Is Hyperliquid Safe? Custody, Bridge, Validators, HLP Incidents and a Safety Checklist

Is Hyperliquid safe? It depends on which risk you mean, and the honest answer is that Hyperliquid removes some risks and adds others. It is non-custodial: nobody at Hyperliquid holds your funds, and "only someone with access to your private key or seed phrase can sign transactions on your address' behalf" (I got scammed/hacked). That removes the risk of an exchange freezing or losing your money, and puts the whole burden of key security on you. The platform risks that remain are documented: USDC enters through a bridge and Circle's CCTP, other assets through an independent third party (Unit), prices depend on validator-published oracles, failed liquidations land on the community vault HLP and then on auto-deleveraging of profitable traders, and validators have voted to intervene in a market at least once (the JELLY delisting in March 2025). Then there is the biggest risk for most users, which has nothing to do with Hyperliquid's code: leverage. This guide goes through each, from the official docs read on 11 November 2026 and reporting on past incidents, and ends with a practical checklist. It does not tell you whether to use Hyperliquid; it tells you what you would be trusting if you do.

Is Hyperliquid safe? Four kinds of "safe"

People asking "is Hyperliquid safe" usually mean one of four things:

Custody: your keys, your account, your problem

Hyperliquid accounts are EVM addresses. You sign actions with your wallet; there is no password-reset desk. The docs' scam page is explicit about what follows: if you see activity you did not initiate, "it's highly likely that your key was compromised, meaning someone else has control of your address", and the advice is to treat the address as "burned" and move everything to a new wallet, including assets on HyperEVM.

What that means in practice:

• No one can freeze your account the way an exchange can. Your funds are in protocol state controlled by your signature.
• No one can recover a stolen key. There is no chargeback.
• Email logins are still wallets. If you log in with email, a wallet is created for you; its key can be exported from the settings menu (Export your email wallet). Store that key as carefully as a seed phrase.
• Third-party bots may hold your key. Many Telegram trading bots create and control a wallet for you. The docs note "most of the Telegram bots are configured to automatically deposit any balance" (My withdrawal keeps getting re-deposited). If a bot holds the key, the bot's security is your security.

Getting money in and out: the bridge and Unit

USDC

"USDC is natively minted on the Hyperliquid L1," with Circle's contracts on HyperEVM, and Circle documents CCTP transfers from Arbitrum to HyperCore (USDC). The original route was a bridge contract on Arbitrum; the docs say "the legacy Arbitrum bridge holds less than 10% of the USDC supply on HyperCore" and that it "and its logic in relation to the L1 staking have been audited by Zellic". The Audits page links the Zellic reports and Circle's independently audited contracts.

Withdrawals are signed by validators: "the L1 validators will sign and send the withdrawal request to the bridge contract" (Exchange endpoint). So the bridge's safety depends on the validator set's honesty, the bridge contract's correctness and, for native USDC, Circle.

You also depend on USDC itself. If USDC lost its peg, every USDC-margined account would feel it.

Other assets (BTC, ETH, SOL and more)

Non-USDC deposits and withdrawals go through Unit, which the docs describe as "an independent team" (Withdrawal has not arrived). Unit has its own support and its own revert tool for some mistakes. Holding BTC on Hyperliquid means trusting Unit's system to honour withdrawals back to Bitcoin.

Deposit mistakes are a real loss path

Several deposit errors are unrecoverable by design: USDC below 5 from a wallet, any Unit asset below its minimum, BTC sent on the wrong network. Our deposit guide lists every documented minimum and what can and cannot be reversed.

Consensus and validators

How the chain is secured

Hyperliquid uses HyperBFT, "a variant of HotStuff consensus. Like most proof-of-stake chains, blocks are produced by validators in proportion to the native token staked to each validator" (Overview). Safety needs a quorum: "any set of validators that has more than ⅔ of the total stake… The operating requirement of consensus is that a quorum of stake is honest" (Staking).

Mechanisms in the docs:

• Validators need 10k HYPE self-delegated, locked for a year.
• Peers can vote to jail an unresponsive validator; a jailed validator earns nothing.
• "There is currently no automatic slashing implemented" for native staking.
• Validators publish oracle prices, sign bridge withdrawals and vote on delistings and HIP-3 slashing.

Concentration

How safe a proof-of-stake chain is depends on who holds the stake. After the JELLY incident in March 2025, The Defiant reported that about 78% of staked HYPE was with Hyper Foundation validators (The Defiant), and Blockworks reported that more than half the stake belonged to five Foundation validators (Blockworks). Those are snapshots from that time. The current distribution is visible on staking explorers; check it if this matters to you. Delegating to smaller, reliable validators is one way holders can spread it; see how to stake HYPE.

Validators can intervene

Hyperliquid's docs give validators formal powers that matter to users:

• Delistings by on-chain vote (Delisting).
• Disabling HIP-3 growth mode on ineligible markets, "similar to delistings… by onchain validator vote" (Fees).
• Slashing HIP-3 deployers by stake-weighted vote.
• Removing quote-asset status from a stablecoin, which disables DEXs using it.

Whether such powers make the system safer (someone can stop an attack) or less safe (someone can change outcomes) is the core of the "validator put" debate. Both views are reasonable; what matters is that you know the power exists.

Prices: oracle and mark price

Liquidations and funding depend on prices published by validators, not only on Hyperliquid's own book.

Oracle price. "The validators are responsible for publishing spot oracle prices for each perp asset every 3 seconds." Each validator computes "the weighted median of Binance, OKX, Bybit, Kraken, Kucoin, Gate IO, MEXC, and Hyperliquid spot mid prices for each asset, with weights 3, 2, 2, 1, 1, 1, 1, 1", and the final price is the stake-weighted median of validators' submissions (Oracle). Assets whose main spot market is on Hyperliquid itself, such as HYPE, do not use external sources "until sufficient liquidity is met".

Mark price. The median of three inputs: oracle plus a 150-second EMA of Hyperliquid's mid-oracle gap; the median of best bid, best ask and last trade on Hyperliquid; and a weighted median of perp prices on Binance, OKX, Bybit, Gate IO and MEXC. It "is used for margining, liquidations, triggering TP/SL, and computing unrealized pnl" (Robust price indices).

What this protects against: a single trade on a thin Hyperliquid book cannot by itself move the mark price for a liquid asset. What it does not fully protect against: a token whose price can be pushed on the external venues the oracle reads. That is what happened with JELLY.

On HIP-3 markets the deployer sets the oracle. See our HIP-3 explainer.

Liquidations and auto-deleveraging

How liquidation works

From Liquidations:

• You are liquidated when account equity falls below maintenance margin, which is half the initial margin at max leverage: between 1.25% (40x assets) and 16.7% (3x assets).
• First, market orders go to the book. "Any remaining collateral remains with the trader." Positions above $100k are liquidated 20% at a time.
• If equity falls below two thirds of maintenance margin without the book closing the position, backstop liquidation transfers it to HLP's liquidator vault, and "the maintenance margin is not returned to the user."
• A cross backstop liquidation takes all cross positions and cross margin; "if the trader has no isolated positions, the trader ends up with zero account equity."

That last point is the one people miss. In cross margin, one bad position can take the whole cross account. Isolated margin limits the damage to that position. Our liquidation calculator estimates an isolated position's liquidation price.

When the backstop is not enough

If an account goes negative, auto-deleveraging closes positions on the other side: "users on the opposite side of the position are ranked by unrealized pnl and leverage used… Those traders' positions are closed at the previous mark price against the now underwater user, ensuring that the platform has no bad debt." The docs add a guarantee: "a user who has no open positions will not socialize any losses of the platform" (Auto-deleveraging).

So if you are a profitable, highly leveraged trader on the other side of a collapse, your position can be closed for you. It is a solvency guarantee for the system, paid for by the most profitable positions.

HLP: the community backstop and its record

HLP "provides liquidity to Hyperliquid through multiple market making strategies, performs liquidations, supplies USDC in Earn, and accrues a portion of trading fees" (Protocol vaults). It is where failed liquidations go. Two 2025 incidents show the risk:

The ETH position (March 2025). A trader with a very large leveraged ETH long withdrew margin so the position was liquidated into HLP, which bore a loss reported at roughly $4 million (Halborn). Today's docs require that unrealised PnL can only be withdrawn if remaining margin is at least 10% of total open notional (Margining), and BTC and ETH have tiered max leverage (Margin tiers).

JELLY (late March 2025). A large JELLY short was liquidated into HLP while the token's price was pushed up on other venues. Validators voted to delist the JELLY perp and settled positions at $0.0095, and Hyperliquid said users other than flagged addresses would be made whole by the Hyper Foundation (Decrypt). Reported peak unrealised losses vary by outlet; the episode is also covered in detail by Talos.

For traders, these incidents mostly mattered indirectly. For HLP depositors, they were losses (or near-losses) of their own capital. Our vaults guide covers what depositing in HLP means; our vaults page shows HLP's account value and PnL from the API.

HIP-3, HyperEVM and other layers

Each extra layer brings its own risks:

• HIP-3 markets: a deployer sets the oracle, leverage and can halt and settle a market at the mark price. Slashing punishes a bad deployer but "the slashed stake by the deployer is burned instead of being distributed to affected users" (HIP-3).
• HyperEVM: "The HyperEVM is in the alpha stage" (HyperEVM). Apps on it are third-party contracts with their own bugs and approvals. See how to use HyperEVM.
• Portfolio margin: borrowing happens automatically; liquidation is of the whole portfolio, and "users should not expect a deterministic liquidation sequence" (Portfolio margin).
• Staking linking: a linked staking account can move all funds out of the trading account "in a single irreversible transaction" (Fees). Never link to an account you do not control.
• Builder fees: third-party front-ends can charge up to 0.1% on perps and 1% on spot after you approve.

Personal security: the most common way funds disappear

The docs' own list of what to do after a compromise, and best practices, is worth quoting nearly in full (I got scammed/hacked):

• "Never share your seed phrase and private key (Never input it into a website and never share it with a 'support' person)."
• "Consider using a hardware wallet… Hardware wallets can be paired with browser wallets like Rabby to keep your private key off the browser."
• "Never rush to perform actions. Always read and double-check any transaction you sign."
• "Never click on unknown links, and beware of sponsored links on your search engine… Bookmark frequently visited sites."
• "Never download unknown or unverified applications" and "Never download PDFs from unknown users or sources."
• "Assume most DMs are scams."
• "Keep your browsers and extensions up to date; delete any extensions that are no longer maintained."

The same page lists one Hyperliquid-specific sign of compromise: "an unknown multi-sig on your Hyperliquid account". An attacker who controls your key can convert the address to a multisig they control; if you see that, the address is lost to you.

Common scam patterns we see around Hyperliquid:

Our wallet directory lists hardware wallets that work with Hyperliquid, including Ledger.

Leverage: the risk you choose

Every number above matters less than this one: on an asset with 20x max leverage, maintenance margin is 2.5%, so a position opened at full 20x has only about 2.5 percentage points between its initial margin (5%) and liquidation. A move of roughly 2.5% against you, before fees and funding, can be enough. Hyperliquid offers up to 40x on BTC at the first margin tier (Margin tiers). The docs remind traders that "leverage is only checked upon opening a position. Afterwards, the user is responsible for monitoring the leverage usage to avoid liquidation" (Margining).

Funding adds a slow cost: it is paid every hour, capped at 0.5% per hour. A position held for days in a crowded direction can lose more to funding than to price. Check our funding table before holding.

Large accounts' positions on Hyperliquid are public; our whales page shows some. Crowded positions can unwind violently, and you can see when you are on the same side as a lot of leverage.

What has gone right

A fair assessment includes the other side. From the docs:

• Transparency. "Every order, cancel, trade, and liquidation happens transparently" on-chain, so incidents can be analysed by anyone, and deployer actions "can be independently analyzed by any interested parties".
• Liquidation design that favours the trader first. Liquidations go to the book first and leftover margin stays with you; there is no clearance fee.
• A strict ADL invariant protecting users with no open positions from socialised losses.
• Audits of the legacy bridge (Zellic) and Circle's contracts.
• A bug bounty paid in USDC for responsibly disclosed bugs that cause outages or logical errors on nodes or API servers (Bug bounty program).
• Users made whole after JELLY, per Hyperliquid's statement at the time.

Whether that balance is acceptable is your decision.

Hyperliquid vs a centralised exchange, on risk

Delistings: what happens to your position

Market-level intervention is not only an emergency tool. The docs describe a normal process: "Validators vote on whether to delist validator-operated perps. If validators vote to delist an asset, the perps will settle to the 1 hour time weighted spot oracle price before the scheduled delisting voting time… When an asset is delisted, all positions are settled and open orders are cancelled. Users who wish to avoid automatic settlement should close their positions beforehand" (Delisting).

So any position in a validator-operated perp carries a small risk of forced settlement, usually announced in advance. HIP-3 markets have their own version: a deployer can halt and settle at mark price.

Stops are not guarantees

A common source of "unsafe" experiences is a stop that filled far from where it was set. The docs explain why (My TP/SL did not execute correctly):

• TP and SL orders "are triggered by mark price, and then executed. Trade price and mark price are different."
• "By default, market TP/SL orders have a 10% slippage tolerance", so a fill can deviate a lot on large or illiquid positions.
• To control the price, use limit TP/SL orders, break large positions into smaller pieces, and check the book's depth first.

A limit stop protects the price at the cost of possibly not filling at all in a fast move. There is no setting that guarantees both.

Risk by type of user

If something goes wrong

You see transactions you did not make, or an unknown multisig. Follow the docs: stop using the address, create a new wallet, move remaining funds (HyperCore and HyperEVM) to it, revoke contract permissions, clear browser data, and find how you were compromised (I got scammed/hacked).

A deposit has not arrived. Refresh, then check the asset, chain and minimum against our deposit guide. For Unit assets marked "Failed" with the right asset, chain and amount, contact Unit.

A withdrawal has not arrived. Portfolio → Deposits & Withdrawals: if it says "Send", it stayed on Hyperliquid; if "Withdrawal", check status and the explorer link.

You were liquidated and do not know why. Trade history shows "Market Liquidation". Check the mark price at the time (not the last trade), your margin mode (a cross liquidation involves the whole cross account) and funding paid while the position was open.

A stop filled badly. See the TP/SL section above: market stops trigger on mark price and fill with up to 10% slippage by default.

You found a bug. The bug bounty covers mainnet bugs "that would cause an outage or logical error on nodes or API servers", reported to bugbounty@hyperfoundation.org with reproduction steps, tested only on testnet or local forks.

Checking things yourself

One advantage of a fully on-chain exchange is that you do not have to take anyone's word, including ours. Ways to verify the claims in this guide:

• Your own account. Portfolio shows deposits, withdrawals, sends and fills with explorer links. If a number looks wrong, the history explains it.
• Any address. Positions and balances on HyperCore are public. Our address lookup at /address/<your 0x address> shows an account's open positions read live from Hyperliquid's API; for HyperEVM balances use hyperevmscan.io or hyperscan.com.
• Markets. Our markets table shows open interest, funding and volume per perp, so you can see how crowded a market is before trading it.
• Validators and stake. Staking pages and explorers list each validator's stake, commission and jailed status.
• The assistance fund. Its system address is published in the docs (0xfefe…fefe); its HYPE balance and burns are visible on explorers.
• HLP. Our vaults page shows its account value, all-time PnL and the last month of account value from the API.
• The rules. The official docs are versioned on GitBook; when this guide quotes a rule, the link goes to the page it came from. Rules change, so re-read the page if you are acting on it.

A safety checklist

Before you deposit:

1. Bookmark app.hyperliquid.xyz and only use that.
2. Use a hardware wallet for meaningful amounts, or a fresh wallet used only for Hyperliquid.
3. Read the deposit minimums; send at least 5 USDC on Arbitrum from a wallet.
4. Decide how much you can lose completely.

While trading:

1. Prefer isolated margin until you understand cross; remember a cross backstop liquidation takes the whole cross account.
2. Use low leverage and a stop. Size so that a gap does not liquidate you.
3. Check funding before holding positions for long.
4. Check a HIP-3 market's deployer, oracle and fee before trading it.

For everything else:

1. Read every signature. Approve exact amounts on HyperEVM; revoke old approvals.
2. Never link a staking account you do not control.
3. Do not keep savings in a bot's wallet.
4. Withdraw what you do not need for trading. Know the route: USDC to Arbitrum, with a documented $1 fee at the time of writing.
5. If anything looks compromised, move everything (HyperCore and HyperEVM) to a new wallet at once.

FAQ

Is Hyperliquid legit?

Hyperliquid is an operating blockchain and exchange with public documentation, on-chain history, audits of its bridge contract and a bug bounty. "Legit" does not mean risk-free: it has had incidents, validators have intervened in a market, and trading on it can lose you money.

Has Hyperliquid been hacked?

The best-known incidents in March 2025 (a large ETH position liquidated into HLP, and the JELLY market) were market manipulation of the protocol's rules rather than a theft of the core contracts, according to the reports cited above. Individual users' wallets are compromised regularly through phishing, which the docs treat as the main cause of unauthorised transactions.

Can Hyperliquid freeze my funds?

There is no company holding your funds to freeze them. Validators can, by vote, delist markets and settle positions, which changes outcomes for open positions. Funds in your account remain controlled by your key.

Is HLP safe to deposit in?

HLP is a trading vault that can lose money; it took losses of millions of dollars in specific 2025 incidents. It has a 4-day lockup from your most recent deposit. Treat it as a risky strategy, not as savings.

What happens if Hyperliquid's bridge is exploited?

USDC that entered through the affected route could be at risk, and withdrawals could be disrupted. The docs say the legacy Arbitrum bridge now holds less than 10% of HyperCore USDC, with most USDC natively minted through Circle's CCTP, which carries its own dependence on Circle.

Is my money safer on Hyperliquid or on an exchange?

They fail differently. Hyperliquid removes custodian risk and puts key security, bridge, oracle and validator risks in its place. An exchange holds your funds, provides support and account controls, and can freeze or lose them.

Our recommendation

For crypto security news, incidents and market risk:

• CCrypto_Crime_News@Crypto_Crime_NewsOPEN
  @Crypto_Crime_News: hacks, scams and crypto crime coverage
• Ccryptoresearch@cryptoresearchOPEN
  @cryptoresearch: protocol research
• BBitcoinInsightsDaily@BitcoinInsightsDailyOPEN
  @BitcoinInsightsDaily: daily market insights