Hyperliquid: rebuilding the exchange
Hyperliquid: rebuilding the exchange
As of 2026, it's an exchange with a ~$11B market cap, an 80% share of the perp DEX market, and the first US spot ETF on its name. What's more interesting than those numbers is the problem it's solving — it broke, head-on rather than around, the trade-off everyone took as a given: that you must pick between a fast CEX and a self-custodied DEX. It built a fast blockchain made specifically for trading, and put a real order book on top of it.
The point is that this decision wasn't an accident. It was built by an ~11-person team out of an HFT shop (Hudson River Trading), with zero VC funding, bootstrapped on trading-firm profits. That made the token distribution possible at 0% insider / 0% market maker — and at the same time, all in one bundle: how that elegant mechanism became an attack surface during a crisis (the JELLY incident), and how "code is the rule" got rewritten by human votes. Every choice is the consequence of the previous choice's limits.
1. What an exchange actually does
Whether it's stocks or crypto, an exchange does exactly one thing at its core. It connects someone who wants to buy with someone who wants to sell. How you solve that one line determines every design decision that follows, and that's where the shape of Hyperliquid begins.
The most familiar way to do this is the order book. "Buy 10 at $100" and "sell 5 at $101" line up, and when prices match they execute. That's the order book in your brokerage app, the one you see on Binance. Who runs that line? A central company's server. Places like Binance and Coinbase are CEXes (Centralized Exchanges).
The reason a CEX is fast and easy comes straight out of this shape. When one company server holds every quote in memory, finding the matching counter-quote when a new order arrives takes microseconds. Even tens of thousands of quote updates per second is fine.
The problem is the cost. When I deposit my coins to an exchange account, the coins are actually held by the exchange. My balance is just a row in their database, and if the company collapses (FTX was exactly this) or freezes withdrawals, that row turns into nothing. The ability to match fast is built on the premise of "putting all the assets in one place," and that premise is itself the single point of failure. "Not your keys, not your coins" — the old saying everyone repeats — is naming this single point of failure.
2. Blockchains dissolve that single point of failure
What a blockchain is, at the mechanism level, is this: a public ledger that nobody can forge alone, that everyone holds an identical copy of. Instead of a bank's single server recording balances, thousands of computers share the same ledger and verify each other. If one computer tries to lie, the others have a different copy and catch it instantly. So there's no need to "entrust" anyone with your balance — as long as you hold the key to your wallet, only you can move what's on the ledger.
Ethereum took it one step further: smart contracts. Instead of just recording balances on the ledger, you put a program on the ledger that says "if these conditions are met, move money like this," and the ledger executes it automatically. No need for a human or a company in the middle. Code is the rule, and the code is readable by anyone.
So "on-chain" isn't just a word, it's a declaration of where responsibility sits. When an activity happens on the blockchain, in public, automatically, it's on-chain. When it happens inside a company's server, in private, it's off-chain. CEX matching is off-chain. That fact, by itself, is the single point of failure from §1.
3. The wall the DEX ran into
So the natural next question — can't an exchange run with no company server, just smart contracts? That's a DEX (Decentralized Exchange). You don't deposit your coins to a company; they stay in your wallet, and you trade directly with code. Self-custody is preserved.
But the moment you try to put an order book directly on a blockchain, you hit a wall. The wall is baked into how blockchains work. To add one row to the ledger, many validators have to agree on that change, and you pay gas as the price for asking for that agreement. Each row takes seconds, costs cents.
An order book sees tens of thousands of orders placed and canceled per second. If a single quote update takes seconds and costs gas every time, the book simply cannot function. CEX's microsecond matching and a blockchain's second-scale consensus operate on different units. Once you remember that the CEX's speed in §1 sat on top of the premise of "putting all assets in one place," it follows naturally that removing that premise collapses the speed at the same time. The usability of an exchange and self-custody were two sides of the same trade-off on the same graph.
4. AMM — the workaround that "gives up" the order book
So the DeFi camp stepped back here. They gave up the essence of the order book — direct person-to-person matching — and used a different mechanism to go around it. That's the AMM (Automated Market Maker), and Uniswap is the canonical example.
The idea swap is the core. Instead of matching buyers and sellers directly, build a giant jar of money (a liquidity pool) and let people trade with the jar.
If the order book is "person-to-person flea market," the AMM is a vending machine. The jar is full of ETH and USDC (dollar-pegged coin). Drop USDC in, and the formula spits out a fixed amount of ETH. You don't need to wait for a human counterparty — as long as the jar is big enough, you trade instantly. Price is set automatically by a math formula, based on the ratio of the two coins in the jar — that famous x · y = k.
If the jar holds 100 ETH and 200,000 USDC, the product is fixed at 20,000,000, and the ETH price is automatically USDC/ETH = $2,000. When someone pulls ETH out, x shrinks and price rises; when they pull USDC out, the reverse. There's nowhere for a human decision to enter — the single rule that "the product must stay constant" generates every price.
Who fills the jar? Regular users deposit their coins and get a share of the trading fees in return. They're called LPs (Liquidity Providers).
The AMM elegantly side-stepped the blockchain's speed limit. Instead of updating quotes tens of thousands of times per second, you only have to update the jar's ratio once, when a trade actually happens. The reason DeFi exploded is this invention.
But from a trader's seat, it's awkward. Vending-machine prices are set by formula, in a blunt way. There's no precision limit order like "queue exactly at $100.05" on an order book. Trade a large amount and your own trade moves the price against you — slippage is baked into the structure. Leverage, sophisticated liquidations, and complex order types — things professional traders want — are hard to layer on top of a vending machine. It's a structure that sacrificed precision for convenience. Saying it cleanly: the AMM didn't solve the blockchain's speed limit, it side-stepped it, and the price was the precision a trader cares about.
5. Hyperliquid's question — why must we go around?
Now the stage is set. Two paths:
- CEX (Binance): Fast, precise order book. But you have to deposit money to a company (FTX risk).
- DEX-AMM (Uniswap): Self-custody. But it's a vending machine, blunt for traders.
Hyperliquid's question was simple. "Can't we have both?" More precisely: if the only reason we had to detour through the AMM was that "existing blockchains can't handle exchange workloads," wouldn't replacing that premise fix it?
The answer was brute but head-on.
If existing blockchains are too slow, just build a fast blockchain made for exchanges.
That's why they laid down their own L1 (Layer 1). Not stacked on top of someone else's chain, but designed from scratch, just for high-frequency trading. The decision deleted the necessity of the AMM detour from §4. The result became the first exchange to actually run a fully on-chain order book (CLOB) at scale, and it now holds over 80% of the perp market.
A quick word on what perp (perpetual futures) means — leveraged bets with no expiry. You can put 10x on "ETH is going up" and hold it indefinitely. Crypto traders trade perps far more than spot, and it's the market that most needs precise order books. That's the market Hyperliquid aimed at directly, after untangling the trade-off in §1–§5.
6. The architecture — two rooms living on top of one consensus
The decision to build your own L1 brings two demands. First, the trading itself has to be microsecond-fast (or the aim from §5 falls apart). Second, other developers have to be able to put their own apps on top of it (a chain with only trading doesn't grow an ecosystem). These two demands are hard to satisfy in one chain, so Hyperliquid split the chain into two rooms, joined under the same consensus.
6.1 HyperCore — the trading engine itself
The room where the order book and matching happen. Speed is sacred and it's optimized to the extreme. Every order, fill, and liquidation finalizes inside a single block, on a consensus shared by the same validators. This is the technical embodiment of the "real order book" from §5.
6.2 HyperEVM — the developer playground
The second demand — that pure trading doesn't grow an ecosystem — built this room. There's a space next door where other developers can deploy their own apps (smart contracts), and EVM means it's compatible with the Ethereum Virtual Machine, so existing Ethereum developers can bring their code almost as-is.
The key is two things. The same consensus secures it, and the developer next door can directly tap the deep liquidity of HyperCore's order book. Normally if you build on top of a DEX, you have to bring in external liquidity yourself; here, you borrow the real deep order book directly. The fact that "the trading engine and the app ecosystem see the same truth" is not a convenience — it's the identity of the design.
6.3 HyperBFT — the consensus that ties the two rooms
What keeps the two rooms on top of the same truth is HyperBFT, the custom consensus algorithm. It's based on HotStuff, a textbook academic BFT consensus, retuned for exchange workloads. The core mechanism is leader rotation — each round, one leader proposes a block and the other validators reach agreement through a few rounds of communication. Voting weight is proportional to stake (the amount of HYPE deposited), including stakes delegated by users (DPoS, Delegated Proof of Stake).
The numbers tell you what this consensus was aiming at.
HyperBFT performance (2026)
──────────────────────────────────────────────
Throughput up to 200,000 TPS (per order)
Block time 0.07s
Median latency 0.1s
99p latency 0.5s
Finality 1 block (immediate)
"BFT (Byzantine Fault Tolerance)" means the system keeps running even when some validators turn malicious — up to ~⅓ can be Byzantine and the network doesn't break. Plain language: a consensus rule under which even if some of the verifying machines lie, the truth as a whole is preserved. Once every 0.07 seconds. The "second-scale consensus" limit from §3 is precisely what got broken at this point.
7. How a perp tracks spot without an expiry
§5 said a perp is a leveraged bet with no expiry, but there's an awkward demand baked into that. A regular futures contract settles against the spot price on expiry day, so the two prices converge by force at that moment. With no expiry, the perp price can drift further and further from spot. To understand why the HLP vault in the next section takes on risk, the convergence mechanism has to be laid down first.
The solution is a pressure device called the funding rate. At fixed intervals (typically 1–8 hours), the difference between the perp price and the spot price is calculated, and money flows directly between longs and shorts. The exchange doesn't pocket it — traders pay each other.
The direction is this.
- When the perp trades above spot (premium): longs are betting at a higher price than spot, the signal is bullish-loaded. → longs pay the funding fee to shorts. Longs feel the cost pressure and either close or stop entering, shorts get paid and step in → perp price gets pulled back toward spot.
- When the perp trades below spot (discount): the opposite. Shorts pay longs.
The formula is usually split into two pieces.
funding rate ≈ premium index + interest rate clamp
↑ ↑
how far the a small correction reflecting
perp is from the rate gap on the USD/quote
spot asset
The important thing here is that the funding rate is not a "mechanism by which the exchange forces the price." It doesn't press the price directly — by making the expensive side pay, it lets the market converge on its own. An elegant mechanism that captures the effect of expiry settlement while keeping a product that has no expiry.
8. The HLP vault — opening "insider profit" to ordinary people
This is the part that's most interesting from a market-structure perspective.
On a CEX, the money from market making and liquidations is monopolized by the exchange and its in-house professional traders (insiders). Ordinary users can't even touch it. This isn't an accident, it's a structure — only those with the capital, technology, and access to lay deep quotes on both sides and instantly take the other side of a forced liquidation can sit in that seat.
Hyperliquid replaced that seat with code. They built a public vault called the HLP (Hyperliquidity Provider), and anyone can deposit USDC. The vault makes money on three streams.
- Market making — quotes on both sides of every listed perp, eats the spread.
- Liquidation inheritance — when someone gets force-liquidated, the HLP takes the opposite side. Liquidations happen at a slightly unfavorable price relative to market, and that edge flows in (this is called "liquidation alpha").
- USDC Earn — spare USDC is lent out somewhere safe and earns interest.
Returns swing with market conditions but report in the range of 15–35% annualized (roughly 1.75%/mo ≈ ~20% annualized). When a huge liquidation hits, a single-day return north of 5% can happen — in Feb 2026, when BTC broke $76,000 and a $700M long was force-liquidated, the HLP collected ~$15M in 24 hours.
It looks like the AMM's LP (the people who fill the vending machine) but it's different. An LP is passive — they supply the vending-machine inventory and let the price move on its own. The HLP is a vault that behaves like a professional trading shop, actively running market-making and liquidation strategies. It opens to ordinary people the precise market-making seat the vending machine in §4 couldn't solve, but on top of a real order book. On top of that, professional traders build their own strategy vaults that ordinary people deposit into — native copy-trading.
Not free, though. A 4-day lockup means you can't withdraw for 4 days after your most recent deposit — a guard against the market-making strategy being shaken by capital flight at the wrong moment. And — as §10 will show — the liquidation-inheritance revenue stream is exactly what gets weaponized through the same mechanism. That's the dark side of the design.
9. The founder decides the design
That none of these choices were accidents becomes clear when you look at who built it.
Jeff Yan. International Physics Olympiad gold medal in 2013. Math and CS at Harvard. And alumnus of Hudson River Trading (HRT), the HFT shop famous for ultra-low-latency strategies. HFT is a world where you fire and pull thousands of orders per second and fight on microsecond margins. You can see immediately where the obsession with 0.07s blocks and instant finality in §6 came from — to someone from that world, "execution speed and determinism" isn't a thing to negotiate, it's religion. The team includes alumni of Caltech, MIT, Citadel, and HRT.
The way the company runs is an extension of the same spirit. They bootstrapped with trading-firm profits, refused VC investment, and kept the team around 10 people. What Yan saw as the problem with VC was simple — outside capital with large stakes becomes a "scar" on the network and warps long-term decision-making. From an interview:
"I was never really doing it for the money. Trading teaches you that money is really just a number."
Token launch was the same principle's offspring. On November 29, 2024, they distributed about 31% of total supply (~310M tokens) directly to past users. Zero private investor allocation, zero paid market-maker allocation. In a market exhausted by FTX and the belief that "insiders eat everything," this "no insider" distribution converted directly into trust. If the HLP from §8 was "opening pro market-making profit to ordinary people," the token distribution is the same principle in a different form — "opening protocol equity to ordinary people."
Two lines that show up often in the design philosophy.
- "No internal exchange, no discretionary power."
- "Hyperliquid is not a company." — It's a protocol, not a company.
Yan himself almost never appears in public. Few interviews, no conference circuit, minimal social. With ~11 core people they run ~$10B/day in volume, 570k+ users, $0 marketing. The design decisions in §6–§8 are only possible on top of this way of operating — if VC had taken a large stake, the 31% airdrop from §9 couldn't have started.
10. The shadow — the contradiction the JELLY incident revealed
This clean story took its biggest crack in a single event. They claimed self-custody and decentralization, but when a crisis hit, the truth came out: "you can pull the plug from the center." This is the dark side §8 hinted at.
10.1 What happened
March 26, 2025. The attacker opened three fresh accounts within about 5 minutes.
Attack setup
──────────────────────────────────────────────
Account A long ~$2.0M on JELLY perp
Account B long ~$2.05M on JELLY perp
Account C short ~$4.1M on JELLY perp ← slightly larger short on net
JELLY was a small memecoin perp with almost no volume. Once the setup was in place, the attacker started pumping JELLY spot price across multiple external exchanges, lifting the price over 400% within an hour.
The attacker's short (Account C) went deeply underwater on unrealized loss. As the loss exceeded the account's collateral, a forced liquidation was triggered. Normally the liquidation engine closes the short by taking the opposite side in the market — but the order book had almost no liquidity, so the liquidation failed to execute.
This is where the design from §8 worked exactly as written — and that's the body of the trap. When a liquidation fails, the position is inherited by the HLP. In other words, the ~$290M public vault, holding the deposits of ordinary people, inherited a huge short, and as JELLY's price kept rising, the HLP would keep getting eaten. It's the dark mirror of the "liquidation alpha" from §8. If the system is structured to earn from liquidation inheritance, that very mechanism becomes the attack surface.
10.2 How they responded
The validators were urgently convened and finished the vote in about 2 minutes. The result:
- Delisted the JELLY perp.
- Force-settled all JELLY positions at a price unfavorable to the attacker (close to the open) — effectively overwriting the oracle (price feed) by hand.
- The foundation refunded everyone affected, excluding the address tagged as the attacker.
The funds were saved. The HLP's PNL loss capped at ~$4M, and the attacker, though they had withdrawn ~$6.26M to their wallet, only got to keep part of it — the rest got frozen.
10.3 What that exposed
The problem is what that response means. It proved that, in a crisis, validator power can overwrite normal market flow. The "code is the rule" principle from §2 got rewritten by human votes in a crisis. The cleanest decentralization story shook right there. What stopped the manipulation attack wasn't code — it was a fast vote among people.
Critics pointed out the validator set was only ~24 at the time — a narrow base — and in the immediate aftermath, about $80M flowed out of the HLP. The cost of rebuilding trust.
After this, Hyperliquid went into hardening. Leverage limits were tightened (BTC max 40x, ETH 25x) to give the HLP a buffer to unwind positions safely; the oracle and liquidation mechanisms were reinforced; and HIP-3 was introduced as a permissionless market-listing framework — anyone can spin up a market, but the responsibility structure is made explicit.
The real lesson JELLY left is this — the HLP in §8 was an elegant mechanism design, but it was also an attack surface. Elegant and robust are not the same thing.
11. Tokenomics evolution — the same principle, further out (2025–2026)
After JELLY the flow split in two. One stream is the risk hardening above. The other is the deeper application of the principle started in §8–§9: "return revenue to participants."
11.1 USDH announced and retired
In September 2025, Hyperliquid announced its own stablecoin USDH and selected the external operator through on-chain validator vote. It applied the §9 "no internal exchange" to stablecoin issuance, too. Native Markets was selected — reserves managed via Stripe-owned Bridge.
Then in May 2026, the turn. Native Markets sold the USDH brand to Coinbase, and Coinbase is winding down USDH and moving toward making USDC the primary quote asset of Hyperliquid. The judgment was: rather than holding our own stablecoin, getting deeply intertwined with the USDC ecosystem and capturing the interest on those USDC reserves is the bigger picture.
11.2 AQA v2 — sending that interest into HYPE buybacks
That judgment's output is the Aligned Quote Asset v2 (AQA v2) proposal. Starting October 2026, up to 90% of the yield generated on USDC reserves locked at Hyperliquid will flow to the protocol's Assistance Fund. And the Assistance Fund is used only for HYPE token buybacks.
In plain language: while the USDC users deposited on the exchange is sitting idle, it earns interest. That interest gets routed into an automatic buy engine that buys HYPE off the market, shrinking supply and supporting price. Both exchange revenue and deposit interest flow into token value in one structure.
This is the largest extension of the "give what insiders used to eat to protocol participants" principle from §8–§9. If the HLP opened up market-making and liquidation revenue to ordinary people, AQA v2 brought the interest on exchange deposits into that same stream.
11.3 ETF, and a listed-company holder
The flow translated into external trust as well. In July 2025, Nasdaq-listed biotech Sonnet BioTherapeutics established an entity holding $880M of HYPE and renamed itself "Hyperliquid Strategies Inc." — the largest HYPE holder among US listed companies. In May 2026, Bitwise launched the first US spot Hyperliquid ETF (BHYP) including staking. HYPE is a top-10 crypto by market cap, reaching ~$11B in less than two years of trading.
12. Summary
Each link follows from the previous link's limit.
- 1. A CEX is fast and precise, but the assets sitting in one company create a single point of failure.
- 2. A blockchain dissolves that single point of failure — balance lives on a distributed ledger, the key stays with the user.
- 3. But you can't put an order book directly on-chain — consensus cost makes it not work.
- 4. That limit got side-stepped by the AMM (vending machine). What was lost was the precision a trader cares about.
- 5. Hyperliquid didn't go around it — it built a trading-specific fast L1 and put a real order book on chain.
- 6. It joined the trading engine (HyperCore) and the EVM environment (HyperEVM) under one consensus (HyperBFT).
- 7. The awkwardness of a perp having no expiry was solved by the funding rate — make the expensive side pay, the market converges on its own.
- 8. On top of that, the HLP vault opened the market-making and liquidation revenue that insiders monopolized to ordinary people.
- 9. All of these decisions are only possible on top of a VC-scar-free, bootstrapped operation.
- 10. JELLY proved that the elegant mechanism is exactly the attack surface, and that "code is the rule" got rewritten by validator votes in a crisis.
- 11. The subsequent flow has two streams — risk hardening, and the tokenomics extension that brings even deposit interest into HYPE buybacks.