Is Hyperliquid safe?

The short version

“Safe” depends on which risk you mean. Hyperliquid removes one big risk that centralized exchanges carry, a company holding your money, and replaces it with others that you manage yourself. Ranked roughly by how often they hurt ordinary users:

1. Leverage. Perpetual futures can wipe out your margin in minutes.
2. Your own keys and signatures. Phishing sites, fake support and malware.
3. Bridges and third parties you use to get money in and out.
4. Market structure. Liquidations, auto-deleveraging and thin markets.
5. The protocol itself. Validators, bridge contracts and software bugs.

1. Self-custody: no one can freeze it, no one can recover it

Hyperliquid’s Terms of Use (§1.4) say you must use a non-custodial wallet and that Hyperliquid Corp. “has no custody or control over the contents of your wallet and has no ability to retrieve or transfer its contents.”

That cuts both ways. No company can freeze your account or lose your deposit in a bankruptcy. But if someone gets your seed phrase (the 12 or 24 recovery words) or private key, they control your funds, and there’s no help desk that can reverse it. The docs put it plainly: “Only someone with access to your private key or seed phrase can sign transactions on your address’ behalf.”

If you log in with email, a wallet is created for you (the login codes are sent by Privy). You can export its private key from the settings menu (“Export Email Wallet”); treat that key exactly like a seed phrase. See create a Hyperliquid account.

2. Market risk: leverage, liquidation and ADL

This is where most money is lost, and it’s not a flaw in the system: it’s how leverage works.

• Liquidation. If your account equity falls below the maintenance margin (between 1.25% and 16.7% of your position, depending on the asset’s maximum leverage), your position is closed with market orders. If it falls below two-thirds of the maintenance margin before that succeeds, the position is taken over by the liquidator vault and you lose the remaining maintenance margin too. In cross margin with no isolated positions, the docs say you end up with zero account equity.
• Slippage on stops. Market take-profit and stop-loss orders allow up to 10% slippage. In a fast move, your stop can fill well below the trigger.
• Auto-deleveraging (ADL). If a losing account goes negative, traders on the winning side can have part of their profitable position closed at the previous mark price to keep the exchange solvent. The docs state that a user with no open positions never shares those losses.

Before trading, read leverage and margin on Hyperliquid and start with low leverage and an amount you can afford to lose.

3. The protocol: validators, bridges, bugs

• Validators. The chain is run by a validator set using HyperBFT consensus. The info API listed 35 validators, 27 active (Hyperliquid API, 4 Nov 2026). Consensus requires more than two-thirds of stake to be honest, so how stake is spread across validators matters.
• USDC. USDC is natively minted on Hyperliquid by Circle, and Circle’s CCTP is the preferred deposit method. The older Arbitrum bridge is deprecated, holds less than 10% of USDC on HyperCore, and was audited by Zellic. On that bridge, withdrawals are processed by the validators rather than by any single company.
• Bug bounty. Hyperliquid pays up to 1M USDC for critical bugs (loss of user funds) and up to 50k USDC for network downtime, which gives researchers a strong reason to report rather than exploit.
• Downtime and congestion. If an action isn’t accepted within 15 seconds, the app rejects it with “Action already expired” rather than placing it late. That’s protective, but it means you can’t always act at the exact moment you want.

No blockchain is free of software risk. What you can check is that the code paths you rely on (USDC deposits and withdrawals) are the documented, official ones.

4. Third parties you choose to use

Much of the risk sits outside Hyperliquid’s core:

• Unit, an independent team, runs deposits and withdrawals of BTC, ETH, SOL and several other native coins. Hyperliquid’s docs describe Unit as managing those deposits and withdrawals, so you’re trusting Unit as well as Hyperliquid. Read Unit’s own documentation for how it secures them. Sending the wrong asset or chain to a Unit address is usually unrecoverable. See deposit Bitcoin to Hyperliquid.
• HIP-3 markets such as trade.xyz stock perps are run by deployers who set the oracle (price source), leverage limits and can settle a market. Deployers must stake 500,000 HYPE, which validators can slash for malicious or broken operation, but a market is only as sound as its price feed. See HIP-3 explained.
• Vaults. HLP and user vaults are trading strategies and can lose money (HLP guide).
• Front ends. Wallets and trading apps that connect to Hyperliquid can charge a builder fee of up to 0.1% on perps and 1% on spot, on top of normal fees, once you approve it. The official app charges none. See builder codes.
• HyperEVM apps are built by independent teams. Hyperliquid’s support guide says questions about them go to those teams.

5. Phishing and impersonation

Hyperliquid’s own support guide warns about lookalike domains such as “hyperliguid.xyz” and says to assume anyone who contacts you directly is a scammer. Official support only happens in a ticket you open yourself. Our scams guide covers the common tricks; official links lists the real addresses.

A safety checklist

Before your first deposit:

• Bookmark app.hyperliquid.xyz and only reach it from the bookmark, not search ads.
• Write your seed phrase on paper, store it offline, never type it into a website.
• Consider a hardware wallet (the docs name Ledger, Trezor and Keystone) paired with a browser wallet.
• Send a small test deposit first, and respect the minimums: USDC deposits under 5 USDC are lost.
• Set your referral code and check your fees with the fee calculator so a front end’s builder fee doesn’t surprise you.

Before every trade:

• Use isolated margin and low leverage while you learn.
• Know your liquidation price and set a stop loss.
• Read what your wallet asks you to sign. If it’s unclear, don’t sign.

If you think you’ve been compromised

The docs’ steps: stop using the address and treat it as burned; create a new wallet; move any remaining funds, including anything on the HyperEVM; revoke smart-contract permissions at revoke.cash; clear browser cache and cookies; and work out how it happened (malware, a fake site, a fake support chat) before using the new wallet.