HyperBFT is the consensus algorithm that secures Hyperliquid. It's a Byzantine-fault-tolerant protocol inspired by HotStuff: validators vote on each round of transactions, and once validators with more than two-thirds of the stake sign, the round is final.

How fast is Hyperliquid finality?

Hyperliquid has one-block finality: a committed block cannot be reverted. The docs give a median end-to-end latency of 0.2 seconds and a 99th percentile of 0.9 seconds for an order sent from a co-located client.

How many validators does Hyperliquid have?

On 4 November 2026 the validatorSummaries endpoint listed 35 validators, of which 27 were active and 6 were jailed. The docs say the active set is the top 27 validators by stake.

Can Hyperliquid be shut down by its validators?

Validators holding more than one-third of stake could halt progress by refusing to sign, and more than two-thirds could in principle agree on invalid state. On 4 November 2026 the five Hyper Foundation validators held about 47% of all stake, so the Foundation alone was above the one-third threshold.

HyperBFT Explained: How Hyperliquid Reaches Consensus (2026)

Every blockchain has to answer one question: who decides what happened, and in what order? On an exchange that question is everything. If two traders try to buy the last offer at the same price, someone has to decide who was first, and everyone has to agree. On a centralized exchange that’s the company’s matching server. On Hyperliquid it’s HyperBFT.

The idea in plain English

Think of a committee that must approve every page of a ledger before it’s bound into the book.

One validator, the proposer (leader), assembles a batch of transactions and proposes it.
The others check it and vote.
When validators holding more than two-thirds of all staked HYPE have signed, that group is a quorum, and the batch (a round) is committed.
Committed rounds go to the execution engine, HyperCore, which applies them in order.

“BFT” stands for Byzantine fault tolerance: the system keeps working correctly even if some participants are offline or actively lying, as long as more than two-thirds of the stake is honest. HyperBFT is described in the docs as a variant of HotStuff, a well-known BFT design, optimized end to end together with Hyperliquid’s networking stack.

Rounds, heights and epochs

Term	Meaning
Round	One bundle of transactions plus signatures from a quorum. All honest nodes agree on the ordered list of committed rounds.
Height	The block number of the execution state. It only increases on rounds that contain at least one transaction.
Epoch	100,000 rounds, about 90 minutes on mainnet. The validator set and stakes are fixed within an epoch.

Why one-block finality matters

On some chains a transaction is only probably final and becomes safer with every block that follows. Under HyperBFT, a committed block is final. When your order fills, it can’t be undone by a reorganization a few seconds later. The docs give these latency numbers for an order from a co-located client:

Measure	End-to-end latency
Median	0.2 seconds
99th percentile	0.9 seconds

Throughput is about 200,000 orders per second; the docs say execution, not consensus, is the bottleneck.

Ordering inside a block

The mempool and consensus logic know which transactions touch HyperCore order books. Within each consensus batch, actions are sorted into three groups:

Actions that don’t send GTC or IOC orders
Cancels
Actions that send at least one GTC or IOC order

So within a batch, cancels run before new aggressive orders. That protects market makers from being picked off by an order that arrived in the same batch as their cancel, which in turn supports tighter spreads. More in the order book explainer.

Jailing is not slashing

Validators can vote to jail a peer that responds too slowly or too rarely. A jailed validator stops participating and earns no rewards for its delegators until it fixes the problem and unjails (subject to rate limits). Slashing, confiscating stake, is reserved for provably malicious behaviour such as double-signing; the staking docs say no automatic slashing is currently implemented. (HIP-3 deployer slashing is a separate mechanism; see HIP-3.)

Who holds the stake, as of 4 November 2026

From the Hyperliquid API (validatorSummaries), 07:27 UTC:

Measure	Value
Registered validators	35
Active	27
Jailed	6
Total HYPE staked	~439.4M
Hyper Foundation 1–5 combined	~208.2M HYPE (~47% of stake)
Largest validators needed to pass two-thirds	8

Stake concentration matters because consensus thresholds are measured in stake, not head count. With about 47% of stake, the Foundation’s validators can’t finalize blocks alone, but they could stall the chain by refusing to sign. See validators and staking for the full list.

Why it matters to you

Fills are final. No waiting for confirmations: once a trade is in a committed block, it stands.
Order matters, and it’s predictable. The cancel-first rule within a batch is part of why Hyperliquid’s books can be tight.
Your stake choice is a security choice. If you stake HYPE, the docs say it’s every staker’s responsibility to delegate only to trusted validators, since the system’s safety assumes a two-thirds honest quorum.
Decentralization is a work in progress. The validator set is permissionless to join (with a 10,000 HYPE self-stake), but stake is still concentrated.

What can go wrong

Liveness halts. If more than a third of stake goes offline or refuses to sign, the chain stops producing blocks. Open positions can’t be adjusted until it restarts.
Concentration. A small number of validators control a large share of stake. Collusion or a shared bug among them is a systemic risk.
No automatic slashing. Misbehaving validators are handled by jailing and the social layer, not automatic penalties.
Latency isn’t equal. The 0.2s median is for co-located clients. Your home connection will be slower than professional traders’.

Next: validators and staking, or how execution works in HyperCore vs HyperEVM.

HyperBFT: how Hyperliquid agrees on every trade