The word that stopped me was "trap."
Not "concern." Not "uncertainty." Not the usual regulatory throat-clearing that pads every comment letter ever filed in Washington. Trap. Hyperliquid โ the on-chain perpetuals venue that a large share of the traders I know use and almost none of them will name in a public group chat โ has told the Securities and Exchange Commission that its proposed crypto framework contains "critical flaws," and that those flaws would "trap Web3 developers." Then it asked for five immediate fixes.
Here is what should bother you, and it should bother you in a very specific place. I have read the coverage of this letter more times than I care to admit, and I still cannot tell you what the five fixes actually are. Neither, it seems, can most of the outlets that reported on it. We have a posture, a count, and a mood. We do not have the substance.
That gap matters more than the headline. In a rulemaking proceeding, the substance is the proceeding. So the honest move is to separate what is documented from what I am inferring, and then explain why the inference still earns your attention.
Let me build the stage, because the stage is where the real argument lives.
In the American administrative state, a proposed rule enters a period of notice-and-comment. Anyone โ a bank, a trade association, a person with a grievance and a stamp โ can file a comment letter. The agency is obliged to read them and to respond, in aggregate, to the significant ones. What the agency is not obliged to do is agree. A comment letter has no legal force. It does not register you, exempt you, or protect you. It is a formal act of persuasion, and its success rate is best described as "occasionally, at the margins, over years."
Which is exactly why the fact that Hyperliquid filed one is more interesting than anything the letter probably says.
Hyperliquid, in one breath: a purpose-built layer 1 with its own consensus, a fully on-chain central limit order book for perpetual futures, and an EVM execution environment โ HyperEVM โ layered on top so that other developers can deploy onto it. Sub-second finality. No off-chain matching engine. No sequencer quietly reordering your fills in a Frankfurt data centre. Everything the venue does, it does in the open, with the order book itself as public state.
I audited over 150 Uniswap V2 liquidity pools during the DeFi summer of 2020, and I can tell you that "in the open" is not a marketing phrase. It is an engineering constraint with teeth. When your matching logic is public state, every edge case in that logic is public too. You cannot patch a slippage bug quietly at 3 a.m. and hope nobody noticed.
But the thing that makes Hyperliquid structurally distinct from nearly every venue it competes with is not speed. It is permissionlessness at the listing layer.
HIP-1 and HIP-2 let anyone auction a spot market into existence. HIP-3 lets builders deploy their own perpetual contracts on top of the venue's liquidity. Nobody approves the market. Nobody vets the asset. Nobody can decide, on a Tuesday, that a particular ticker is too politically inconvenient to list.
Now hold that thought against the shape of almost every crypto regulatory proposal drafted since 2022.
The token structure matters here, and it matters for a reason that has nothing to do with price. Hyperliquid has no venture round โ no private allocation, no exchange quota, no strategic investor holding a cliff that forces somebody's hand at a fixed date. Supply is capped. Roughly 31 percent went to the community at launch, around 38.9 percent remains earmarked for future emissions and rewards, about 23.8 percent sits with the foundation and ecosystem budget, and roughly 6 percent is set aside for the team. Fees come from actual trading โ taker and maker on perpetuals โ not from a subsidy engine paying people to pretend to provide liquidity.
Check those figures against the official documentation; the decimals move. The structural point does not: no investor is leaning on this team to get compliant fast and pump the valuation.
Any regulatory design that requires identity verification inside the protocol layer, or contracts that can be frozen, or markets that must be pre-approved before they exist, does not inconvenience Hyperliquid. It deletes the product.
That is the whole letter, compressed. Everything else is footnote.
The venue's differentiation is not that it is faster than dYdX v4 or simpler than GMX. It is that it removed the human from the listing decision, the human from the matching decision, and โ this is the part that keeps regulators awake โ the human from the compliance decision. โ Root: the architecture itself is the compliance argument. Not the legal entity. Not the foundation's jurisdiction of convenience. The code.
When you tell a system like that to embed a broker-dealer, you are not asking it to add a feature. You are asking it to stop being itself.
Which brings us to the phrase that actually carries the argument: "trap Web3 developers."
Read that carefully, because it is not a complaint about difficulty. It is a complaint about where liability lands.
Under the securities laws, broker-dealers and exchanges carry registration, recordkeeping, reporting, and suitability obligations. Those obligations were written for firms โ entities with employees, compliance departments, and something to lose. The open question of this entire rulemaking cycle is whether those obligations can be attached to software, and to the people who write it, when nobody custodies anything and nobody can unilaterally change the rules of the market.
In practice, that is a demand to make code into a compliance officer. A piece of software that identifies its users, files its reports, and can be ordered to freeze a position. For a protocol with no admin key and no operating company, that is not a heavy lift. It is an impossibility.
So what are the five? I will be direct with you: I do not know, and anyone who tells you they do is extrapolating. What I can do is read the shape of the business and tell you what they almost certainly have to cover โ an explicit statement that non-custodial software developers are not broker-dealers or exchanges; a safe harbour or exemption for token distribution, meaning airdrops and liquidity incentives; clarity that protocol-layer KYC and AML obligations attach to regulated intermediaries rather than to the software itself; recognition that decentralised governance and a validator set are not the same thing as issuer control, and that the ability to upgrade code is not automatically the ability to direct an enterprise; and something about the enforceable boundary of geographic blocking, because geofencing is the weakest link in every DeFi compliance story ever told.
Every one of those is a reasonable reverse-engineering from the business model. None of them is sourced. Treat them accordingly.
Now here is the part of this story that almost nobody has picked up, and I think it is the actual story.
Hyperliquid's core product is perpetual futures. Perpetuals are derivatives. In the United States, derivatives are, broadly, the Commodity Futures Trading Commission's territory โ not the SEC's. A venue whose primary regulatory exposure runs through the CFTC does not, on the face of it, have an obvious reason to spend political capital commenting on a Securities and Exchange Commission proposal.
So why did it?
Two explanations survive scrutiny. The first is that the proposal is broad enough to reach token issuance and market structure, not just trading venues โ in which case it touches Hyperliquid's emissions schedule, its airdrop mechanics, and the legal character of the 38.9 percent of supply it still intends to distribute. The second is that the SEC and CFTC have overlapping and quietly competitive claims over on-chain derivatives, and a protocol in Hyperliquid's position has to hedge on both fronts simultaneously.
I find the first more persuasive, and more interesting.
The five demands are probably less about how Hyperliquid trades and more about how it distributes.
Think about what a hostile reading of token distribution does to this specific protocol. The airdrop is done โ that pain is priced and digested. But nearly 39 percent of supply has not yet been released. If the final rule treats those future distributions as unregistered securities offerings, the emissions plan stops being a growth engine and becomes a standing liability. Every reward epoch becomes a legal question. Every incentive programme becomes a filing decision.
That is a far more existential threat to Hyperliquid than any rule about order books. You can architect around a trading rule. You cannot architect around a distribution rule that criminalises the mechanism by which your community was built.
Which is why the letter frames itself as advocacy for "Web3 developers" rather than for itself. It is not entirely altruistic. It is the only framing that makes a perpetuals venue's interest in a securities proposal coherent.
I keep coming back to something I have believed for a long time: open source is not a license; it's a state of mind.
A license is a document. A state of mind is a set of decisions about what you will not do even when you are allowed to. Hyperliquid's architecture is a state of mind expressed as an engineering constraint โ we will not hold the keys, we will not approve the listings, we will not rewrite the settlement. The comment letter is the same state of mind expressed in the only language a regulator reads.
That is why I do not dismiss it as theatre, even though its immediate market value is approximately zero. Somebody has to translate "we cannot comply because compliance is architecturally impossible" into statutory language. That translation work is unglamorous, slow, and almost always fails. It is also the only path that does not end with every serious on-chain venue incorporating in a jurisdiction that simply does not ask.
I spent six months of the 2022 bear market doing exactly this kind of unglamorous work โ forty-plus patches to the Gnosis Safe multisig repository, fixing legacy bugs nobody's roadmap had room for.
That period did not teach me that security is hard. Everyone knows security is hard. It taught me that trust lives in the boring layer. Nobody writes a thread about a correctly handled edge case in a signature verification routine. Nobody gets a podcast booking for a migration script that does not corrupt state. But that is where the trust architecture of this industry actually sits โ in the parts too dull to speculate on.
A comment letter is the boring infrastructure of legitimacy. It will not make anyone money this quarter. It is the difference between a venue that exists because regulators have not got around to it and one that exists because the rules were written to permit it. Those look identical on a chart and are not remotely identical across five years.
There is a contradiction in this letter that I cannot stop turning over, and I want to name it plainly because it cuts against Hyperliquid's own interests.
To file a comment letter, you need a "we."
Someone has to be legally identifiable as the author. Someone has to sign it. Someone has to be reachable when the agency has follow-up questions. That act of authorship is itself evidence of a core development team capable of speaking for โ and therefore arguably directing โ the protocol.
For years, the industry's strongest defence against securities law has been the claim that no such team exists. That the network is sufficiently decentralised. That no central actor's efforts drive the value. That the thing runs itself. Every comment letter is a small concession that the thing does not entirely run itself. It runs because a group of identifiable people built it, maintain it, and are willing to appear in the Federal Register on its behalf.
The same is true of the validator set. Hyperliquid's cohort is small by layer-1 standards, and there is precedent for validators intervening to resolve an abnormal market. That precedent is a feature when you are protecting users from a broken oracle. It is a liability when a regulator is assessing how decentralised you really are.
My audit history makes me allergic to one failure mode, and I see it here.
In 2020 I found an edge case in a slippage calculation affecting roughly two million dollars of user funds across the pools I had reviewed. The bug was not in the design โ the design was correct. It was in the gap between the specification and the deployed bytecode, where a rounding convention met an extreme market and produced a number nobody intended.
Regulation has the same gap. The proposed rule is the specification. Enforcement posture is the bytecode. Protocols rarely die because the specification is bad. They die because the enforcement posture turns out to be considerably harsher than anyone reading the proposal predicted, and nobody built for that contingency.
Now let me be difficult, because somebody should be.
I have held, for years, a position that makes me unpopular at conferences: orderbook DEXs will not out-compete centralised exchanges, because market makers will not leave resting quotes on a public chain where they can be observed and picked off. Latency is not a nice-to-have in perpetuals. It is the product. The entire business of a professional market maker is being faster than the person on the other side, and an on-chain book hands that advantage to whoever can see the queue.
Hyperliquid has pushed that boundary further than anyone I have watched. Genuinely. The engineering is not a gimmick, and the volume is not all incentives. I take the achievement seriously.
But here is the pragmatism test I keep applying. If you win the regulatory argument completely โ full carve-out, explicit exemption, the SEC writing "non-custodial software developers are not broker-dealers" into the Federal Register in letters ten feet tall โ what have you actually won? You have won the right to compete on the same terms you were already competing on. The liquidity problem does not move. The market-maker incentive problem does not move. The latency problem does not move.
A comment letter is not a moat. It is a permission slip. And permission slips are only worth what the business behind them is worth.
The second thing I want to push back on is the narrative itself.
"Challenges the SEC" is a template. It is a high-emotion, low-information template, and it spreads through crypto communities the way a rumour spreads through a small town โ fast, distorted, and impossible to retract. I spent a year of my life mining for truth in the noise of NFT mania, hosting a podcast I called The Digital Soul, interviewing thirty artists and builders about whether blockchain could preserve cultural heritage. Fifty thousand downloads in a week on the episode that went viral. And what I learned from that year was not about art. It was about the ratio.
The ratio of community enthusiasm to actual information, in this industry, is routinely somewhere north of fifty to one. A protocol saying "your framework is broken" produces enormous enthusiasm and almost no information. It tells you a posture. It does not tell you a rule.
The market value of this news is close to zero. The information value is moderate. The narrative value is enormous โ and that is precisely the problem.
And there is a risk in this letter that nobody is pricing, which is the simplest one.
Filing a comment letter puts your name into the public record of a federal agency. That record is read by the people who write rules and, separately, by the people who bring enforcement actions. There is no wall between those two groups that a determined subpoena cannot get around.
A venue with no KYC at the protocol layer, geographic blocking that a VPN defeats in about ninety seconds, and a product line built entirely on leveraged derivatives is, in most major jurisdictions, a textbook enforcement priority. Participating in rulemaking does not change any of that. It does not lower the probability of a Wells notice. If anything, it raises the profile that makes one more likely.
I want to be fair: there is a defensible strategic logic here. If you are eventually going to be in a courtroom, you would rather be the entity that spent three years arguing in good faith for a compliant path than the entity that ignored the agency entirely. Reputation is a defence. But it is a defence, not an immunity.
The genuinely interesting thing about the token structure, in this light, is that it removes the usual pressure valve.
Most projects in this position have investors who want a resolution โ any resolution โ so that a valuation can be marked and an exit planned. That pressure produces compromise: KYC for American users, delisting the awkward markets, a compliance officer with a title and a desk.
Hyperliquid has none of that. No venture round, no unlock cliff, no board seat held by a fund approaching the end of its life. The team can afford to be maximalist. It can choose to shape rules rather than accommodate them, because nobody is standing behind it with a term sheet and a deadline.
That is rare, and it is the most underrated fact in this story. It is also a warning: maximalism is cheap when you have nothing to lose and expensive when you have users to protect.
One more piece of the picture deserves more attention than it is getting โ the ecosystem layer.
HyperEVM changed what Hyperliquid is. It stopped being a venue and became a platform. That shift is the reason the phrase "trap Web3 developers" is in the letter at all, because the developers it refers to are, increasingly, Hyperliquid's own tenants.
If the final rule requires every on-chain application serving American users to register as a broker-dealer, the casualty list does not begin with Hyperliquid. Hyperliquid has fees, brand, and a treasury. The casualties are the long-tail builders on HyperEVM who have none of those things and would simply leave, or never arrive.
A platform's regulatory exposure is always larger than its own balance sheet, because it is also the exposure of everyone who built on top of it. That is a lesson the whole layer-1 sector learned the hard way, and it is why the framing of this letter is strategically smarter than it first appears.
So what do you actually watch? Not the letter. The letter is already filed, and its fate is out of anyone's hands.
Watch the final rule text, and watch one clause inside it: whether "non-custodial software developer" receives an explicit carve-out or an implicit one. That single distinction decides the shape of the next five years of on-chain finance. Explicit, and the compliance discount on this entire sector narrows โ slowly, over quarters, not days. Implicit or absent, and the industry's response will not be capitulation. It will be architectural: front-ends split from protocols, operating entities relocate, and a whole compliance-middleware category is born to sit in the gap between the code and the customer.
The signal to set an alert on is not "Hyperliquid files comment." It is "final rule text published," and then a careful reading of about four hundred words somewhere in the middle.
Liquidity isn't a number on a dashboard. It is a promise about who will still be there when you need to exit. Legitimacy isn't a press release either. It is the same kind of promise, made to a slower and less forgiving counterparty.
For a decade we told ourselves we were building an alternative to the institutions. We didn't build a future; we built a mirror. And the mirror has now been asked to file paperwork.
The question worth sitting with is not whether Hyperliquid's five demands get adopted. It is whether a protocol can remain genuinely permissionless and still be legible to the state that insists on knowing who is responsible. If the answer turns out to be no, then the five demands were never the argument. They were the eulogy.