Which DEX is safe? After the Binance hack, that’s the question every trader is asking. Here’s the short answer: of the four biggest perp DEXs, only Lighter lets you withdraw your funds without the team’s help. On Hyperliquid, Aster and Variational, your money depends on keys and systems the team controls, just like on a centralized exchange.
This post builds on an excellent research thread by 0xJaehaerys on X. He went through the verified contracts, on-chain balances and L2BEAT data of all four platforms. Full credit to him for the digging. We’ve rewritten his findings for our readers and added our own take.
Why the Binance Hack Changes the Question
Our Binance hack post mortem covers the full story. The short version matters here. Attackers compromised a DevOps engineer’s laptop, reached an internal service and had Binance’s own systems sign the withdrawals. Binance says no private keys leaked. Nobody needed them.
That’s the uncomfortable part. If a company’s systems can move your funds, breaking into those systems is enough. Bitget lost over $350 million a month earlier in a similar way, when attackers reached a backend that fed data to its signers.
Perp DEXs sell themselves as the fix. Your funds sit in a smart contract, not a custodial hot wallet. So the real question is simple: if a DEX team’s keys or servers got hacked the way Binance’s were, what could an attacker do, and could you still get out?
How the Four DEXs Were Checked
0xJaehaerys asked every platform the same three questions:
- Where does the money actually sit?
- Whose signature gets it out?
- If the team disappears or gets hacked, can you still leave?
The answers come from on-chain reads, verified contract code, each team’s own docs and L2BEAT. Balances come from DefiLlama and block explorers, as of late October 2026.
One caveat before we start. This isn’t an audit or a bug hunt. Teams may run MPC wallets, signing policies or monitoring that you can’t see from outside. Those protections could make these scenarios much harder. So read what follows as what the contracts allow, not as a prediction that anyone will get hacked.
Lighter: The Only One With an Exit
About $1 billion sits in Lighter’s contract on Ethereum. Roughly $556 million of that is USDC, about $430 million is LIT, plus some ETH and smaller tokens.
In normal operation, money only leaves that contract in batches verified with a ZK proof. A standard withdrawal can only go to the wallet that owns the account, and that link is fixed at your first deposit. Faster withdrawals and account transfers exist too, but they need a signature from your own wallet. In other words, whoever controls Lighter’s sequencer, prover or validator keys can’t simply drain balances. That’s the big difference from Binance.
You can also leave without the team. Submit a forced withdrawal on Ethereum, and if Lighter doesn’t process it within 14 days, anyone can flip the contract into “desert mode.” Upgrades stop, and every user exits with a ZK proof of their balance built from data already on Ethereum.
Where Lighter Still Needs Trust
Still, Lighter isn’t trustless:
- Prices. Lighter’s operator supplies index and mark prices, and the proofs don’t check them against oracle signatures. Bad prices could trigger unfair liquidations.
- Pauses. Two guardian keys can pause batches and withdrawals, one for up to 24 hours and the other for up to 72, with cooldowns. Neither can block desert mode.
- Upgrades. A 3-of-5 multisig can push an upgrade after a 21-day public notice. If a separate 4-of-7 security council also signs, there’s no notice at all. Every upgrade so far went that fast route, and the proof verifier alone was swapped five times in October.
On the history side, Lighter had about 4.5 hours of downtime in the October 2025 crash, withdrawal delays after the LIT launch, a two-hour guardian pause on October 17 and two state-update gaps in late October. Nobody has reported losing escrowed funds.
For more on the platform itself, read our Lighter review.
Hyperliquid: Safe as Coinbase’s Key
Around $6.5 billion in USDC backs Hyperliquid, and it sits in three places:
- About $5.6 billion (86%) in one address on HyperEVM that Coinbase named as its USDC treasury wallet.
- Around $622 million (10%) in Circle’s CoreDepositWallet contract on HyperEVM.
- Roughly $290 million (4.4%) in the old Hyperliquid bridge on Arbitrum.
Here’s the catch. The Coinbase address is a regular wallet. No smart contract or on-chain multisig sits in front of it. For 86% of the USDC, it comes down to how Coinbase protects one key, which nobody can verify from outside. Hyperliquid’s own chain also moves USDC in and out of that address without Coinbase’s key, using unsigned system transactions to keep a 9-to-1 split with Circle’s contract.
Coinbase staked about 506,000 HYPE for the role, worth around $46 million. However, that stake only gets slashed if the wallet can’t pay the protocol its share of yield. It’s under 1% of the balance and doesn’t back the funds.
Circle’s contract is upgradeable by a single admin address. On the Arbitrum bridge, 3 of 4 validator signatures release a withdrawal after a 200-second window. The real backstop is Circle, which can freeze native USDC anywhere. It did exactly that with the $823 million taken from Binance. A freeze stops a thief, but frozen money stays stuck until someone sorts it out.
There’s no way out on your own. If Hyperliquid’s operators stop, L2BEAT rates it “Cannot withdraw.”
The Validator Set and a Possible Rollback
The chain runs on 27 active validators. The five run by the Hyper Foundation hold about 47% of the stake, and its three biggest alone could stall the chain by going offline. All of them run Hyperliquid’s closed-source node software, the only implementation that exists.
That concentration has a flip side worth mentioning. HyperEVM is Hyperliquid’s own chain, not Ethereum. If billions ever left the Coinbase wallet in a hack, the validators could roll the chain back or hard fork it to undo the theft. With a Foundation-heavy validator set running one closed-source client, that decision could happen fast. The JELLY incident already showed the validators will intervene when the protocol itself is at risk. Of course, a rollback only works while the funds are still on HyperEVM. Anything bridged out to Arbitrum or another chain before the fork would be gone. So it’s a real safety net, but also a reminder that a small group controls the ledger.
Unit: Where the Spot Coins Live
Spot BTC, ETH and SOL come in through Unit, a separate protocol. Those coins are really Unit’s tokens (UBTC, UETH, USOL). Unit holds about $940 million, and two of its three guardians must sign every withdrawal. After the Binance hack, Unit added a delay on every deposit and withdrawal.
History includes the JELLY incident in March 2025, when validators voted to delist a market and settle it at a price they picked. The Arbitrum bridge has been emergency-paused several times, each time reopening within hours with no funds lost.
Our Hyperliquid review covers the trading side in full.
Aster: Custody With Speed Limits
About $500 million sits in Aster’s vaults across BNB Chain, Ethereum, Arbitrum and Solana. Roughly $100 million of that is USDF, Aster’s own stablecoin. That excludes about $1 billion in ASTER and APX tokens in the BNB Chain vault.
The vaults simply hold pooled money. Who owns what is tracked on Aster Chain, which only Aster’s own validators run for now. Every withdrawal from the EVM vaults must be sent by an Aster operator address and signed by two Aster keys. You sign your request too, but your signature is checked against an address that Aster’s keys supply. It confirms you asked, rather than protecting the pool.
That’s the same custody risk Binance had. If Aster’s keys or backend get compromised, money can leave the vaults. What slows it down is an hourly withdrawal cap per vault: $30 million on BNB Chain and Ethereum, $20 million on Arbitrum. Hit the cap and the vault pauses.
There’s no self-exit either. The verified vault code has no function for withdrawing on your own.
Who Can Change Aster’s Rules
Upgrades go through a 4-of-7 multisig with a 6-hour timelock. The same multisig can change roles and caps instantly, though. On Solana, a 3-of-6 multisig can upgrade the program on the spot.
Those caps have triggered several times, in December 2024, September 2025 and July 2026, and the multisig raised them afterwards each time. Aster also refunded traders after a mispriced XPL market in September 2025. A month later, DefiLlama delisted its perp volume after it closely mirrored Binance’s and Aster couldn’t provide order-level data.
For the full picture, see our Aster review.
Variational: One Key Is Enough
Around $290 million in USDC sits with Variational on Arbitrum. About $223 million is spread over 208,000 per-user settlement pools, $54 million sits with its market maker (the OLP) and $12 million in the treasury.
You can deposit into your pool yourself, but you can’t withdraw alone. Every withdrawal is sent by one of 17 operator keys, and 16 of those are plain wallets. According to the verified contracts, any single key can move USDC out of any pool, with no cap on the amount. One function sends USDC straight to the key’s own wallet and processes a whole batch of pools per transaction. In theory, a single compromised key could empty every pool within minutes.
The admin is one regular wallet as well, and its actions apply immediately. It adds keys, can point pools at a different oracle and can pause all withdrawals. The docs call the OLP vault a smart contract, but the listed address has no code.
No Exit Without the Team
Variational says it uses Fireblocks for deployments and oracle signing. It doesn’t say which keys that covers or what the approval rules are. If limits or a quorum exist, they aren’t visible on-chain.
No exit without the team exists here either. If the backend stops or the admin pauses the oracle, the contracts give you no way out. Outside Variational, Circle could freeze the USDC or Arbitrum’s Security Council could step in, as both did after the Binance hack.
To its credit, Variational has no reported hacks, thefts or withdrawal halts so far. After the Binance hack, it said user funds are safe in on-chain contracts and can be withdrawn at any time. Both statements are true, as long as its backend keeps signing.
Read our Variational review for the trading side.
Which DEX Is Safe? Side by Side
| Where the money sits | Who can move it | Leave without the team? | What limits the damage | |
|---|---|---|---|---|
| Lighter | ~$1B in a contract on Ethereum | Only ZK-verified batches; withdrawals go to the owner’s wallet | Yes, forced withdrawal then desert mode after 14 days | Pauses capped at 24h/72h; upgrades need 21-day notice unless a 4-of-7 council co-signs |
| Hyperliquid | ~$6.5B USDC: 86% in a Coinbase-named wallet, 10% in Circle’s contract, 4.4% in the Arbitrum bridge | Coinbase’s key and the chain itself; one admin key for Circle’s contract; 3-of-4 on the bridge | No | Circle can freeze USDC; 200-second bridge window; validators could roll back HyperEVM |
| Aster | ~$500M in vaults on four chains | Aster operator plus two Aster keys | No | Hourly caps of $30M/$30M/$20M; 6h timelock on upgrades, but caps can change instantly |
| Variational | ~$290M USDC on Arbitrum | Any one of 17 operator keys | No | Admin can pause or remove a key; Circle freeze; Arbitrum Security Council |
Only Lighter passes the third test. On paper, Variational is the most exposed, since a single key is enough to drain the pools.
What I Do With This
Here’s my own rule, and it applies to DEXs as much as to Binance. Keep on any exchange only what you’re actively trading with. Everything else goes to self-custody.
Before parking real size anywhere, look at two things. First, where does the money actually sit? Second, is there a way out if the team disappears? L2BEAT shows both for the venues it covers, and that check takes five minutes.
This also doesn’t mean the three custodial DEXs are bad venues. I put volume through most perp DEXs myself. It means you should size your deposits to the trust you’re giving. A platform you can always exit deserves a bigger balance than one where 17 plain wallets hold the keys.
Smart contract custody also isn’t the only risk. The Polymarket hack two days before Binance showed that a frontend can be compromised even when the contracts are fine. Our crypto safety guide covers that side.
For how these platforms compare as trading venues, our best perp DEX guide ranks them all.
Keep This Content Free
Breaking down four DEXs’ custody models takes time, and we publish it for free. If this helped you decide where to trade, signing up through our Hyperliquid referral link or our Lighter referral link supports our work at no cost to you. Both are venues I use myself, with the balance sizing above in mind.
Final Words
So, which DEX is safe? Lighter is the only one of the four where a Binance-style compromise of the team’s systems can’t pull your balance out on its own. What you trust there is the pricing and how fast the multisigs can change the code. Hyperliquid leans on Coinbase’s custody and its own closed-source chain, with a possible rollback as its last resort. Aster and Variational run a custodial model with on-chain speed limits, or in Variational’s case, none at all.
None of that is a prediction. It’s what the contracts allow today. Teams can add protections we can’t see, and they can also remove the ones we can. Check again before you deposit, because October has shown that nobody is immune, from Binance down to the StonkFun hack we covered earlier. Thanks again to 0xJaehaerys for the research that made this post possible.
FAQ
Which DEX is the safest?
Of the four biggest perp DEXs, Lighter is the safest on custody. Funds only leave its Ethereum contract through ZK-verified batches, and users can force an exit without the team through desert mode. Hyperliquid, Aster and Variational all depend on team-controlled keys.
Can Hyperliquid be hacked like Binance?
Hyperliquid’s custody model differs, but 86% of its USDC sits in a single Coinbase-controlled wallet with no on-chain multisig. Its safety depends on Coinbase’s key management and Hyperliquid’s own chain, with Circle’s freeze powers and a possible chain rollback as backstops.
Is my money safe on a perp DEX?
It depends on the DEX. Some, like Lighter, let you withdraw without the team. Others, like Aster and Variational, need team keys for every withdrawal. Check where the funds sit and whether a forced exit exists before depositing.
Can I withdraw from a DEX if the team disappears?
Only on Lighter among these four. Hyperliquid, Aster and Variational have no self-withdrawal function in their contracts, so their users rely on the team’s backend to keep signing.
Is a DEX safer than a centralized exchange?
Not automatically. A DEX with team-controlled keys carries the same core risk Binance had: if the team’s systems get compromised, funds can move. The advantage only exists when the contracts give users a verifiable exit.
Credit: Source link
