Blockaid Expands Onchain Monitoring Support for Hyperliquid's HyperCore

Executive Summary

Hyperliquid has grown into one of the most active trading venues in crypto, with $2.95 trillion in cumulative trading volume, $844 million in revenue, and over 609,000 new users added in 2025 alone. It accounts for over 70% of on-chain perpetual futures volume and processes around 200,000 orders per second on HyperCore, its custom L1. Few decentralized perpetual exchanges are operating anywhere near that scale.

Hyperliquid is built around two execution environments that run under the same consensus. HyperEVM is an Ethereum-compatible layer where developers deploy Solidity contracts. HyperCore is the trading engine that runs alongside it, a custom Rust-built state machine that handles every order, position, spot transfer, and vault deposit directly at the protocol level. There are no smart contracts in HyperCore, no event logs, and no call traces. Every state change is expressed as an EIP-712 signed action, a structured typed message that validators read directly to authenticate and execute each operation. Every operation on HyperCore, whether placing an order, transferring funds, or depositing into a vault, flows through signed EIP-712 actions rather than contract calls.

That architecture makes HyperCore fast and purpose-built for high-throughput trading. It also means that standard monitoring tools, which are built to read contract calls, emitted events, and transaction traces, cannot parse HyperCore activity. For protocols, trading firms, and asset managers operating on Hyperliquid and needing real-time visibility into HyperCore activity, native monitoring support has been a priority. With this release, those teams can now monitor HyperCore activity in real time, set alerts on the actions that matter, and respond to incidents as they happen on the trading layer.

What has existed: How Blockaid supports the Hyperliquid ecosystem

Blockaid provides support to customers and partners whose platforms and users interact with the Hyperliquid ecosystem, delivering always-on, real-time coverage across four areas:

• End User Protection: Real-time scanning of transactions, tokens, dApps, and addresses on HyperEVM, giving teams the intelligence to surface risk before a transaction is signed and prevent exposure to malicious assets, protocols, and transactions.
• Onchain Monitoring: Visibility into onchain activity on HyperEVM across assets and contracts, with alerting when behavior falls outside expected bounds, enabling trading firms and asset managers to enforce policies that protect their infrastructure and assets.
• Security Modules: Active enforcement via Cosigner on HyperEVM through Multisig and MPC custody providers, allowing teams to intervene directly in live transactions to enforce policy and reduce the risk of risky or unauthorized fund movement.
• Risk Exposure: Counterparty screening for HyperCore and HyperEVM addresses, helping trading firms and asset managers assess the risk profile of wallets and positions before transacting.

Until this release, HyperCore has been mostly outside Blockaid's onchain monitoring coverage, because it has no smart contracts, traces, or event logs, standard monitoring primitives do not apply. 

Learn more about Blockaid's Chain Support →

What's new: Blockaid expands Onchain Monitoring support for Hyperliquid's HyperCore

As Hyperliquid grows and HyperCore handles an increasing share of on-chain trading activity, protocols, trading firms, and asset managers operating on it need the ability to monitor what is happening at the trading layer. This release delivers native onchain monitoring support for HyperCore.

HyperCore activity is now ingested natively as EIP-712 actions, the signed typed-data messages that represent every state change on the chain, including spot transfers, order placement, vault deposits, and perp trading. Because HyperCore has no contracts, traces, or event logs, these actions are the only meaningful activity surface that exists on the chain. 

Blockaid has built a dedicated ingestion pipeline that reads these actions natively and evaluates them against the same monitor-rule primitives used across EVM and SVM monitoring. Teams can set monitors that trigger on specific HyperCore action types and parameters, the same way they would configure a Function Call monitor on EVM or an Instruction monitor on Solana. This is a pipeline built specifically for how HyperCore works, not an EVM adapter running on top of it.

See the full release notes →

Looking ahead: Continuously scaling onchain security for Hyperliquid

Hyperliquid's growth has brought a broader range of participants to the ecosystem, including asset managers, and trading firms that need real-time visibility into what is happening at the trading layer to operate with confidence. As traditional finance continues to move into onchain markets, these participants are operating at speed and expect their security infrastructure to keep pace, both in terms of execution and monitoring. As HyperCore activity continues to expand, the monitoring coverage underneath it will expand with it.

Blockaid evolves alongside the chains it supports, building detection and monitoring capabilities specific to how each execution environment works. With native HyperCore monitoring now live, trading firms and asset managers operating on Hyperliquid have the real-time visibility they need to monitor positions, detect anomalies, and respond to incidents at the trading layer. As more institutional participants onboard to perpetual DEXs like Hyperliquid, Blockaid will continue expanding coverage to meet the security and operational requirements they bring with them.

About Blockaid

Blockaid is the onchain security platform trusted by the largest companies operating in Web3. Built by veterans of elite intelligence and cybersecurity units, Blockaid provides end-to-end protection for financial institutions, protocols, and end users, combining direct wallet and dApp integrations with real-time monitoring, detection, and response across smart contracts, infrastructure, and externally owned accounts. Since 2025, Blockaid scanned over 6.3 billion transactions and blocked 585 million attacks. Blockaid is the security infrastructure behind Coinbase, MetaMask, Uniswap, Safe, and dozens of the most widely used platforms in the industry.

Learn more at blockaid.io, and follow us on Twitter and LinkedIn.