# Is Lighter safe? Check before you connect

> Lighter: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-29.

Canonical: https://tradingagentstack.com/check/lighter/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Lighter

# Is Lighter safe to connect?

Exchange · Lighter zk-rollup settling to Ethereum (zkLighter), Perpetual futures and spot markets. Checked 2026-10-29; every line links its source.

**Worst case:** Your funds sit in Ethereum contracts with a proven state, but one operator runs the exchange: an outage like the 4.5-hour one during the Oct 2025 crash can stop you managing positions, a forced exit only opens after 14 days, ADL can close profitable positions early, and L2BEAT says the team can upgrade the contracts instantly. A leaked API key can trade your account into losses (it can only withdraw to your own address), while a leaked L1 wallet key can move everything.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Run each bot on its own sub-account with its own API key index (4-254), and keep the L1 wallet's private key off the bot server: without it a key cannot send funds to other addresses

2. Give dashboards, tax tools and AI agents a read-only token instead of an API key, and use separate keys per workload (maker-only keys for market-making bots if your account tier allows)

3. Only use app.lighter.xyz and x.com/Lighter_xyz (fakes like lihgter-dex.xyz and fake LIT-airdrop accounts exist) and keep only trading margin on Lighter

## What it can do with your money

| Who holds the keys | You hold the keys You sign with your own Ethereum wallet. Deposits sit in Lighter's Ethereum smart contracts, which 'hold the assets and the canonical state root'; the order book and matching run off-chain on Lighter's single operator/sequencer, and each batch is proven with zero-knowledge proofs on Ethereum. [source](https://l2beat.com/publications/exchange-risk-and-how-lighter-escapes-it) |
| --- | --- |
| Can funds be sent out to any address? | Yes. Normal 'secure' withdrawals go back to the Ethereum address that created the account. If the sequencer ignores you, you can post a priority (forced) transaction on Ethereum; if it is not processed within 14 days, anyone can trigger the escape hatch ('desert mode'), which freezes the L1 contract and lets users withdraw by submitting a zero-knowledge proof of their balance. The desert-exit circuit was audited by zkSecurity (report dated 2025-11-05, https://reports.zksecurity.xyz/reports/zklighter-desertexit), but L2BEAT notes its source code is not public. [source](https://l2beat.com/publications/exchange-risk-and-how-lighter-escapes-it) |
| Can it hold or freeze your funds? | No KYC-style account freeze is described, but Lighter's terms let it 'suspend or terminate your access to the Interface' without notice (https://tostracker.app/document/elliotai-tos). The escape hatch only kicks in after a 14-day forced-transaction deadline, so funds can be stuck for up to two weeks if the operator stops or censors. L2BEAT rates Lighter Stage 0 (May 2026): the team controls the contract upgrade path, and L2BEAT's project page says contracts are instantly upgradable, so a malicious upgrade could steal funds before users exit (https://pr11267-production.previews.l2beat.com/scaling/projects/lighter, preview build). [source](https://l2beat.com/publications/exchange-risk-and-how-lighter-escapes-it) |
| What a leaked API key can do | Each API key is its own key pair with its own nonce, bound to one account index (master account, sub-account or pool). Indexes 0-3 are reserved for Lighter's web and mobile apps, so bots use 4-254. Registering a key needs an L1 wallet signature (ChangePubKey). An API key can trade, cancel, modify orders, change leverage/margin, manage sub-accounts, make 'secure' withdrawals (only to the account's own L1 address) and same-owner transfers. It cannot, without the L1 wallet signature, transfer to a different owner, make fast withdrawals or approve an integrator with fees. Auth tokens made from the key last at most 8 hours; the docs give no expiry for the API keys themselves. Read-only tokens (1 day to 10 years) can read data but not trade or withdraw, and Lighter recommends them for dashboards and AI agents. Premium/Advanced accounts can mark keys maker-only (post-only orders, modify and cancel only). [source](https://apidocs.lighter.xyz/docs/api-keys) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `lighter.xyz`

- X: `@Lighter_xyz`

Where we confirmed these
- https://hummingbot.org/exchanges/lighter/ (Exchange Info: 'Website: https://lighter.xyz'; login app.lighter.xyz; fee docs at docs.lighter.xyz)

- https://apidocs.lighter.xyz/docs/api-keys (Lighter's own API docs on a lighter.xyz subdomain; links app.lighter.xyz/read-only-tokens, app.lighter.xyz/ethereum-gateway and the SDKs github.com/elliottech/lighter-python and github.com/elliottech/lighter-go)

- https://alearesearch.substack.com/p/lighterxyz (Alea Research: X @Lighter_xyz, website lighter.xyz, docs docs.lighter.xyz, app app.lighter.xyz)

- https://www.theblock.co/post/384399/lighter-lit-buyback (The Block, 2026-01-05: links Lighter's 'official X account' post at x.com/Lighter_xyz)

- https://www.pcrisk.com/removal-guides/34670-fake-lighter-trading-platform-scam (PCrisk, 2026-01-02: names app.lighter.xyz as the real Lighter site)

### Known fakes

- `lihgter-dex.xyz` · 2026-01-02 [source](https://www.pcrisk.com/removal-guides/34670-fake-lighter-trading-platform-scam)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2026-02-25 | ARC perpetual long squeeze: a whale's ~$50M open-interest long was liquidated and auto-deleveraging (ADL) partially closed profitable shorts | ~$8.2M whale loss; ~$75K LLP loss | LLP loss capped by the per-market risk bucket; Lighter set a $40M open-interest cap on ARC and said similar caps may apply to other assets | [source](https://cointelegraph.com/news/whale-loses-8-2m-arc-squeeze-lighter-perps-liquidation) |
| 2025-12-30 | GoPlus warned of phishing disguised as LIT airdrop claims and eligibility checks, pushed by numerous fake X accounts impersonating Lighter (no specific handles or domains named) (third-party report) |  | losses not reported | [source](https://www.mexc.com/news/372997) |
| 2025-10-10 | About 4.5-hour outage during the market-wide crash: a database upgrade problem left the single sequencer unable to process trades, so users could not manage positions and the LLP lost about 5.35% | 2,008 users lost over $1K, 367 over $10K and 38 over $100K (Lighter post-mortem) | Lighter said it would fully compensate the 2,000+ affected users in stablecoins and points | [source](https://ambcrypto.com/lighter-dex-to-repay-users-in-stablecoins-after-major-outage-details/) |

## Check a link

Got a link, @handle or repo that claims to be Lighter? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Lighter

We email you if we add an incident, a freeze report, a known fake or a deadline for Lighter. Free; unsubscribe anytime.

## More checks: Exchanges
[Binance](https://tradingagentstack.com/check/binance/)[Bybit](https://tradingagentstack.com/check/bybit/)[OKX](https://tradingagentstack.com/check/okx/)[Kraken](https://tradingagentstack.com/check/kraken/)[Coinbase Advanced](https://tradingagentstack.com/check/coinbase-advanced/)[Hyperliquid](https://tradingagentstack.com/check/hyperliquid/)[Bitget](https://tradingagentstack.com/check/bitget/)[Gemini](https://tradingagentstack.com/check/gemini/)[KuCoin](https://tradingagentstack.com/check/kucoin/)[MEXC](https://tradingagentstack.com/check/mexc/)[Gate](https://tradingagentstack.com/check/gate/)[HTX](https://tradingagentstack.com/check/htx/)[Crypto.com Exchange](https://tradingagentstack.com/check/crypto-com-exchange/)[BingX](https://tradingagentstack.com/check/bingx/)[Bitfinex](https://tradingagentstack.com/check/bitfinex/)[Bitvavo](https://tradingagentstack.com/check/bitvavo/)[Bitstamp](https://tradingagentstack.com/check/bitstamp/)[WhiteBIT](https://tradingagentstack.com/check/whitebit/)[Pionex](https://tradingagentstack.com/check/pionex/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)