# Is Hyperliquid safe to connect? | TradingAgentStack

> Hyperliquid: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-24.

Canonical: https://tradingagentstack.com/check/hyperliquid/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Hyperliquid

# Is Hyperliquid safe to connect?

Exchange · Hyperliquid L1 (HyperCore/HyperEVM), USDC via Arbitrum bridge. Checked 2026-10-24; every line links its source.

**Worst case:** You keep your keys, but your deposit sits in a validator-controlled bridge that can be paused, profitable positions can be force-closed by auto-deleveraging, and HLP vault deposits absorb manipulation losses; a leaked main-wallet key (not an API wallet) can withdraw everything.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Give bots a dedicated API (agent) wallet with a valid_until expiry, never your main wallet's private key

2. Generate a fresh agent wallet instead of re-approving an old address after deregistering it

3. Only use the app at app.hyperliquid.xyz and keep only trading margin on Hyperliquid, not long-term savings

Hyperliquid also has a full listing with an Agent Risk Score [Agent risk 64% (partial, 5 of 7 inputs)](https://tradingagentstack.com/methodology/#agent-risk-score): [Hyperliquid on TradingAgentStack](https://tradingagentstack.com/tool/hyperliquid/).

## What it can do with your money

| Who holds the keys | You hold the keys You sign with your own wallet; deposited USDC sits in the Hyperliquid bridge contract, which permissioned validators control (2/3 of a 4-validator hot set signs withdrawals). [source](https://www.l2beat.com/bridges/projects/hyperliquid) |
| --- | --- |
| Can funds be sent out to any address? | Yes. Withdrawals go through the bridge after a ~200s challenge period; validators/lockers can pause it (it was paused about an hour in Nov 2025). [source](https://www.l2beat.com/bridges/projects/hyperliquid) |
| Can it hold or freeze your funds? | No KYC account freezes as on a CEX, but L2BEAT notes funds can be frozen if the validator set stops processing withdrawals or if permissioned 'lockers' (threshold 2) pause the bridge, and funds could be stolen if a majority of the hot validators signed an invalid withdrawal. Validators have also delisted a market and force-settled positions (JELLYJELLY, Mar 2025). [source](https://www.l2beat.com/bridges/projects/hyperliquid) |
| What a leaked API key can do | No exchange-style API keys: you approve an 'API wallet' (agent wallet) with approveAgent. An account can have 1 unnamed and up to 3 named API wallets (plus 2 named per subaccount); an expiry can be set with valid_until, at most 180 days ahead. API wallets only sign trading (L1) actions, not transfers or withdrawals, which need the main wallet's signature (per Chainstack's integration guide). Hyperliquid warns not to reuse an agent address after it is deregistered, because pruned nonces can let old signed actions be replayed. [source](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/exchange-endpoint) |
| Monero and Zcash | **ZEC**: perpetual futures only (USDC-margined synthetic exposure; ZEC is one of the most actively traded perps); native ZEC deposit/withdraw not documented [source](https://docs.bitquery.io/docs/perpetuals/hyperliquid/track-zec-on-hyperliquid/) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `hyperliquid.xyz`

- X: `@HyperliquidX`

Where we confirmed these
- https://www.coingecko.com/en/exchanges/hyperliquid (website app.hyperliquid.xyz, twitter.com/HyperliquidX)

- https://onekey.so/blog/ecosystem/fake-hyperliquid-site-detection/ (official app URL app.hyperliquid.xyz, updated 2026-05-12)

- https://cryptobriefing.com/hyperliquidx-open-interest-surpasses-13b-for-first-time-since-october-10/ (news referring to the HyperliquidX account)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2026-04-09 | FARTCOIN pump and self-liquidation dumped a losing position onto HLP | ~$1.5M (HLP) | Loss borne by HLP depositors | [source](https://forklog.com/en/unknown-attackers-exploit-hyperliquid-storage-via-fartcoin-pump/amp) |
| 2025-11-13 | POPCAT price manipulation left ~$4.9M bad debt in the HLP vault; bridge withdrawals paused via 'vote emergency lock' | ~$4.9M (HLP) | Withdrawals resumed after about an hour; loss borne by HLP | [source](https://cointelegraph.com/news/hyperliquid-hlp-popcat-attack-3m-wipeout) |
| 2025-10-10 | First-ever cross-margin auto-deleveraging (ADL) during the 10 Oct crash: profitable positions were force-closed at mark price |  | Affected traders' positions closed early; no compensation reported | [source](https://wublock.substack.com/p/hyperliquid-activates-cross-margin) |
| 2025-03-26 | JELLYJELLY short-squeeze manipulation threatened the HLP vault; validators delisted the market and settled positions | ~$10M HLP loss reportedly avoided | Hyperliquid said it would compensate affected JELLYJELLY traders | [source](https://thedefiant.io/news/defi/hyperliquid-to-compensate-jellyjelly-traders-and-strengthen-risk-protocols) |

## Check a link

Got a link, @handle or repo that claims to be Hyperliquid? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Hyperliquid

We email you if we add an incident, a freeze report, a known fake or a deadline for Hyperliquid. Free; unsubscribe anytime.

## More checks: Exchanges
[Binance](https://tradingagentstack.com/check/binance/)[Bybit](https://tradingagentstack.com/check/bybit/)[OKX](https://tradingagentstack.com/check/okx/)[Kraken](https://tradingagentstack.com/check/kraken/)[Coinbase Advanced](https://tradingagentstack.com/check/coinbase-advanced/)[Bitget](https://tradingagentstack.com/check/bitget/)[Gemini](https://tradingagentstack.com/check/gemini/)[KuCoin](https://tradingagentstack.com/check/kucoin/)[MEXC](https://tradingagentstack.com/check/mexc/)[Gate](https://tradingagentstack.com/check/gate/)[HTX](https://tradingagentstack.com/check/htx/)[Crypto.com Exchange](https://tradingagentstack.com/check/crypto-com-exchange/)[BingX](https://tradingagentstack.com/check/bingx/)[Bitfinex](https://tradingagentstack.com/check/bitfinex/)[Bitvavo](https://tradingagentstack.com/check/bitvavo/)[Bitstamp](https://tradingagentstack.com/check/bitstamp/)[WhiteBIT](https://tradingagentstack.com/check/whitebit/)[Pionex](https://tradingagentstack.com/check/pionex/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)