Hyperliquid Email Login Security Audit: Phishing Risks and Two-Factor Authentication Gaps

A trader deposits USDC on Hyperliquid, connects a wallet, and begins trading perpetual futures on the platform’s own blockchain. Weeks later, they receive an email asking them to «verify» their account or «confirm» a recent login. The message looks official. The link redirects to a form that accepts their email and password. Within minutes, an unauthorized user has accessed the account, disabled two-factor authentication if one existed, and liquidated open positions by shifting collateral to an attacker’s address. The damage is immediate and irreversible on-chain.

This scenario is not theoretical. Hyperliquid’s support for email-based login and account recovery, combined with the irreversible nature of blockchain transactions, creates a distinct threat surface that differs sharply from traditional finance. Unlike a bank account where unauthorized transactions can sometimes be reversed, a compromised Hyperliquid account grants an attacker direct custody of funds and the ability to execute trades at high leverage. Understanding the specific security mechanisms—and gaps—in email-based authentication is therefore not optional for users who plan to hold balances or maintain active positions on the platform.

Email login as a single point of failure on Hyperliquid

Hyperliquid offers users a choice: connect a non-custodial wallet such as MetaMask or log in directly with email and password. The email option is convenient. It lowers the barrier for users unfamiliar with wallet software and removes the need to manage recovery phrases. However, convenience and security are often inversely related in cryptographic systems, and email login introduces a centralized authentication dependency that a wallet-only system does not have.

When a user logs in via email on Hyperliquid, the platform becomes responsible for storing, validating, and protecting that credential. If an attacker obtains the email password—through phishing, credential stuffing from another breached service, or direct password database compromise—they gain immediate account access without needing the user’s private keys. Because Hyperliquid is a non-custodial exchange where the user controls their own funds through the blockchain, the consequences are severe: the attacker can trade, withdraw, or liquidate positions with no reversal mechanism.

The specific risk vector depends on how account recovery is implemented. If Hyperliquid allows password resets via email confirmation alone, an attacker who controls the user’s email inbox can reset the password without needing the original credential. If the platform does not enforce two-factor authentication or makes it optional, the email account becomes a sufficient key to the trading account. Even if two-factor authentication is offered, a user who has not enabled it, or who enabled it but stored the backup codes insecurely, remains exposed to email compromise.

This architecture differs fundamentally from wallet-based authentication. A wallet such as MetaMask uses locally stored private keys that never leave the user’s device (in its standard configuration). An attacker who gains access to the email account associated with the wallet cannot directly access the private keys; they would need to compromise the device itself or gain access to the recovery phrase. Email login collapses that separation.

Phishing and credential harvesting campaigns targeting email-based traders

Email-based accounts are a natural target for phishing because the attack surface is enormous and the success rate can be high. An attacker can send emails that appear to come from Hyperliquid support, citing recent suspicious login activity, unusual trading patterns, or mandatory account verification. The recipient is asked to click a link and log in. That link points to a fake website that closely mimics the real Hyperliquid login page.

Such attacks succeed at scale because users receive hundreds of emails daily and cannot verify the authenticity of every one. A fake email that says «Your account will be locked in 24 hours unless you verify your identity» creates urgency that overrides skepticism. Even technically sophisticated users can be caught if the fake site is well designed and the email is sent from a domain that appears similar to the real one (for example, using a zero in place of the letter O).

The second phase of the attack is credential exfiltration. The attacker runs a simple web form that accepts an email address and password, displays a generic «verification in progress» message, and logs the credentials to a database. The user, seeing no obvious error, may assume the verification succeeded. By the time they notice funds missing or unexpected positions opened on Hyperliquid, the attacker has had hours or days to liquidate positions and withdraw assets.

A related attack uses email compromise to bypass security questions or recovery processes. If the attacker can reset the password via an email link and the original user does not have email notifications enabled for login changes, the account takeover can be complete before the legitimate owner realizes anything is wrong. On Hyperliquid, this means the attacker gains the ability to trade with full leverage, access any open positions, and move funds through the blockchain without any approval from the original user.

Two-factor authentication gaps and recovery code management

Two-factor authentication (2FA) is a standard defense against credential compromise. If enabled, it requires a second form of verification—typically a time-based one-time password (TOTP) generated by an authenticator app, or an SMS code sent to a phone number—before granting account access. Hyperliquid may offer 2FA, but the practical security depends on implementation details and user behavior.

The first gap is optionality. If 2FA is not mandatory for all users, most will not enable it. Users tend to skip security measures they perceive as inconvenient, and enabling 2FA adds friction to the login process. A platform that makes 2FA optional is relying on user awareness and motivation rather than on technical architecture. For a trading platform where funds can be liquidated at leverage, optional 2FA is insufficient.

The second gap is recovery code management. When a user sets up 2FA, the platform typically provides a set of recovery codes (also called backup codes or one-time use codes). These codes are meant to allow account access if the user loses their authenticator device or uninstalls the app. However, users frequently store recovery codes insecurely: in cloud notes, in email, in messaging apps, or printed on paper kept near the computer. An attacker who obtains both the email password and a recovery code can complete 2FA authentication and gain account access.

The third gap is phone-number-based 2FA, which uses SMS or voice calls. SMS-based one-time passwords can be intercepted or diverted through SIM swapping, a technique where an attacker contacts the user’s mobile carrier, claims to have lost or switched their phone, and requests that the carrier transfer the phone number to a new SIM card controlled by the attacker. Once the attacker has the phone number, SMS-based 2FA codes are rendered useless. If Hyperliquid relies on SMS for 2FA, users face this additional vulnerability.

Risk management on a non-custodial platform without account freezing

Traditional centralized exchanges can freeze accounts suspected of compromise, reverse recent trades, or block withdrawals pending investigation. These mechanisms exist because the exchange holds custody of user funds and can therefore exert direct control. Hyperliquid, being non-custodial, does not have this capability. Once funds are on the blockchain, they are under the control of whoever holds the private key or password to the account. An attacker with account access has the same privileges as the legitimate owner.

This architecture creates a distinct risk profile for on-chain trading compared to custodial platforms. Risk management must therefore focus on account hardening before a compromise occurs, rather than on recovery afterward. The primary controls are strong authentication, email security, and segregation of funds.

For users maintaining significant balances on Hyperliquid, the standard recommendation is to avoid email login altogether if a wallet connection is available. A hardware wallet such as Ledger or Trezor is more resistant to compromise than a software wallet, which is more resistant than email-based authentication. By using a hardware wallet to sign transactions on Hyperliquid, a user ensures that account access requires physical possession of the device, not just a password that can be phished or guessed.

For users who must use email login, the next layer of defense is email account security. This means using a strong, unique password for the email account; enabling two-factor authentication on the email account itself; and ensuring that the email recovery phone number and backup contact information are correct and controlled by the user. If the email account is compromised, all accounts accessed via that email are at risk. Therefore, email security is foundational.

Account security hardening: authentication and monitoring on Hyperliquid

Users who access Hyperliquid via email should implement the following controls. First, enable two-factor authentication if available and use an authenticator app (such as Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS. Store the recovery codes in a secure location that is not on the same device used for trading and not in cloud storage. Memorize the location so that you can retrieve the codes if needed, but do not share them with anyone.

Second, use a unique password for Hyperliquid that is not reused on any other service. If one of those other services is breached and your email-password pair is leaked, attackers will attempt to log into Hyperliquid using the same credentials. A unique password prevents this «credential stuffing» attack. Use a password manager such as Bitwarden, 1Password, or KeePass to generate and store strong passwords securely.

Third, monitor login activity. If Hyperliquid provides an account activity log or login history, review it periodically for unauthorized access attempts. Many platforms allow users to see the IP address, device type, and timestamp of recent logins. An unfamiliar location or device is a warning sign.

Fourth, configure email forwarding and recovery settings carefully. If Hyperliquid allows users to configure an alternate email address for recovery, use a second email account that you control and protect separately. Do not use a recovery email that is easier to compromise than the primary one. If possible, use an email provider that offers strong security features, such as hardware key support or advanced phishing protections.

Fifth, limit the window of exposure by using Hyperliquid actively rather than leaving it as a dormant account. Attackers may test compromised credentials over weeks or months, waiting for a moment when you will not notice unauthorized trades. If you log in regularly, you are more likely to spot suspicious activity quickly. For accounts that will remain unused for extended periods, consider moving funds to a secure wallet offline until you plan to trade again.

On-chain transaction finality and the inability to reverse compromise

A core architectural feature of Hyperliquid is that it operates on its own blockchain, which means transactions are final once confirmed. Unlike traditional databases where an administrator can reverse a transaction, blockchain transactions cannot be undone by the platform. This property is what makes Hyperliquid truly non-custodial—no platform operator has the power to unfreeze accounts or claw back funds.

However, this same property means that if an attacker gains account access and initiates a withdrawal, liquidation, or transfer of collateral, the legitimate owner has no recourse within the platform. The transaction will be recorded permanently on the blockchain. Law enforcement or civil litigation might recover funds in some circumstances, but the process is slow and uncertain. Insurance is not offered by the platform; the user bears the full risk of account compromise.

This is fundamentally different from credit card fraud or bank account compromise, where the victim’s liability is legally limited and the institution bears responsibility for reversal. On Hyperliquid, the security burden is entirely on the user. An attacker who opens a 40x leveraged position in a volatile asset and then liquidates it can wipe out a account’s entire collateral in minutes, with no way to undo the trades.

Risk management therefore must be proactive rather than reactive. A user who suspects their account is compromised should change their password immediately and check for active positions. However, if the attacker has already executed trades, the damage is done. The only true safeguard is preventing account compromise in the first place through strong authentication, email security, and judicious use of funds on the platform.

Regulatory context and the user’s responsibility for account security

Perpetual futures trading on any platform, including Hyperliquid, is subject to varying regulatory frameworks depending on the user’s jurisdiction. The CFTC in the United States regulates derivatives and futures contracts, though the treatment of decentralized derivatives platforms remains unsettled. The FCA in the UK has issued guidance on crypto derivatives, including restrictions on leverage products sold to retail users. Ontario’s OSC regulates crypto derivatives in that jurisdiction. These regulatory bodies generally place responsibility for account security on the user or platform operator, not on regulators themselves.

Hyperliquid restricts access in the United States, Ontario, and sanctioned jurisdictions, partly to mitigate regulatory risk. Users outside these jurisdictions who access the platform do so at their own risk and should be aware that regulatory protections that exist in traditional finance may not apply to decentralized exchanges. If a user’s account is compromised, regulators are unlikely to compel recovery or compensation.

The fundamental security principle underlying this regulatory environment is that users of non-custodial platforms are responsible for their own account security. No platform operator can protect you from phishing if you enter your credentials into a fake website. No two-factor authentication system protects you if you store recovery codes in an email inbox. No leverage limit protects you from liquidation if an attacker executes trades on your behalf. The regulatory framework acknowledges this reality by holding users accountable for their access controls.

Practical steps to audit your Hyperliquid security posture

Users should conduct a security audit of their Hyperliquid account quarterly or whenever they change devices, email providers, or authentication methods. Start by verifying your login method: if you use email, confirm that your email password is unique and strong. Check the recovery email and phone number on file to ensure they are current and under your control.

Next, verify two-factor authentication status. If 2FA is enabled, confirm that your authenticator app is backed up (if the platform or your authenticator app supports backup) and that your recovery codes are stored securely. If 2FA is not enabled, enable it immediately. Review the settings to ensure SMS is not the only option available; prefer authenticator apps.

Then, review your account activity log if Hyperliquid provides one. Look for login attempts from unfamiliar locations or devices. If you see unauthorized access attempts, change your password immediately and enable stricter account recovery controls if available.

Finally, assess your balance and position risk. If you maintain a large balance on Hyperliquid and use email login, consider moving most of the balance to a hardware wallet that you control directly, keeping only the amount needed for active trading on the platform. This reduces the damage from a potential compromise to the trading balance rather than your entire holdings.

Comparing wallet-based and email-based security models

The security difference between connecting a wallet and using email login can be illustrated by examining the threat model for each. When you connect a wallet to Hyperliquid, the platform never has your private keys. Your device stores the key, and you approve transactions using the wallet’s UI. An attacker who compromises your email account cannot access your wallet because the wallet is not authenticated via email.

When you use email login on Hyperliquid, the platform’s authentication system becomes a critical component of your security. If that system is compromised or if you are phished, the attacker needs only the email password. They do not need to compromise your email provider or device. This asymmetry makes email login inherently riskier for a platform where transactions are final and irreversible.

For regulatory and accessibility reasons, platforms such as hyperliquid offer email login to users who may not have wallet experience. This is a pragmatic trade-off; excluding users who lack wallet knowledge would limit the platform’s reach. However, users should understand that email login trades convenience for security. If you choose email login, you must compensate by hardening email security, enabling two-factor authentication, and limiting balances on the platform.

A hybrid approach is possible: maintain most of your balance in a hardware wallet, connect that wallet to Hyperliquid for trading, and use email login only for viewing positions or accessing customer support. This segregation ensures that compromised email credentials cannot liquidate your main holdings.