Hyperliquid has public protocol documentation and audit reports for specific components. Those materials support a review of defined risks; they do not establish that all funds or positions are safe. Your exposure depends on the market, collateral route, margin mode, and whether you trade or deposit in HLP.
Use the live tools
This review separates those choices and identifies what the available sources can establish. It uses primary documentation reviewed on September 13, 2026. The Hyperliquid market page supplies market observations, which should remain separate from a safety judgment.
Key takeaways
- The official audit page identifies the legacy bridge, not a complete audit of every Hyperliquid component.
- Current documentation includes native USDC and Circle transfer routes alongside the legacy bridge.
- An HLP deposit has strategy and withdrawal risks that differ from a trading balance.
- Market operators, margin rules, and settlement powers can affect an open position.
Identify the part of Hyperliquid you use
Hyperliquid contains HyperCore and HyperEVM on the same blockchain. HyperCore provides native trading functions. HyperEVM supports smart contract applications. The HyperEVM documentation states that both use the same consensus system.
A trade depends on more than the interface
A third-party application on HyperEVM can add contracts and permissions beyond native trading. A builder-deployed perpetual market can also have a separate operator and configuration. A venue name alone therefore leaves important parts of the risk undefined.
| Activity | What needs a separate review |
|---|---|
| Native perpetual trading | Margin, mark price, liquidation, settlement |
| Builder-deployed market trading | Deployer, oracle, collateral, market controls |
| HLP deposit | Strategy exposure, shared profit and loss, withdrawal lock |
| Third-party HyperEVM application | Application contracts, permissions, dependencies |
| Deposit or withdrawal | Asset, network, transfer route, recipient |
The first step is to identify the exact activity and route. Evidence about the legacy bridge cannot automatically support a conclusion about a separate application contract.
What the published audits cover
The official audit page states that Zellic audited the legacy bridge contract. It links two reports and separately references Circle's contracts. This wording matters because it identifies the component under review.
An audit report has a scope, code version, findings, and review date. A useful check matches those details to the component that currently handles the funds. A later software change or another contract can fall outside that review.
| Evidence | What it helps establish | What it cannot establish alone |
|---|---|---|
| Component audit | Findings about the reviewed scope | Safety of every protocol component |
| Public transaction data | Observable actions and balances | Future availability or full off-chain intent |
| Published risk rules | Documented behavior and controls | Absence of implementation defects |
| Historical performance | Results during a stated period | Future returns or a complete incident record |
This guide does not present the audit page as a certification of the entire chain. It also does not infer an absence of past exploits from an absence of reports in these sources.
Review the current USDC transfer route
Hyperliquid's USDC documentation now describes native USDC on the Hyperliquid chain. It links Circle's documentation for transfers from Arbitrum to HyperCore. It also distinguishes the legacy Arbitrum bridge.
That means an older description of every deposit using the same bridge is incomplete. The applicable contract, network, and transfer process depend on the route selected. Check the current instructions for that route before sending funds.
A successful transfer proves that one transfer completed under its observed conditions. It does not prove that a larger or later withdrawal will complete during a network disruption. Keep the transaction record and verify the asset and destination before another transfer.
Stablecoin exposure is another dependency. USDC targets the dollar, but a trading balance still depends on the token's operating and redemption arrangements. Margin rules can also determine how the platform values collateral.
Separate HLP exposure from a trading account
Hyperliquidity Provider, or HLP, is a protocol vault. Its documentation describes market-making, liquidation, USDC lending through Earn, and receipt of some trading fees. Depositors share the vault's profit and loss.
The same documentation specifies a four-day lock after the most recent deposit. That is a material difference from money you expect to withdraw immediately. Confirm the displayed unlock time before adding funds.
Hypothetical example: a $1,000 vault share loses 5% of its value during an adverse period. Its value becomes $950 before any additional charges or movements. A reported historical annual return does not prevent this loss.
An HLP deposit therefore adds exposure to strategy results. The fact that HLP supports parts of the trading system does not make the deposit insured or principal-protected.
Understand what liquidation can take from a position
A trading position can fail because its margin is insufficient even when the protocol operates as designed. The relevant questions are which collateral supports it and which price triggers the risk process.
Separate the loss from the liquidation charge
The adverse move before and during the close
Applicable trading fees and the actual fill price
Any stated charge, collateral transfer, or backstop treatment
Hyperliquid's margin rules distinguish shared cross margin from isolated margin. The liquidation rules describe order-book liquidation and a separate backstop process. Backstop treatment can transfer the affected position and its supporting margin.
Hypothetical account example: two cross-margin positions each lose $600. Together they reduce their shared supporting balance by $1,200 before costs. A gain recorded in a separate account or wallet does not automatically replenish that balance.
Use the leverage guide to distinguish quantity, margin, and planned loss. A stop order and a displayed liquidation estimate have their own execution limits.
Check who can settle the market
Hyperliquid's current delisting rules give validators a vote over validator-operated perpetual delistings. A delisting settles positions and cancels open orders. A perpetual's lack of regular expiry does not remove this settlement power.
Builder-deployed markets require another check. The HIP-3 specification assigns oracle and market-operation responsibilities to deployers. It also documents a deployer action that halts trading and settles positions.
For a held position, these powers are part of the contract's operating risk. Review the actual market operator and settlement rules. A claim about one validator-operated market does not automatically cover every builder-deployed contract.
Use market data for the question it answers
Volume measures executed activity over a period. Open interest measures outstanding positions on the source's stated basis. Neither figure measures the probability of a bridge loss or guarantees withdrawal availability.
The HYPE asset page concerns HYPE price exposure. Buying HYPE, trading a BTC perpetual, and depositing in HLP are different positions. A favorable view of one does not establish the risk of the others.
The market-structure guide explains how to read volume and open interest without treating them as safety scores. Costs also deserve a separate calculation in the cost comparison tool.
A review before committing funds
- Identify the exact market, application, or vault.
- Read the relevant component audit and its scope.
- Confirm the collateral asset and transfer route.
- Check margin sharing and liquidation rules.
- Identify the market operator and settlement powers.
- Record withdrawal conditions and any lock period.
- Decide how much loss your own finances can absorb.
The source review supports these checks, rather than a universal safe-or-unsafe score. It does not reconstruct every historical incident or certify current solvency. Those questions require additional evidence beyond the pages reviewed here.
Is Hyperliquid audited?
Its official audit page identifies Zellic reviews of the legacy bridge and separately links Circle contract information.
That is component-specific audit coverage.
Is HLP the same as holding a stablecoin balance?
No.
An HLP deposit shares strategy profit and loss and has a documented withdrawal lock. A trading balance has different account rules.
Does wallet control remove custody risk?
Wallet control governs your keys.
Contracts, validators, transfer systems, and market controls still affect deposited funds and their availability.
Has Hyperliquid never had an exploit?
This documentation review cannot establish a complete incident history.
An audit list or public dashboard cannot prove that negative claim.
PerpFinder may earn a commission from exchange referral links on this page.
This guide links to partner offers. PerpFinder may earn a commission. You can lose all your money on perp trades. Details