TL;DR: Institutional participation in Hyperliquid now depends on real-time screening because permissionless markets, HyperCore and HyperEVM activity, and HIP-3 and HIP-4 listings outpace periodic AML, KYC, and sanctions review, according to Blockaid. Compliance has shifted from after-the-fact traceability to pre-transaction decisioning, where desks need to know whether to interact before a trade clears.
At a glance
What this is: Blockaid argues that Hyperliquid’s growth is turning compliance into a real-time screening problem, not a periodic review problem.
Why it matters: This matters because institutions trading permissionless markets need pre-trade exposure decisions across counterparties, pools, and markets, or they inherit regulatory and financial crime risk they cannot reliably see after settlement.
By the numbers:
- Hyperliquid now accounts for nearly 50% of all onchain perps volume and over 60% of total open interest in DeFi.
- As of July 2026, HIP-3 markets surpassed all other Hyperliquid markets and accounted for more than 50% of total Hyperliquid volumes.
- The operator reported roughly a 55% drop in wash trading attempts after deploying it.
Context
Hyperliquid’s expansion is a compliance story as much as it is a trading venue story. When a permissionless market can be deployed quickly and transact onchain in seconds, traditional review models lose the ability to sit between the trader and the transaction in the way a centralized venue can.
For regulated institutions, the issue is not whether the chain is useful. The issue is whether AML, KYC, and sanctions obligations can be enforced at execution speed across HyperCore and HyperEVM, especially when new markets, pools, and counterparties appear faster than manual screening can follow.
Key questions
Q: What breaks when compliance teams rely on periodic screening for permissionless markets?
A: Periodic screening fails when markets, pools, and counterparties can appear and trade before the next review cycle. The result is an exposure window in which tainted or sanctioned flow can clear before policy catches up. Institutions need controls that decide at the point of execution, not controls that only explain what happened later.
Q: When should institutions prioritise real-time monitoring over post-trade forensics?
A: They should prioritise real-time monitoring whenever a market can settle in seconds, listings can be deployed continuously, or exposure can change between batch scans. Forensics still matters, but it cannot be the primary control when the business risk is interaction with prohibited or manipulated flow before settlement.
Q: What are the signs that static address screening is failing on DeFi venues?
A: The clearest signs are growing review backlogs, delays adding new markets or addresses, repeated false confidence from stale lists, and discovery of exposure only after funds have moved. If the team cannot say whether a transaction should be allowed right now, the control is no longer matching the pace of the venue.
Q: Who is accountable for AML and sanctions decisions on permissionless trading venues?
A: The regulated institution remains accountable, even when the venue itself is permissionless and may not provide a centralized compliance desk. Firms cannot outsource their obligations to the chain. Governance has to assign ownership for policy, thresholds, escalation, and evidence so the institution can defend each decision.
Technical breakdown
Why permissionless market deployment breaks batch screening
Permissionless listings compress the lifecycle of a market from onboarding to live trading, which means risk characteristics emerge only after liquidity is already moving. In a setup like Hyperliquid, the screening target is not just a known counterparty but a changing set of deployers, pools, and event-driven traders. Batch review assumes the universe of addresses is stable long enough to inspect it, but that assumption fails when a market can be created, funded, and traded before a periodic scan runs. The control problem is therefore one of timing and scope, not merely coverage.
Practical implication: institutions need controls that score markets and flows before execution, not after a daily review window.
How real-time exposure scoring changes compliance decisions
Real-time exposure scoring turns transaction review into a policy decision at the point of risk. Instead of asking whether an address exists on a deny list, the control evaluates whether a market, pool, or transaction path is exposed to sanctions, mixers, scams, stolen funds, or other taint categories at the moment of interaction. That matters because DeFi exposure can propagate through multiple addresses in a single flow, and the relevant question is often the whole path, not just the immediate counterparty. A pre-transaction verdict can stop bad flow before settlement, while continuous surveillance can detect when an initially benign route becomes risky.
Practical implication: desks should apply policy to the full transaction path and not rely on counterparty-only checks.
Why continuous surveillance matters more than post-trade forensics
Post-trade forensics answers what happened, but it does not prevent a desk from interacting with an address or pool that was already risky. In fast-moving markets, the delay between event occurrence, detection, and policy update creates an exposure window that sample-based review cannot close. Continuous surveillance reduces that window by reassessing exposure as new intelligence arrives, including new exploits, front-end attacks, and DNS takeovers that can change the risk posture of a market or wallet without any formal lifecycle event. In operational terms, the control objective shifts from evidence preservation to interaction prevention.
Practical implication: compliance teams should treat real-time surveillance as the primary control and forensics as a backstop.
Threat narrative
Attacker objective: The objective is to move illicit, manipulated, or sanctioned flow through a fast market before screening catches up.
- Entry occurs when new permissionless markets, pools, or wallets appear on Hyperliquid faster than manual screening and static address lists can absorb them.
- Credential or counterparty trust is then abused when institutions interact with tainted or newly risky flows before exposure data has been updated.
- Impact follows as regulated desks either clear prohibited flow or miss coordinated manipulation such as wash trading, leaving them exposed to compliance and market integrity failures.
Breaches seen in the wild
- Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Real-time compliance is now a market access control, not a reporting function. The article shows that institutions trading permissionless venues cannot depend on periodic review to decide whether a transaction should proceed. When markets settle in seconds, the control must operate before execution, which makes pre-trade exposure scoring part of the access decision itself. The practitioner conclusion is simple: if compliance cannot influence the transaction before settlement, it is too late to govern the risk.
Continuous market surveillance: this is the named governance gap Hyperliquid exposes. The weak point is the assumption that a static address list or sampled review can keep up with markets that deploy and mutate continuously. That assumption fails first in DeFi because market objects, not just counterparties, become the unit of risk. The practitioner conclusion is to govern the market, pool, and flow as live objects, not as periodic audit subjects.
Regulated institutions need policy-driven transaction refusal, not only post-event tracing. The article’s strongest signal is that compliance posture now affects both regulatory defensibility and trading operations. The ability to say a transaction was blocked before it cleared is materially different from reconstructing the path later. The practitioner conclusion is that prevention controls should be designed as an operational requirement, especially where AML and sanctions obligations attach to real-time market access.
The Hyperliquid case shows how infrastructure expansion widens governance scope faster than review processes can adapt. HIP-3 and HIP-4 extend the target surface from a single perpetuals venue into deployable market infrastructure with new asset classes and event contracts. That changes the governance problem from venue oversight to ecosystem oversight, which is where traditional compliance tooling tends to fragment. The practitioner conclusion is to align monitoring, policy, and escalation around the pace of market creation, not the pace of manual case review.
What this signals
Continuous market surveillance: the article shows that compliance teams need a live governance model for permissionless trading, not a nightly reconciliation habit. That changes how institutions think about control ownership, because the operational question becomes who can stop a trade before it clears, not who can explain it after the fact.
The broader lesson for identity and access teams is that transaction-level trust is now a policy enforcement problem. Where market objects appear and mutate faster than review cycles, the governing control has to move from inspection to intervention.
For practitioners
- Implement pre-transaction exposure gating Require a policy decision before settlement for every market, pool, and counterparty path that touches permissionless venues. Use a deny, warn, or approve model tied to sanctions, stolen funds, scams, and mixer exposure.
- Extend screening to market objects, not just addresses Model new deployers, pools, and event markets as live objects that need onboarding, scoring, and continuous reassessment. Do not assume an address-only control can represent the full compliance state.
- Set escalation thresholds for fast-moving exposure Define when a threshold breach triggers automated transaction refusal, analyst review, or enhanced due diligence, and make those thresholds consistent across HyperCore and HyperEVM.
- Retain forensic traceability after prevention Keep full evidence trails for blocked and allowed flows so the team can explain why a transaction was permitted or rejected and whether the policy behaved as intended.
Key takeaways
- Permissionless market growth turns compliance into a pre-transaction decision problem rather than a retrospective review exercise.
- The main weakness is reliance on periodic screening, which cannot keep pace with rapidly deployed markets, pools, and event contracts.
- Institutions need policy-enforced refusal, live exposure scoring, and audit trails that prove why a trade was allowed or blocked.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The article centres on abusive flow reaching markets before controls can intervene. |
| Recommendation — Map rapid exposure and manipulation scenarios to TA0006 and TA0040, then prioritise pre-execution blocking. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Transaction gating here functions as an authorization control for market access. |
| Recommendation — Apply PR.AA-05 to enforce policy decisions before a trade can clear. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article’s control problem depends on managing who or what can interact with risky markets. |
| Recommendation — Use CIS-5 to govern accounts and access paths that can initiate or approve trading activity. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Institutions need to limit which actors can reach high-risk markets and flows. |
| Recommendation — Apply AC-6 to restrict market interaction rights to the minimum necessary scope. | ||
Key terms
- Pre-Transaction Enforcement: Pre-transaction enforcement is the control pattern that decides whether a trade, transfer, or access request can proceed before it clears. In permissionless environments, it shifts the security and compliance decision to the moment of execution rather than relying on later investigation.
- Exposure Scoring: A risk method that combines permissions, connections, behaviour, and policy violations into one operational view. It is useful when inventories are too flat to show which identities are most likely to be misused or to affect critical systems.
- Continuous Surveillance: Continuous surveillance is ongoing monitoring that updates risk judgments as new intelligence arrives and as transaction patterns change. In onchain compliance, it is the difference between seeing yesterday’s state and acting on today’s exposure.
- Permissionless Market: A permissionless market is a venue or contract where new listings can be deployed without a centralized approval gate. That openness increases speed and liquidity, but it also removes the stable onboarding assumptions that many compliance processes depend on.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect identity controls to the wider access decisions their programmes depend on.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org