Chain profile
Authenticates with ECDSA on secp256k1 through EIP-712 typed-data signing, with no published post-quantum roadmap found despite very large open interest.
No. Hyperliquid authenticates user transactions on HyperCore and HyperEVM with ECDSA on the secp256k1 curve, using EIP-712 typed-data signing, which is the same cryptography Ethereum uses and which a sufficiently large quantum computer would break. We searched for a published post-quantum roadmap, a research programme, a protocol proposal and a testnet implementation, and found none at the time of writing. What makes Hyperliquid worth listing rather than omitting is the mismatch between that absence and the size of what sits behind it: the venue carries very large open interest and cumulative volume, so the value secured by classical keys is substantial relative to the attention the question has received. Third parties have begun offering post-quantum custody products to Hyperliquid holders, which is a market response to the gap rather than a protocol answer to it.
Where we are making a judgement call Two things are worth stating plainly. First, our finding is that we could not locate a published post-quantum position, not that we have confirmed none exists. Tier 5 records quantum-vulnerable signatures alongside the absence of a plan we could find. Second, the placement is about disclosed readiness and nothing else, not about Hyperliquid's engineering or its market. If Hyperliquid has published a position, the primary source is the fastest way to correct this profile.
ECDSA on secp256k1, via EIP-712 typed-data signing
None selected. No protocol-level post-quantum work was found.
None adopted
Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme could be found.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 0 | 30% | 0.0 |
| 2 | Deployment stage | 1 | 25% | 2.5 |
| 3 | NIST alignment | 0 | 15% | 0.0 |
| 4 | Migration path | 0 | 15% | 0.0 |
| 5 | Exposure | 2 | 10% | 2.0 |
| 6 | Verification | 5 | 5% | 2.5 |
| Hardy Score | 7.0 | |||
User transactions on HyperCore and HyperEVM are authenticated with ECDSA on secp256k1 via EIP-712 typed-data signing. Nothing post-quantum protects funds on the protocol. source
Tier 5: Exposed. Hyperliquid authenticates with ECDSA on secp256k1 and we found no roadmap, research programme, protocol proposal or testnet implementation. See the caveat below on what that finding does and does not establish. source
No post-quantum scheme has been named or selected at protocol level, so there is nothing to assess against a NIST standard. source
No migration plan, mechanism or published position was found. This is the only zero on migration in the index, and it reflects an absence of any identified route rather than a route we judged inadequate. source
Addresses follow the Ethereum model and are hashes of public keys, so a funded address that has never signed keeps its key private. On a trading venue essentially every account of consequence signs constantly, so the practical exposure is near total. source
The signature scheme is documented and follows a public Ethereum standard, so that much is verifiable. There is no post-quantum claim to check, and we found no published protocol position on the question to hold against future statements. source
The deployment dimension is not a separate judgement. It is Tier 5 expressed as a number. See the tier mapping.
No post-quantum roadmap, research programme, protocol proposal or testnet implementation was found at the time of writing. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
Hyperliquid uses Ethereum-style addressing, so an address is a hash of the public key and a never-used address does not reveal it. That protection is close to meaningless for this particular network. Hyperliquid is a trading venue, and accounts that hold value sign orders and transfers continuously, publishing their keys immediately and repeatedly. The result is that effectively all economically active value on the platform sits behind keys that are already recorded on-chain and can be collected today against a future quantum computer.
What this rating means for you
Hyperliquid runs quantum-vulnerable signatures with no published post-quantum plan that we could find. Nothing here is urgent today, and there is also nothing scheduled to change it.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
No. Hyperliquid authenticates transactions with ECDSA on the secp256k1 curve through EIP-712 typed-data signing, which a sufficiently large quantum computer would break. We found no published post-quantum roadmap at protocol level.
Because we found no migration route at all: no plan, no mechanism, no published position. Other chains scoring low on this dimension have a route we judged weak or contested. Hyperliquid scores zero because we could not identify one to assess.
They protect the holders who use them, and they do not change the protocol's rating. Products offering post-quantum self-custody for HYPE exist, but this index rates the chain's own cryptography. A third-party custody option is a mitigation available to individuals, not a property of the network.
It makes the consequences larger, which is why we list it. The venue carries very large open interest and cumulative volume, and because it is a trading platform, accounts sign constantly and publish their keys immediately. A large amount of value therefore sits behind keys that are already harvestable.
This is a security-readiness assessment, not investment advice.