hot account and the damage is capped near $1.4M. If it is a PDA of Pacifica's own program, an upgrade reaches it and the hot-cold story collapses into one key. We could not determine which, and the difference is roughly seventeen times the loss.
The likelier version does not need an attacker. The engine goes down or gets slow during the exact hour SOL or HYPE moves. Both showcase shorts are on this one venue and both hedges are somewhere else, jitoSOL on Solana and PT-kHYPE on Pendle. If Pacifica stops matching, you cannot close, cannot add margin and cannot withdraw, while the other side of the hedge keeps repricing. You watch.
The version specific to being short is auto-deleveraging. Pacifica's third liquidation tier closes profitable opposing positions by risk priority when a counterparty's equity goes below zero and the backstop cannot absorb it. In a sharp down move, the winning side is our two shorts. ADL would close them at exactly the moment they are doing their job, leaving the jitoSOL and PT-kHYPE legs naked into the crash. No insurance fund is described anywhere in the documentation, and who capitalises the backstop liquidator is not stated, so the documented loss waterfall ends at ADL against profitable traders. Note also that the backstop liquidator refuses positions in eighteen listed markets, all equities, metals, energy and FX, so on those the path from tier one to ADL is shorter. Neither of our markets is on that list.
On sizing, the picture is better than a first read suggests, and worth stating precisely because it cuts against the instinct to panic. Pacifica holds $4,190.93 of account equity, about 34% of roughly $12.3k of portfolio value, and carries $8,156 of short notional, almost exactly half the gross notional across all four legs. It is not the majority of the money. What it is, is 100% of the hedging side: both shorts sit on one venue, so a single Pacifica failure un-hedges both pairs at once while the two long legs keep moving. Liquidation prices are far away, at 111.06 on HYPE against a 53.07 mark and 136.69 on SOL against a 72.49 mark, so a forced close is not the near-term worry. Correlated hedge failure is.
Bottom line
Avoid, and treat that as a statement about verifiability rather than a prediction of imminent loss. The venue works, the book is liquid, the fourteen-month record is clean, the hot-cold split is visibly real on-chain, and the deposit program has not been touched since launch. But the gate is worst-flaw-wins on the surface that can lose the money, and there are three flaws on it: custody is deposit-to-venue with no documented unilateral exit, the audit cannot be read and the named firm acknowledges Pacifica nowhere, and the multisig claim over the upgrade authority does not reproduce when you run the check the docs invite you to run. That is a step down in verifiability from Ethereal, which we rated caution, and which at least published an audit that spelled out its own centralisation. The corrected position sizing does not rescue the verdict, because the verdict rests on what cannot be checked rather than on how much is exposed.
Three things would move this to caution quickly, and none of them require Pacifica to change its architecture. Publish a working audit report with a firm-hosted copy. Publish the Squads multisig address, threshold, timelock and the derivation of the cold-vault PDAs so the claims can be checked. Move the program upgrade authority to a Squads vault so it reads off-curve like the vaults do. Until then, treat a Pacifica freeze as the scenario that breaks both hedges simultaneously, and consider splitting the two shorts across a second venue rather than holding both here. Auto-lend is on and can be turned off with auto_lend_disabled if we would rather not lend at all, though at current utilisation it is not costing or risking anything material.
Data appendix
- TVL: $25.65M (DefiLlama,
api.llama.fi/tvl/pacifica= 25,649,455.75). Composition verified on-chain and it reconciles to within about $450 at a SOL price of $72.49: 24,000,000 USDC inFvGqozihHY4Mmh4Nmx2rkXnMDcumiXEbjxA9oRu3mUeJ(the cold-vault ATA), 1,357,510.70 USDC in the hot bridge72R843XwZxqWhsJceARQQTTbYtWy6Zw9et2YV4FpRHTa, and 4,033.55 SOL at9sSr35zwnFTuv2kZ86i55sR9dqQLTG663homexrLYgYu. DefiLlama's adapter counts exactly those three accounts, so headline TVL is bridge balances, not total user equity. History: first tracked 2025-09-08 at $6.71M, ATH $46.77M on 2026-01-18, $30.49M on 2026-05-07, $25.65M now, which is 45.2% off the ATH and 16.8% below 90 days ago. - Market size: ~$471.0M 24h volume and ~$103.3M open interest across 75 markets, computed from Pacifica's own
/info/prices; CoinGecko independently shows $470.25M, $103.27M and 75 pairs, entity listed as British Virgin Islands. Note the docs' Overview page still says "over thirty-five perpetual markets," which is stale against the API. Cumulative-volume figures circulating in third-party write-ups (for example "$116B since launch") are unverified. - Custody / settlement: Deposit-to-venue. USDC or SOL goes to an exchange-controlled bridge account, an off-chain central limit order book matches, settlement is on Solana. Perp and spot, 3x to 50x on perps, cross margin unified with spot collateral. Still Closed Beta per the docs.
- Hot / cold split: Verified. For USDC, 94.65% sits cold (
5kwCMKjE3Krvs7cHfcQ9kBkGyPQphd3oJ4KnsXcpMoVc, off-curve) and 5.35% hot. For SOL the published cold vault8nFeyzTFhUXp11raJkSSvZWn9GXDjcrGq8LuzP9aKtg8holds 0.001 SOL with no signatures in the node's retained window, while all 4,033.55 SOL sits in the hot bridge. All four published addresses match Pacifica's Fund Security page verbatim. Which program derives the cold PDAs (Squads or Pacifica's own program): refresh, and not resolvable from account state alone. - Audits: BlockSec, per Pacifica's docs Audits page. The linked PDF (
/images/tjfRMLcTkAHqN7rfxcos.pdf) returns HTTP 404, BlockSec's public audit-report index does not list Pacifica, and BlockSec's Solana audit page does not name Pacifica among its clients. Date, scope, severity counts, remediation: refresh. A Bug Bounty Program page exists in the docs. - Admin / governance: Program
PCFA5iYgmqK6MqPhWNKg7Yv7auX7VZ4Cx7T1eJyrAMH, BPF upgradeable loader, program dataFC5zcmPmqo5188fLVga2HN5QZ1T1ojhNneVkFdu6eF1E, upgrade authority present and set toBzZgjpBFHb19vWjBRoM5eVy6qnUjbGH5tMJrnN7cA47a. That authority is on-curve (verified against on-curve and off-curve controls), so it is not a Squads vault PDA. The hot USDC bridge's token authority9Gdmhq4Gv1LnNMp7aiS1HSVd7pNnXNMsbuXALCQRmGjYis a PDA owned by the Pacifica program, so the upgrade key reaches the hot balance. Last deploy slot 343778047, roughly 14 months ago by slot arithmetic, so no upgrade since about launch; the exact date is refresh because the block predates public-node history. Docs claim multisig governance, a Squads partnership, programmatic spending limits and time-locked changes; the team claimed 4/6 "from day one" on X on 2026-04-03 while the same docs page says it "is transitioning to" the architecture. Multisig address, threshold, signer identities, timelock duration, spending-limit value: refresh. - Oracle: Pacifica-computed, 3-second updates, weighted CEX average (Binance 2, OKX 1, Bybit 1, Hyperliquid 1). Mark price is the median of that oracle, the median of Pacifica's own bid/ask/last, and outside perp prices. No third-party oracle, no on-chain attestation.
- Liquidations: Three tiers. Market liquidation in chunks with a fee of
max(0.75%, maintenance_margin_ratio * 0.4), then backstop liquidation to a Pacifica account below two-thirds of maintenance margin, then auto-deleveraging of profitable opposing positions if equity goes below zero. Maintenance margin is half the initial requirement. The backstop refuses eighteen markets (URNM, GOLD, SILVER, PAXG, CL, COPPER, NATGAS, EURUSD, USDJPY, NVDA, TSLA, PLTR, SP500, GOOGL, CRCL, HOOD, MEGA, BP). A separate spot-insolvency deleveraging path triggers at 95% money-market utilisation and targets 90%. Insurance fund: not described in the docs, existence and size refresh. - Money market: Single shared USDC pool, auto-lend on by default above a 1,000 USDC threshold net of a 10% initial-margin floor, opt out with
auto_lend_disabled. Borrow APR 1% floor, 10.95% kink at 80% utilisation, 50% at full. Borrowers blocked from new non-reduce-only orders above 90% utilisation. Spot collateral is stated as never rehypothecated. Live pool: total_borrowed $10,419 against $9.55M borrowable, utilisation 0.109%, borrow APR 1.01%, lend APR 0.0000111. - Withdrawals: Engine-processed from the hot account. $250k per account per 24h for USDC and per asset for spot, $1 fee, $1 minimum, plus an exchange-wide cap whose value is not published (the docs give "$5 million USDC" only as an illustrative hot-wallet daily limit). No permissionless escape hatch documented: refresh.
- Owned position (this run): account equity $4,190.93, balance $4,124.41, available to withdraw $3,374.94, margin used $408.00. Short 69 HYPE at entry 53.4326 against a 53.072 mark, liquidation 111.06; short 62 SOL at entry 73.22 against a 72.49 mark, liquidation 136.69. Short notional $8,156. Off-venue hedges: 47.93 jitoSOL at $93.71 ($4,491) and 69.275 PT-kHYPE-24SEP2026 at $52.80 ($3,658). Pacifica is 34% of portfolio value and 50% of gross notional, and 100% of the short side.
auto_lend_disabledis null, so the default applies and the account is lending; $0.000271 of interest earned to date. - Funding (this run, hourly): HYPE +0.00000856 with next +0.00000985, so longs pay our short, about +7.5% annualised. SOL -0.00000378 with next +0.00000345, so our short currently pays, about -3.3% annualised, flipping positive on the next print.
- Holder concentration: No confirmed native token. Points since 2025-09-04, 10,000,000 per week, formula undisclosed. TGE undated as of 2026-08-03. refresh at launch.
- Recent news / incidents: No platform-level exploit, insolvency, socialised loss or outage found in DefiLlama 2026 hack coverage, news scans, or an X scan from 2025-06-01. Pacifica disclosed on 2026-01-21 that third-party builder Mithril suffered a database breach exposing user API keys, stating per Mithril that Pacifica users were unaffected, and advised revoking keys. An X scan found no user reports of unauthorised withdrawals or frozen withdrawals. Name-collision warning: "Pacifica" also returns a California city and Pacific Life, an insurer with its own 2026 data breach, and third-party sites publish a PACIFICA token price with no confirmed TGE behind it. Maintained monthly. Methodology: DeFi Research Instruction v2.