Running a HIP-3 market · Lesson 5 of 5 · 3 min
Keys, people, and how to stop
A HIP-3 dex is run by keys that sign around the clock and by people who answer for them. This last lesson covers how to split the keys, how to stay up, and how the operators who stopped did it, because every plan should include the exit.
Split the keys
Every dex's roles are public: the deployer, the oracle updater, the fee recipient, and sub-deployers, each allowed only certain actions. Use that.
- The deployer key holds the stake. Keep it cold. It should almost never sign.
- The oracle key signs every few seconds. Give it only
setOraclethrough a sub-deployer, and run it where nothing else runs. trade.xyz's prices all come from one dedicated key. - Limits and listings go through more than one person. Hyperliquid has native multisig: for example, 4 of 6 signers must approve a cap or leverage change.
Stay up
- Downtime is slashable: up to 50% of the stake for a brief outage, up to 100% for a prolonged one. Someone must be reachable at any hour, with the authority to halt a market.
- Run a standby price updater that takes over when the primary goes silent, well inside Hyperliquid's 10-second fallback.
- Alarm on what matters: oracle silence, a price far from your sources, open interest near a cap, any change in who holds which role.
How the ones who stopped did it
| Operator | How it stopped |
|---|---|
| Felix | Signalled in mid-May 2026 that its USDH markets would end, then closed them in phases on 19–20 June (The Block). |
| Kinetiq | Closed the least active markets first from 10 June, set 17 June as the last day, and re-opened on USDC as a new dex about two weeks later (Kinetiq). |
| HyENA | Delisted one market an hour from 31 August to 2 September 2026 (Crypto Briefing). |
| Ventuals | Froze its pre-IPO markets at 24-hour average prices and returned staked HYPE one for one (The Defiant). |
The common thread: notice in advance, markets closed one at a time, a stated settlement price. And the stake stays locked for at least 183 days after deploying, plus 7 days to unstake, so the exit has a floor on how fast it can be.
Start on testnet
Hyperliquid's testnet has 272 registered dexes against 10 on mainnet; most teams rehearse there first, and so should you. Run the whole loop on testnet before staking: price updates with a standby, caps and leverage, alarms, a key rotation, a halt and a settlement.
doctorlists who holds which role on any dex and flags a staked key used for hot operations.plan/applykeep the dex's settings in one reviewed file and stop on changes the chain would reject.- A separate signer process signs only what its policy allows; native multisig for changes that need several people.
- Alarms go to Telegram, Slack or a webhook;
watchshows oracle liveness, caps and role changes on one screen.
hip3-ops runs on testnet today. A testnet quick start will be published here.
Where to go from here
- What happened to HIP-3 operators: all ten, over time.
- SK Hynix liquidation replay: one incident, second by second.
- Risk settings scorecard: every live market's limits against its book.
- Oracle receipts: proving what went into a price.