Hyperliquid Account Recovery After Email Compromise: Steps to Regain Control Without KYC

A trader wakes to discover that a compromised email account has granted an attacker access to their Hyperliquid trading account. Positions may be open, balances may have shifted, and recovery feels urgent. Unlike traditional custodial exchanges where account freezes happen server-side and customer support can reverse transactions, Hyperliquid operates on its own blockchain with non-custodial asset control. Recovery therefore depends on understanding which assets remain under the user’s cryptographic control, which actions an attacker could realistically take, and how quickly the account owner can regain exclusive access before liquidation or unauthorized withdrawals occur.

The immediate instinct is often to contact support, but Hyperliquid’s architecture means that no single entity can reverse a blockchain transaction or instantly seize assets held in the user’s wallet. Instead, recovery requires the account owner to act directly: secure the email account, change the password within Hyperliquid, reconnect a wallet with known private keys, and verify the current state of all positions and balances. This sequence matters. A trader who reconnects an unknown wallet or does not verify which account they are logged into could inadvertently grant the attacker deeper control or transfer assets to the wrong destination.

Why email compromise matters differently on a decentralized exchange

Hyperliquid allows users to log in via email without any KYC requirement, which removes a friction point but also concentrates access through one authentication channel. If an attacker gains control of that email address—through a phishing attack, password reuse, or a breach at a third-party email provider—they can access the trading account, open new positions, modify settings, and potentially withdraw funds if the wallet connection remains unchanged.

The non-custodial nature of Hyperliquid means that the platform itself does not hold user assets in a corporate wallet. Instead, funds exist on the Hyperliquid L1 blockchain under the control of the user’s connected wallet address. If the wallet connection is still valid, an attacker with email access can use that existing connection to trade and withdraw, but they cannot create a new Hyperliquid account and steal the funds outright. The assets remain tied to the wallet address, not to the email account alone. However, an attacker with both the email account and knowledge of the wallet’s private keys could move the funds entirely off the exchange.

This distinction shapes the recovery priority. The first step is not to panic and create a new wallet; it is to secure the email account itself, understand what wallet is currently connected, and determine whether the attacker has had time to export those private keys. If the wallet connection is compromised, the entire balance becomes exposed. If only the email account is compromised, the attacker can trade but cannot withdraw without the private key.

Immediate response: Email account recovery and password reset

Begin by regaining control of the email account. Check the recovery phone number and backup email addresses associated with the account; an attacker may have added their own recovery options. Review recent login activity, connected applications, and forwarding rules. Many email providers maintain a security log that shows geographic locations and device fingerprints. If the email provider (Gmail, Outlook, Proton Mail, etc.) supports it, sign out all active sessions and change the password from a known-good device.

Once the email account is secure, log into Hyperliquid using that same email address. This action is critical because it establishes which wallet is currently connected to the account and allows the account owner to change the Hyperliquid password before the attacker realizes the email is no longer compromised. Many attackers will have changed the trading password if they suspected the email recovery might be attempted; if you still can log in without being prompted to reset it, the attacker may not have discovered the account yet, or they were focused on open positions rather than account settings.

Change the Hyperliquid password to something complex and unique, stored in a password manager rather than written down or reused from other accounts. This step alone does not prevent an attacker from resetting the password via email if they regain access to the email account, so parallel email security is essential. Enable any multi-factor authentication or additional login restrictions offered by the platform. Some email providers offer security keys or app-based authentication; using these on the email account adds a barrier that a phishing attack or email compromise cannot bypass alone.

Verifying wallet connection and assessing active positions

After logging back into Hyperliquid, check which wallet address is connected. This appears in the account settings or profile section. If this address matches a wallet you control and have backed up securely offline, the account is recoverable. If it matches an unfamiliar address or an address you previously controlled but no longer have private keys for, the situation is more serious: the attacker may be about to move funds or has already done so.

Review all open positions immediately. On Hyperliquid, perpetual futures positions are held on-chain and visible in real-time. Check the margin mode (cross or isolated), leverage level, and entry prices. An attacker may have opened large, highly leveraged positions that are close to liquidation, expecting to pocket the difference if liquidation occurs or to force you to scramble and make poor decisions under time pressure. Similarly, verify that all active orders match positions you recognize. If there are orders you did not place, cancel them immediately. Open orders can execute without warning if market conditions move.

Spot balances also require verification. Hyperliquid accepts USDC deposits on Arbitrum and other chains with a 5 USDC minimum. If your account holds USDC or other spot assets, check whether they remain in full. An attacker might have withdrawn some balances to an address they control, sold positions to create liquidity for a withdrawal, or left them untouched if they were focused on leveraged positions. Document the current balance in screenshots; if a liquidation or withdrawal occurs in the next few minutes, this record helps clarify the timing.

Disconnecting and reconnecting the wallet securely

If the currently connected wallet is one you control and have verified offline (for instance, a hardware wallet or a mnemonic phrase stored in a safe), you can leave it connected while monitoring positions closely. If the wallet is one that you accessed only through a browser extension, a mobile app, or a desktop application, and you cannot verify the private keys, you should disconnect it and reconnect a wallet you are absolutely certain is secure.

Disconnect the current wallet from Hyperliquid by using the account settings disconnect option. This terminates the authorization between the email account and the wallet address. However, this action does not move the funds themselves; the USDC and other assets remain on the Hyperliquid L1 blockchain at the wallet address, simply no longer controlled through that Hyperliquid login.

To reconnect and regain control, use a wallet application that you trust completely. If you have a hardware wallet such as Ledger or Trezor, connect it to a clean computer and import or restore it from your verified backup seed phrase. If you have a fresh software wallet or a mnemonic phrase stored offline, import it into a standard Ethereum-compatible wallet application. Then, on Hyperliquid, initiate a new wallet connection (e.g., via WalletConnect or a browser extension) and sign the connection message with the private key under your control.

This reconnection is a cryptographic proof that you own the wallet address and can authorize transactions from it. Once reconnected, your email login on Hyperliquid is now paired with a wallet you control, and only you can sign transactions or authorize withdrawals. An attacker with access to the email account can no longer trade or move funds without also having the wallet’s private keys.

Risk management and preventing liquidation during recovery

While regaining account control, any open positions are at risk of liquidation if market conditions move against them. The base tier fees on Hyperliquid are 0.045% taker and 0.015% maker for perpetuals, with up to 40x leverage available on select assets. If an attacker opened a highly leveraged position before your recovery, the liquidation price may be very close to the current market price. Even a small adverse move can trigger a loss of the entire margin.

Review the liquidation price for each open position and calculate the distance to current price. If the margin is very thin, consider closing the position immediately, even at a loss, rather than risking liquidation while you are still stabilizing the account. The HLP (Hyperliquid Liquidity Provider) backstop is designed to manage liquidations fairly, but liquidation fees and slippage can still be substantial. A controlled close on your own terms is typically preferable to a forced liquidation.

If you recognize a position opened by the attacker—such as one that matches recent trades you can see in the history but do not recall placing, or one in an asset you would never trade—close it immediately. Do not attempt to trade your way out of it or wait for the price to recover. The attacker’s goal may have been precisely to tie up your attention and margin while they extracted value elsewhere.

Withdrawal and bridge security after account recovery

Once the account is secured and all positions are verified, you may wish to withdraw your funds to a wallet entirely under your control or to a different custodial service. Hyperliquid operates on its own blockchain and accepts deposits via bridges from Arbitrum, Ethereum, and other chains. Withdrawals follow the reverse path: USDC or other assets exit the Hyperliquid L1 blockchain to the source chain.

Bridge security is an important consideration. The technology that allows assets to move between Hyperliquid L1 and external chains like Arbitrum can be a vector for theft if the bridge is compromised or if you are tricked into sending to the wrong address. Verify the withdrawal destination address carefully. If you are bridging USDC to Arbitrum, confirm that the receiving address is one you control on Arbitrum, not an address that a phishing email or fake website suggested. Scammers often use domain names very similar to Hyperliquid’s official domain to trick users into sending to the attacker’s address.

The regulatory context also affects withdrawal options. Hyperliquid restricts access in the United States, Ontario, and sanctioned jurisdictions. The hyperliquid platform’s architectural design allows non-custodial trading without KYC, but withdrawal compliance still depends on which chain the funds are exiting to and any on-ramp or off-ramp service you use afterward. If your jurisdiction has restrictions on derivatives trading or asset movement, verify that your withdrawal path complies before executing it.

Ongoing security practices to prevent recurrence

After recovery, implement security measures to prevent a similar incident. Use a password manager to create and store unique, complex passwords for every service. Never reuse a password across email, cryptocurrency, trading platforms, or other accounts. This practice ensures that a breach at one service does not compromise all of them.

Enable multi-factor authentication wherever available. For email, use a security key (hardware-based) or an authenticator app (TOTP) rather than SMS-based codes, which can be intercepted or hijacked through sim-swapping. For Hyperliquid, if the platform supports additional authentication methods or IP whitelisting, enable those as well. Some DEXs allow users to add a trusted device list or a trading pause feature; check whether these options exist and fit your workflow.

For larger balances or frequent trading, consider using a hardware wallet exclusively and avoid keeping private keys on internet-connected devices. A hardware wallet can be connected to Hyperliquid via WalletConnect or a browser extension for trading, but the actual private key never leaves the device. This means that even if your computer is compromised, the attacker cannot export the key or sign unauthorized transactions without physical access to the hardware device.

Finally, maintain an offline backup of your wallet’s recovery phrase in a secure location such as a safe deposit box, a home safe, or a private vault service. This backup should be encrypted if stored digitally, and it should never be photographed, written in a cloud note, or stored anywhere an attacker might find it. The recovery phrase is the ultimate key to your funds; protecting it is the most important security measure.

Reporting the incident and documenting evidence

After you have regained control and secured your account, document the incident. Record screenshots of the timeline (when you first noticed the compromise, what actions appear in the login history, what positions were opened), any transactions that appear unauthorized, and the current state of your account. This documentation helps if you later discover that funds were moved during the compromise window and need to trace them on the blockchain.

Contact Hyperliquid support with this information, even though they cannot reverse transactions. They may be able to log the incident, check for patterns of other compromised accounts, and provide guidance on whether the breach was isolated or part of a larger attack. They may also help clarify whether certain transactions originated from inside or outside the platform.

If the compromise involved a phishing email or a fake website, report it to your email provider and to relevant authorities. The CFTC regulates derivatives trading in the US and may have a mechanism for reporting fraud or platform abuse. Regulatory bodies such as the FCA in the UK also maintain fraud reporting channels. Your report may not recover your specific funds, but it contributes to patterns that regulators and platforms use to improve security across the ecosystem.