Comparison of Security Among Four Perpetual DEXs: Who Can Truly Enable User Self-Rescue?

Written by: @0xJaehaerys

Compiled by: AididiaoJP, Foresight News

On October 29, $6.3 billion was transferred from Binance's hot wallet. According to Binance, a DevOps engineer's laptop was hacked, allowing the attacker to access internal services and initiate withdrawals from there; there are no signs of private key leakage.

In other words, the attacker likely did not need the private key at all, but instead had Binance's own system sign the withdrawal. Binance later discovered more vulnerabilities, and a complete review has yet to be released. $3 billion has been frozen, and Binance has promised to cover the losses.

On Ethereum, a TRM report stated that the attacker had Binance's signature system approve an EIP-7702 delegation, transferring control of a hot wallet to the attacker's contract. Researchers believe that the signature system blocked a list of "known bad actions" rather than only allowing a whitelist of "known good actions," which is why this newer authorization method slipped through. Binance has not confirmed this detail, nor can it explain the losses on Bitcoin, Solana, and Tron.

A month ago, Bitget lost over $350 million in a similar manner: the attacker accessed the backend system that feeds transaction data to the signer, and withdrawals left with valid signatures.

If an exchange's system can access your funds, breaching the system is sufficient. Perpetual contract DEXs have always claimed that they can avoid such risks by design. I selected four and attempted to break down the same three questions: Where is the money? Who can move this money? If the team disappears or is hacked, can you still leave?

The answers come from on-chain readings, verified contract codes, team documents and posts, as well as @l2beat; event histories reference public reports. This is not an audit, nor is it about finding vulnerabilities. I only looked at one scenario: if the team's system and keys were breached like Binance, what could the attacker do with them, and could you still retrieve your funds?

I am not saying these protocols have vulnerabilities or will be hacked. Off-chain protections like MPC wallets, signing strategies, and monitoring may make these scenarios much rarer. So what follows is about what the contracts allow, not predictions.

Lighter: Even if the server is hacked, your balance cannot be moved

Lighter holds about $1 billion in its Ethereum contract: $556 million USDC, $430 million LIT (15.1 million tokens), plus some ETH and miscellaneous assets.

Under normal operation, funds can only leave in batches verified by ZK proofs. Standard withdrawals can only be sent to the account owner's wallet, which is fixed at the time of the first deposit. Faster withdrawals and transfers to other accounts also require your wallet's signature. Therefore, regardless of who controls Lighter's sequencer, prover, or validator keys, they cannot unilaterally withdraw the balance.

You can also bypass them. You can initiate a forced withdrawal directly on Ethereum; if Lighter does not process it within 14 days, anyone can switch the contract to "desert mode." Upgrades stop, and everyone can exit using ZK balance proofs based on existing Ethereum data.

But it is not completely trustless.

Prices are provided by Lighter's operators through index prices and marked prices, and the proofs do not verify oracle signatures. Price errors could lead to unfair liquidations, and L2BEAT has also pointed out the same risk.

Additionally, there are two guardian keys that can pause batch processing and withdrawals. One can pause for a maximum of 24 hours, while the other can pause for up to 72 hours, and each pause requires a cooldown period before it can be used again. However, these two keys cannot stop "desert mode": as long as a forced withdrawal is not processed within 14 days, the contract can still enter a state for everyone to exit.

Upgrades follow a different process. Normally, a 3/5 multisig must publicly notify on Ethereum 21 days in advance, giving users time to see what has changed. But if another 4/7 security committee also signs, this 21-day notice can be completely skipped, and the upgrade takes immediate effect. To date, Lighter has taken this fast track for every upgrade. In October alone, the proof validator was changed five times. The proof validator is a contract component that verifies ZK withdrawal proofs; its frequent replacement means that "how quickly the code can be changed" is not just a theoretical risk.

Historically, during the crash on October 10, 2025, the system was down for about 4.5 hours. After LIT was launched at the end of December 2025, there were delays in withdrawals. On October 17, 2026, there was a 2-hour guardian pause, which L2BEAT regarded as a test. On October 20 and October 29, there were about 4.5 hours of status update interruptions, both ending after rapid validator upgrades. There are no public reports indicating that the custodial funds were harmed.

My judgment: among the four, only Lighter can withstand a Binance-style server hack—if the attacker accesses the server, they still cannot solely rely on the server to withdraw the balance. The cost is that prices are determined by the operators, and multisig code changes may happen quickly. What you really need to trust are these two things.

Hyperliquid: Most USDC is held on Coinbase's single key and its own chain

Hyperliquid has $6.5 billion USDC backing, distributed across three locations.

• About $5.6 billion, accounting for 86%, is in the USDC reserve wallet under Coinbase on HyperEVM;
• About $622 million, accounting for 10%, is in Circle's CoreDepositWallet contract;
• About $290 million, accounting for 4.4%, is still in the old Arbitrum bridge.

That Coinbase wallet is a regular address with only one private key. This means that the security of 86% of USDC entirely depends on how Coinbase manages this private key, which cannot be seen from the chain. The Hyperliquid chain can also bypass Coinbase's private key, using a system that does not require signatures to trade USDC back and forth between the Coinbase wallet and Circle contract, keeping the balances roughly at a 9:1 ratio—meaning the USDC in the Coinbase wallet is about nine times that in the Circle contract.

Coinbase has staked 506,000 HYPE, worth about $46 million, for this role. This stake will only be forfeited if the wallet fails to pay the protocol's share of earnings, and it is less than 1% of the balance, which does not serve as a strong endorsement for the wallet.

The Circle contract is upgradable, and the administrator is a single address; the Hyperliquid chain can also directly transfer USDC out. On the Arbitrum bridge, three out of four validators can sign for the release, with a 200-second window before the release to intercept.

The safety net is Circle. It can freeze native USDC, and the $823 million USDC stolen from Binance was frozen before it could be transferred. Freezing can block thieves, but the funds will be stuck until someone processes them.

There are 27 active validators on-chain. Five operated by Hyper Foundation account for 47% of the stake; the top three combined hold over a third, and if they go offline, they can halt the chain. They all run Hyperliquid's closed-source node software, which is the only implementation and is released as a binary file signed with Hyper Foundation keys.

BTC, ETH, and SOL enter through an independent protocol called Unit, so the spot assets you hold on Hyperliquid are Unit tokens (UBTC, UETH, USOL). Unit holds $940 million across 14 assets, with $690 million in BTC, ETH, and SOL. According to its documentation, three guardians (Unit, Hyperliquid, Infinite Field) control these vaults, and each withdrawal requires two signatures from the three; without them, redemption is impossible. After the Binance incident, Unit added delays to all deposits and withdrawals.

In March 2025, after JELLY was squeezed and Hyperliquid's own liquidity vault was exposed, validators voted to delist that market and settle at self-selected prices. The Arbitrum bridge has been urgently paused multiple times, the most recent being in November 2025; each time it reopened within hours, with no loss of bridge funds.

My judgment: the safety of most USDC depends on Coinbase's custody and the Hyperliquid chain, with Circle's freezing as a safety net; the chain itself relies on a validator set that clearly favors Hyper Foundation, running closed-source software.

Aster: Custody with On-Chain Speed Limits

Aster has about $500 million in its vaults across BNB Chain, Ethereum, Arbitrum, and Solana, of which $100 million is USDF. This does not include $1 billion of ASTER and APX in the BNB Chain vault.

The vault funds are pooled, and ownership records are kept on Aster Chain; this chain is currently only run by Aster's own validators.

Each withdrawal from the EVM vault must be initiated by Aster's operational address and approved by two Aster keys. You will also sign the withdrawal request, but the verified code only compares your signature with the address provided by the Aster key, meaning it can only prove that you initiated the request, not protect the pool.

This poses a custodial risk similar to Binance: if Aster's keys or backend are compromised, funds can be withdrawn from the vault. Each EVM vault has a maximum withdrawal limit per hour, with the latest data as follows:

• BNB Chain: $10 million
• Ethereum: $6 million
• Arbitrum: $3 million
• Solana: $1 million

Users cannot bypass Aster for withdrawals. The verified EVM vault contract code does not include functions for users to initiate withdrawals themselves.

EVM vault upgrades follow a 4/7 multisig and a 24-hour time lock, but the same multisig can instantly change roles and limits; the Solana program can be upgraded instantly with a 3/6 multisig.

The upper limit was triggered multiple times in December 2024, September 2025, and July 2026, leading to a suspension of withdrawals due to exceeding limits; subsequently, the multi-signature increased the limit. In September 2025, an incorrect market pricing of XPL led to traders being liquidated, and Aster compensated within hours. In October 2025, DefiLlama delisted Aster's perpetual contract trading volume due to its high similarity with Binance, while Aster could not provide order-level data. Its predecessor, ApolloX, lost $2 million in its own tokens in 2022 due to a vulnerability.

My judgment: This is essentially still a custodial model. The money is kept in Aster's treasury, and withdrawals must be initiated by Aster's operators, requiring two Aster keys for approval; a user's own signature can only prove "I have withdrawn funds" but cannot protect the pool. The hourly limit on-chain can indeed slow down withdrawals, but it is merely a speed limit, not a permission limit. Moreover, the same set of 4/7 multi-signatures can set limits and instantly change roles or raise limits, meaning the so-called brakes can be released at any time. Ultimately, the safety of the funds depends on how Aster manages those two keys and whether the backend system can hold up.

Variational: Contract Design with Minimal Defense

Variational has $290 million USDC on Arbitrum: $223 million is distributed across 208,000 user settlement pools, with traders and market makers' margins combined; $54 million is in the market maker OLP address; $12 million is in the treasury.

You can deposit money into the pool yourself, but you cannot withdraw it. Each withdrawal is initiated by one of the 17 operational keys, of which 16 are ordinary wallets. Any one of them can transfer USDC from any pool, and the contract has no amount limit.

There is a function that directly sends USDC to the caller's key wallet, allowing a single transaction to process multiple pools; theoretically, a single key can empty all pools in minutes. The administrator is also an ordinary wallet, and actions take effect immediately: adding keys, switching the pool to another oracle contract, or pausing all withdrawals. The documentation states that the OLP treasury is a smart contract, but the listed addresses have no code.

Variational uses Fireblocks for contract deployment and oracle signing, but which keys are covered and what the approval rules are are not disclosed. If these keys have multi-signature thresholds or limits behind them, they cannot be seen on-chain.

Users also have no way to exit without relying on the team. If the backend goes down, withdrawal requests will not be processed; the administrator can also directly pause the oracle, causing the withdrawal process to stall. In both cases, the contract does not have a backup withdrawal entry or a forced exit function, preventing users from bypassing the team to withdraw their funds.

Historically, there have been no reports of hacks, thefts, or withdrawal suspensions. After the Binance incident, Variational claimed that user funds are safe in the on-chain contract and can be withdrawn at any time; both statements are true as long as the backend continues to sign. External backing comes from Circle freezing USDC or intervention from the Arbitrum security committee, both of which have acted after the Binance incident.

My judgment: Looking only at the verified contracts, Variational has the highest risk exposure. Any one of the 17 operational keys can transfer USDC from any user pool, and the contract has no amount limit; losing one key is enough to empty the pool. The only thing that can stop it within the contract is the administrator pausing the oracle or removing keys, but the administrator is also a single wallet, and actions take effect immediately, with no time locks or multi-signature thresholds. This feels more like a post-factum stop-loss rather than a preemptive defense. Like Aster, the safety of the funds ultimately depends on those keys and the backend.

Comparison of Four Platforms

Among the four, only Lighter allows you to exit without relying on the team.

Who is the Safest?

Based on the three questions above and only looking at on-chain verifiable information:

Lighter is the safest by design. Breaching its servers is insufficient to withdraw your balance; if the team disappears, you can still use forced withdrawal and desert mode. However, the operators also set the price, and a bad price may still liquidate you. With 3 votes from a 3/5 multi-signature, plus 4 votes from a 4/7 security committee, a total of 7 votes can change the code without notice; every upgrade has followed this path so far.

Hyperliquid is in the middle. 86% of USDC is in a single Coinbase key wallet, and both Coinbase's key and Hyperliquid's chain can access it, with Circle freezing as a backup.

Aster is on par with Hyperliquid. EVM withdrawals are initiated by Aster's operators and approved by two Aster keys. The hourly limit can slow down withdrawals, but the 4/7 multi-signature can raise the limit at any time.

Variational's contract design is the least defensible. Any one of the 17 operational keys can transfer USDC from any user pool, and the contract has no amount limit. Circle freezing is also a backup.

How to Use This List

Whether DEX or CEX, only keep the money you are currently trading in the exchange.

Before amplifying your funds, do two checks. First, where is the money actually kept: is it locked in an on-chain contract, or lying in a wallet controlled by a team, an exchange custody account, or a cross-chain bridge? If it is a contract, who has the authority to move it, is it a single key, multi-signature, or like Lighter, only released based on ZK proof? Second, can you exit without the team: does the contract have a forced withdrawal, escape route, or time lock, or does every withdrawal require the operator's signature?

Also, do not take the "DEX" label as a guarantee of safety. Perpetual contract DEXs can be decentralized on the front end and have transactions on-chain, but the money may still be controlled by team keys, operational addresses, or multi-signatures; Aster and Variational are examples. The label does not indicate who holds the withdrawal rights; only the contract permissions and exit paths can clarify the issue.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.