2026-09-23 · Derivatives & exchanges

Hyperliquid as a venue: ADL, foundation stake and the HLP vault

Data as of 23.09.2026 unless another date is given next to a figure.

Verdict: usable, with limits. Suitable for trading perps on majors; not suitable as a place to hold idle balances. The matching engine absorbed the largest liquidation cascade in crypto history without bad debt, but it did so by force-closing profitable positions. And the emergency rules are set by a small validator set in which the exchange's own foundation holds about half the stake.

What it is

Hyperliquid is a perp and spot exchange running on its own L1. The order book, margin, liquidations and funding are computed by the chain's validators rather than a company server. The HLP vault — open to deposits from anyone — acts as market maker and liquidator of last resort. Dollars on the exchange are USDC: today mostly minted natively by Circle, with a shrinking share still arriving via the legacy Arbitrum bridge.

Findings

1. The hedge leg can vanish exactly when it is needed

When an account goes underwater, the exchange closes positions on the winning side at the previous mark price. This is auto-deleveraging (ADL). The queue is ranked by profit times leverage: the bigger the profit and the higher the leverage, the earlier a position is closed. Source: Hyperliquid docs, "Auto-deleveraging".

On 10 October 2025 the mechanism fired for the first time in over two years: in 12 minutes the exchange closed $2.1bn of positions. The paper's author estimates that profitable traders lost $45–52m to the way ADL was executed; the denominator in the abstract is ambiguous, so we don't express it as a percentage. Sources: Tarun Chitra, "Autodeleveraging: Impossibilities and Optimization", arXiv 2512.01112, rev. 16.02.2026; insights4vc, "Inside the $19B Flash Crash".

For a hedge, the implication is simple: a short that protects a long turns profitable in a crash — and moves up the ADL queue. Any structure with a hedge leg here has to survive the scenario "hedge closed at the peak of the move, long left naked".

2. Emergency decisions sit with a small group, and the foundation holds half the stake

Our reading of these numbers: the foundation can't pass a decision alone, since it holds less than ⅔. But it holds more than ⅓, so it can block any decision on its own — and halt the chain with it. In practice this is an exchange with a single decisive participant, not a distributed network.

That power has been used. On 26 March 2025 validators voted in two minutes to delist the JELLY contract. Positions were closed at $0.0095 while the oracle showed around $0.50. HLP was sitting on a $13.5m unrealised loss at that point, and the foundation promised to make everyone whole except flagged addresses (CoinDesk, 26.03.2025; other estimates put the loss near $12m). Under the exchange's own rules, a delisting should settle at the average oracle price over the hour before the vote; with JELLY a different price was chosen (Hyperliquid docs, "Delisting").

3. HLP is short volatility — and was run over by manipulation three times in 13 months

Same picture every time: the vault earns on the right tail, and the left tail arrives via manipulation of a thin market. Economically, a vault like this is a synthetic short straddle plus an index. And with the Mango Markets conviction overturned in May 2025, losses from oracle manipulation are, in practice, final.

4. Unified account: spot USDC is the margin

There are three account modes. In unified mode — the one the exchange recommends for most users — there is a single USDC balance that is both the spot balance and collateral for all cross-margin positions. Portfolio margin also accepts HYPE and BTC as collateral, at a 50% haircut. In standard mode, spot and perps are accounted separately. Sources: Hyperliquid docs, "Account abstraction modes"; Dwellir API, userAbstraction.

How it works in practice: in unified mode the margin engine counts spot USDC as collateral for cross positions, so the liquidation price shown for a cross position already includes that spot balance.

The consequence: on a unified account, spot USDC that is withdrawn or spent immediately shrinks the liquidation buffer of every cross position. The account mode determines whether a spot balance is genuinely free or is already working as margin.

5. Bridge and dollars: the risk has moved from the bridge to Circle and the validators

The legacy Arbitrum bridge releases funds once validators with more than ⅔ of stake sign the withdrawal. Each withdrawal sits through a dispute period during which any designated "locker" can freeze the bridge. It is unfrozen by a quorum of validators' cold keys — the same keys that can invalidate pending withdrawals (Bridge2.sol, github.com/hyperliquid-dex/contracts; Zellic audit). In other words, the group that votes on delistings is the group that signs withdrawals.

Under 10% of the exchange's USDC now goes through that bridge; the rest is minted natively by Circle via CCTP (Hyperliquid docs, "USDC"; Hyperliquid announcement on X, December 2025; CCN). No bridge exploits or protocol-level loss of user funds have been recorded (HyperAcademy, August 2026, single secondary source).

6. Regulatory status: offshore, no investor protection

US citizens and residents are barred by the terms of service and geo-blocked by IP. There is no CFTC registration. On 19.08.2026 the US president said the CFTC was working on a legal path for Hyperliquid in the US (CoinDesk, 19.08.2026; Datawallet). No deposit insurance, no jurisdiction to complain to, and no venue to appeal a validator decision.

The case for

The revenue is real: roughly $614m a year, with around 99% of fees going to token buybacks — one of the cleanest cases of fees minus incentives coming out positive. Liquidations go to the book as market orders first and only reach the vault once equity drops below two-thirds of maintenance margin. Positions above $100k are liquidated in 20% clips with a 30-second pause (Hyperliquid docs, "Liquidations"). The oracle is a weighted median of eight venues, updated every 3 seconds; funding accrues hourly.

Who it suits and what to watch

• Suits: traders of validator-operated perps on BTC, ETH and SOL — hedges or liquid directional positions.
• Doesn't fit: markets deployed by third-party teams with their own oracle (gold on one such market dropped ~$100 in a minute on 04.07.2026), thin alts at high leverage, and the HLP vault as a home for idle cash.
• Custody: the venue is built for margin, not for storing balances; funds beyond what open positions need carry the venue's risks without earning anything for it.
• Hedges: any structure with a hedge leg here should be judged by whether it survives that leg being ADL'd at the peak of the move — the liquidation buffer alone does not answer that.

What would revoke the verdict:

• loss of user funds via the bridge or the chain, or withdrawals frozen for more than 24 hours;
• forced closure of BTC, ETH or SOL positions by validator vote, or a closure not done by the oracle rule;
• the foundation's stake rising above ⅔ — at which point it decides alone;
• regulatory action that blocks access or withdrawals in the user's jurisdiction.

What could go wrong

• An ADL cascade on majors, as on 10.10.2025. The hedge is closed at the previous mark and the long runs unhedged until it is reopened. The damage equals the price move between close and reopen, times size.
• An emergency validator decision, as with JELLY: positions closed at a price the validators chose rather than the oracle.
• A chain halt — which one foundation can trigger alone. While the chain is down the exchange doesn't see prices move, so by restart the liquidation buffer may already be gone.

Testable forecasts (made 23.09.2026)

1. By 31.03.2027 Hyperliquid will see at least one more manipulation episode after which HLP books bad debt or a loss of $1m or more. Base rate: three such episodes in 13 months, March 2025 – April 2026.
2. On 31.12.2026 Hyper Foundation will still hold more than ⅓ of stake, i.e. it will still be able to halt the chain on its own. Check: app.hyperliquid.xyz/staking.

What we don't know

• Who the bridge "lockers" currently are and how many. Low impact on the verdict: under 10% of USDC uses the bridge.
• Whether the delisting rules changed after JELLY for manipulation cases. The written rule says "by the oracle"; practice went another way. If that repeats on a major, the verdict flips.
• The 09.04.2026 incident is confirmed only by secondary sites. Even without it the forecast base has two episodes, and the conclusion holds.

What to watch

Through year-end 2026: the foundation's share of stake, whether the Arbitrum bridge is fully retired, and any new validator interventions. Any event on the "revoke" list triggers an immediate reassessment.

Sources: hyperliquid.gitbook.io (Auto-deleveraging, Liquidations, Delisting, Staking, USDC, Account abstraction modes) · github.com/hyperliquid-dex/contracts (Bridge2.sol) · arXiv 2512.01112 · insights4vc · CoinDesk 26.03.2025, 13.11.2025, 19.08.2026 · Crypto Briefing 08.09.2026 · crypto.news · CoinGecko · The Defiant · CCN · Datawallet · Dwellir · blog.can.ac · HyperAcademy · smartcontractshacking.com.

Research for information only. Not investment advice.