After Binance's $6.3 billion hack, are these four Perp DEXs safe enough?

Written by: 0xJaehaerys

Edited by: AididiaoJP, Foresight News

On October 29, $6.3 billion was drained from Binance’s hot wallets. According to Binance, a DevOps engineer’s laptop was compromised, allowing attackers into internal services from which withdrawals were made; there are no signs of a private key leak.

In other words, the attackers likely didn’t need a private key at all, instead getting Binance’s own systems to sign the withdrawals. Binance later uncovered additional attack vectors, though a full forensic report is still pending. $3 billion has been frozen, and Binance has pledged to cover the losses.

On Ethereum, TRM reported that the attackers had Binance’s signing system approve an EIP-7702 delegation, handing over control of a hot wallet to an attacker contract. Researchers believe the signing system blocks a blacklist of “known bad actions” rather than a whitelist of only “known good actions,” allowing this newer authorization method to slip through. Binance has not confirmed this detail, nor can it explain the losses on Bitcoin, Solana, and Tron.

A month earlier, Bitget lost over $350 million in a similar fashion: attackers breached a backend system used to feed transaction data to its signers, allowing withdrawals to exit with valid signatures.

If an exchange’s systems have the ability to move your funds, breaching their systems is all it takes. Perpetual DEXs have long claimed to avoid these risks by design. I picked four platforms to analyze the same three questions: Where are the funds actually held? Who can move them? And if the team disappears or gets hacked, can you still withdraw?

Answers are drawn from on-chain data, verified smart contract code, team documentation and posts, as well as @l2beat; event histories reference public reports. This is neither an audit nor a vulnerability hunt. I examine only one scenario: if the team’s systems and keys were compromised like Binance’s, what could attackers do with them, and could you still recover your funds?

I am not saying these protocols are vulnerable or will be hacked. Off-chain protections such as MPC wallets, signing policies, and monitoring are not visible externally and may make these scenarios much less likely. Therefore, the following describes what the contracts allow, not predictions.

Lighter: Servers Compromised Cannot Touch Your Balance

Lighter holds approximately $1 billion in Ethereum contracts: $556 million in USDC, $430 million in LIT (151 million tokens), plus some ETH and fragmented assets.

During normal operations, funds can only leave via batches validated by the contract using ZK proofs. Standard withdrawals can only go to the account owner’s wallet, which is fixed upon the first deposit. Faster withdrawals and transfers to other accounts also require your wallet’s signature. Therefore, whoever controls Lighter’s sequencer, prover, or verifier keys cannot unilaterally withdraw the balance.

You don’t have to wait for them either. Initiate a forced withdrawal directly on Ethereum; if Lighter doesn’t process it within 14 days, anyone can switch the contract to “Desert Mode.” Upgrades stop, and everyone exits using ZK balance proofs based on existing Ethereum data.

Yet it is not fully trustless.

Prices rely on index and mark prices provided by the Lighter operator, and proofs do not verify oracle signatures. Pricing errors could lead to unfair liquidations, a risk also flagged by L2Beat.

Additionally, there are two guardian keys that can pause batch processing and withdrawals. One can halt operations for up to 24 hours at a time, the other for up to 72 hours, with a cooling-off period required between each use. However, neither can prevent “Desert Mode”: as long as no one processes the 14-day forced withdrawal, the contract can still transition to a full-exit state.

Upgrades follow a different process. Normally, a 3/5 multisig must publicly notify changes on Ethereum 21 days in advance, giving users time to review what changed. But if another 4/7 security committee also signs off, the 21-day notice can be completely bypassed, and upgrades take effect immediately. To date, every Lighter upgrade has taken this fast track. In October alone, proof verifiers were swapped five times. Proof verifiers are contract components that validate ZK withdrawal proofs; their frequent replacement means that “how quickly code can be altered” is not merely a theoretical risk.

Historically, downtime lasted about 4.5 hours during the crash on October 10, 2025. Withdrawal delays emerged after LIT’s launch at the end of December 2025. On October 17, 2026, a 2-hour guardian pause occurred, which L2Beat treated as a test. On October 20 and October 29, status updates were interrupted for about 4.5 hours each, both ending after fast-track verifier upgrades. No public reports indicate custodial funds were compromised.

My assessment: Among the four, only Lighter can withstand a Binance-style server compromise—attackers breach the servers but cannot unilaterally drain balances relying solely on them. The trade-off is that pricing is controlled by the operator, and multisig-controlled code changes can happen quickly. What you truly need to trust are these two things.

Hyperliquid: Majority of USDC Locked in Coinbase Single-Key Wallet and Native Chain

Hyperliquid backs $6.5 billion in USDC across three locations.

Approximately $5.6 billion, accounting for 86%, in the USDC reserve wallet under Coinbase’s name on HyperEVM;

Approximately $622 million, accounting for 10%, in Circle’s CoreDepositWallet contract;

Approximately $290 million, accounting for 4.4%, remaining in the older Arbitrum bridge.

That Coinbase wallet is a standard address with a single private key. Meaning whether 86% of the USDC is secure entirely depends on how Coinbase safeguards that key, which is invisible on-chain. The Hyperliquid chain can also bypass Coinbase’s private key, using non-signed system transactions to shuttle USDC back and forth between the Coinbase wallet and Circle’s contract, keeping balances roughly at a 9:1 ratio—meaning USDC in the Coinbase wallet is about nine times that in Circle’s contract.

For this role, Coinbase staked 506,000 HYPE, worth about $46 million. This stake is only slashed if the wallet fails to pay the protocol’s revenue share, representing less than 1% of the balance, offering little endorsement of the wallet itself.

The Circle contract is upgradable with a single admin address; the Hyperliquid chain can also transfer USDC out directly. On the Arbitrum bridge, a disbursement requires signatures from 3 of 4 validators, with a 200-second window to intercept before release.

The ultimate safety net is Circle. It can freeze native USDC; the $823 million USDC stolen from Binance was frozen before it could be moved. Freezes can stop thieves, but funds will be locked until someone intervenes.

There are 27 active validators on-chain. The 5 run by Hyper Foundation account for 47% of the stake; the top three combined exceed one-third, meaning any could stall the chain if offline. They all run Hyperliquid’s closed-source node software, implemented exclusively as a binary file signed by Hyper Foundation keys.

BTC, ETH, and SOL enter via the independent protocol Unit, so your spot holdings on Hyperliquid are actually Unit tokens (UBTC, UETH, USOL). Unit holds $940 million across 14 assets, including $690 million in BTC, ETH, and SOL. According to its documentation, three guardians (Unit, Hyperliquid, Infinite Field) control these vaults, requiring two-of-three signatures for every withdrawal, making redemption impossible without them. Following the Binance incident, Unit added delays to all deposits and withdrawals.

In March 2025, after JELLY faced a squeeze and Hyperliquid’s native liquidity vaults were exposed, validators voted to delist the market and settle at custom prices. The Arbitrum bridge was repeatedly paused emergency-style, most recently in November 2025; each time it reopened within hours with no bridge fund losses.

My assessment: The security of most USDC relies solely on Coinbase custody and the Hyperliquid chain, with Circle freezes serving as a last resort; the chain itself depends on a validator set heavily skewed toward Hyper Foundation, running closed-source software.

Aster: Custody with On-Chain Speed Limits

Aster holds approximately $500 million in BNB Chain, Ethereum, Arbitrum, and Solana vaults, of which $100 million is USDF. This excludes $100 million in ASTER and APX within the BNB Chain vault.

Vault funds are pooled, with ownership recorded on the Aster Chain; currently, this chain is operated solely by Aster’s own validators.

Every withdrawal from EVM vaults must be initiated by an Aster operational address and approved by two Aster keys. You also sign withdrawal requests, but verified code only matches your signature against addresses provided by the Aster keys, meaning it can only prove you initiated a request, not protect the pool.

This poses the same type of custody risk as Binance: if Aster’s keys or backend are compromised, funds can leave the vaults. Each EVM vault has an hourly withdrawal cap: $30 million for BNB Chain and Ethereum, $20 million for Arbitrum; once reached, the vault pauses.

Users also cannot bypass Aster to withdraw independently. Verified EVM vault contract code lacks functions for users to initiate withdrawals themselves.

EVM vault upgrades use a 4/7 multisig with a 6-hour timelock, but the same multisig can instantly change roles and limits; Solana programs are upgraded instantly by a 3/6 multisig.

These caps were triggered multiple times in December 2024, September 2025, and July 2026, causing vault pauses due to exceeded withdrawal limits; afterward, multisigs raised the caps. In September 2025, a pricing error on the XPL market led to trader liquidations, which Aster compensated within hours. In October 2025, DefiLlama removed Aster’s perpetual DEX volume because it was too similar to Binance’s, and Aster couldn’t provide order-level data. Its predecessor, ApolloX, lost $2 million in self-owned tokens due to a vulnerability in 2022.

My assessment: This remains fundamentally a custody model. Funds sit in Aster’s vaults, withdrawals must be initiated by the operator and co-signed by two Aster keys; user signatures only prove “I requested a withdrawal,” failing to protect the pool. On-chain hourly limits do slow down drains, but they’re speed restrictions, not permission boundaries. Moreover, the same 4/7 multisig that sets limits can instantly alter roles and raise caps, meaning the brakes can be released at any moment. Ultimately, fund security hinges on how Aster safeguards those two keys and defends its backend systems.

Variational: Most Exposed Contract Design

Variational holds $290 million in USDC on Arbitrum: $223 million distributed across 208,000 user settlement pools, where trader and maker margins are commingled; $54 million in maker OLP addresses; and $12 million in the treasury.

You can deposit into pools yourself, but not withdraw. Every withdrawal is initiated by one of 17 operational keys, 16 of which are standard wallets. Any single key can transfer USDC out of any pool, with no contractual amount limits.

One function sends USDC directly to the caller’s key wallet, processing multiple pools in a single transaction; theoretically, a single key could drain all pools within minutes. The admin address is also a standard wallet, with instant-effect actions: adding keys, switching pools to different oracle contracts, or pausing all withdrawals. Documentation claims OLP vaults are smart contracts, but listed addresses contain no code.

Variational uses Fireblocks for contract deployments and oracle signatures, but does not disclose which keys are covered or the approval rules. If these keys involve multisig thresholds or limits, they are invisible on-chain.

Users likewise have no way to exit without the team. Once the backend halts, withdrawal requests go unprocessed; admins can also directly pause oracles, stalling withdrawal flows. In either case, the contract contains no backup withdrawal entry or forced exit function, preventing users from withdrawing funds independently.

Historically, there are no reports of hacks, thefts, or withdrawal pauses. Following the Binance incident, Variational stated user funds are safe in on-chain contracts and can be withdrawn anytime; both statements hold true as long as the backend keeps signing. External safety nets include Circle freezing USDC or the Arbitrum security committee intervening, both of which acted after the Binance event.

My assessment: Looking strictly at verified contracts, Variational has the widest risk exposure. Any of the 17 operational keys can drain USDC from any user pool, with no amount limits; losing one key is enough to empty pools. The only intra-contract brake is an admin pausing oracles or removing keys, but the admin itself is a single wallet with instant effects, no timelock, and no multisig threshold. This resembles post-event damage control, not a pre-established defense. Like Aster, fund security ultimately depends on those keys and the backend.

Cross-Comparison of the Four Platforms

Of the four, only Lighter allows you to exit without relying on the team.

Which Is Safest?

Based on the three questions above, and looking only at verifiable on-chain data:

Lighter is the safest by design. Breaching its servers isn’t enough to drain your balance; if the team vanishes, you can still use forced withdrawals and Desert Mode. However, the operator sets prices, and flawed pricing could still liquidate you. Just 3 votes from the 3/5 multisig, combined with 4 from the 4/7 security committee, totaling 7, can alter code without notice; every upgrade so far has taken this path.

Hyperliquid sits in the middle. 86% of its USDC is in a single-key Coinbase wallet, accessible by both Coinbase’s keys and the Hyperliquid chain, with Circle freezes as a backup.

Aster aligns with Hyperliquid. EVM withdrawals are initiated by Aster operators and co-signed by two Aster keys. Hourly caps slow down drains, but the 4/7 multisig can raise limits at any time.

Variational’s contract design is the most exposed. Any of its 17 operational keys can transfer USDC from any user pool, with no contractual amount limits. Circle freezes serve the same backup function.

How to Use This Checklist

Whether DEX or CEX, only place funds you are actively trading in exchange platforms.

Before moving significant funds, perform two checks. First, where are the funds actually located: locked in an on-chain contract, or resting in a team-controlled wallet, exchange custodial account, or cross-chain bridge? If in a contract, who has permission to move it—is it a single key, multisig, or restricted to ZK-proof validations like Lighter? Second, can you exit without the team: does the contract contain forced withdrawals, escape hatches, or timelocks, or must every withdrawal await operator signatures?

Don’t treat the “DEX” label as a safety guarantee. Perpetual DEXs can offer decentralized frontends and on-chain trades, but funds may still be controlled by team keys, operational addresses, or multisigs; Aster and Variational are prime examples. Labels don’t reveal who holds withdrawal power; only contract permissions and exit paths tell the real story.