summary
When we wrote our first article, "Who's Trading on HIP-3?", our attribution method was statistical. We categorized each wallet based on its trading activity over the past three months: addresses primarily placing orders were categorized as market makers, addresses with high-frequency order taking were categorized as arbitrageurs, and orders with low execution rates and the "builder" tag were categorized as retail investors. This approach did reveal some interesting market structure characteristics, but the classification was probabilistic, and approximately 70% of wallets remained uncategorized.
This article replaces statistical inference with a mechanical classification system. Each order on @ Hyperliquid X carries a set of deterministic tags signed and published by the exchange itself: validity period (ALO, GTC, IOC, FrontendMarket), builder code, execution flag, and holding period. We use this order metadata to categorize each wallet into one of four types: retail investor, market maker, arbitrage bot, and arbitrage wallet account.
The second step was to identify the wallets behind these categories, extracting identity and transaction behavior data from the APIs of @arkham and HyperTracker. The top 450 wallets accounted for 78% of the total transaction volume. Among these wallets, we identified several accounts associated with @Polymarket, @jump_, @SeliniCapital, @wintermute_t, Abraxas Capital, and others.
Through this two-step classification method, we observed several patterns. These will be elaborated upon below.
Trade.xyz Wallet Analysis
Our observation window spans from March 10, 2026 to March 31, 2026, a total of 21 days. During this period, @tradexyz's four markets (xyz:CL Crude Oil, xyz:SILVER Silver, xyz:TSLA Tesla, and xyz:XYZ100) recorded a total of 79,622 unique participating wallets and a total trading volume of $51.95 billion.
Airdrop-based trading accounts are one of the largest categories by the number of wallets, but the smallest by trading volume. 35,091 wallets, representing 44.07% of the total number of wallets, generated only $400 million in trading volume during the entire window, accounting for a mere 0.77% of the exchange's total $51.95 billion. Nearly half of the active wallets on Trade.xyz contributed less than 1% of the total trading volume.
After breaking it down by market, another distinct pattern emerges.
Of the 35,091 airdrop-trading wallets, 34,859 (99.3%) traded xyz:CL during the window period, while the remaining 232 were scattered across xyz:SILVER, xyz:TSLA, and xyz:XYZ100. This pattern aligns with the characteristics of airdrop-trading accounts: each wallet repeatedly engages in small, two-way transactions, generating trading volume without bearing price risk. This strategy relies on tight execution costs and is extremely sensitive to slippage. xyz:CL has the best market depth among Trade.xyz's four markets, naturally making it the preferred venue for this type of activity.
Another noteworthy phenomenon is the identity behind these addresses. On-chain tracing, as shown below, reveals that 34,553 profiteering accounts are linked to the same Polymarket operator. This single entity accounts for 43.4% of all wallets involved in Trade.xyz during this window.
At the other end of the spectrum is market making. 363 wallets, representing 0.46% of all active addresses, drove $32.75 billion in trading volume during the window, 63% of every dollar traded on Trade.xyz. The remaining three categories fall in between. 522 SAT/HFT bots contributed $3.5 billion (6.7%). 38,307 wallets classified as retail contributed $8.7 billion (16.7%). 5,339 unclassified wallets contributed $6.61 billion (12.7%).
The 12.7% of trading volume in the uncategorized category cannot be qualitatively categorized into any particular strategy based on metadata alone. A reasonable assumption is that a significant portion of this comes from retail investors placing limit orders through the Hyperliquid frontend, or market and limit orders through the Trade.xyz frontend. Neither of these channels attaches explicit builder codes or dedicated TIF tags to their orders, making these trades invisible under a metadata-driven classification method.
The TIF composition supports the above hypothesis: 71.5% of orders in the uncategorized category have a GTC (Good Till Cancel) validity period tag, which is usually used by front-end users when posting static limit orders.
Themino scandal uncovered over 30,000 wallets.
Over the past few weeks, there has been much discussion in the market: Is Trade.xyz's impressive user count truly driven by real human participation, or is it inflated by the airdrop of accounts for profit-taking ahead of the anticipated TGE? We do not intend to comment on the broader profit-taking landscape of this exchange, but after analyzing the trading volume data of four Trade.xyz markets in March, a pattern does emerge worth noting.
Of the 34,602 wallets classified as airdrop exploitation accounts, 34,553, or 99.9%, can be traced back to the same Polymarket identity called "Themino".
How exactly does it work? Hyperliquid 's L1 provides a primitive called `internalTransfer` that allows transferring USDC between wallets, charging a flat fee of $1 regardless of the amount. Themino's operators used this primitive to transfer a seed deposit through tens of thousands of new wallets. Each wallet would execute the same five-step process in approximately 26 seconds:
1. Received $X from the previous money-making wallet via internalTransfer, but was charged $1 in HL transfer fees en route.
2. Transfer $14 to the xyz sub-account.
3. Execute two IOC orders on xyz:CL, one buy and one sell, to generate two transactions and generate some trading volume.
4. Transfer approximately $13.99 back to the main account (the $0.01 difference is a reserve for slippage and transaction fees).
5. Transfer $X minus $1 to the next cashback wallet via internalTransfer.
The same process is repeated for the next wallet.
The entire operation involved 34,510 internal transfers, resulting in Themino losing a total of $34,510 in protocol fees. This tactic is consistent with his trading history on Polymarket.
What are the different types of Builders?
Hyperliquid assigns an identifier to orders routed through third-party front-ends, allowing these applications to charge custom front-end fees. This identifier is the builder code, the most direct basis for determining which interface a wallet used (if any). Among the wallets traded on the four markets, these builders can be roughly categorized into three types.
Algorithmic Builders. These are products designed for retail investors to maximize trading volume on DEXs and farm points for potential airdrops. Until the end of 2025, farming points on perpetual DEXs meant either order washing or using algorithms to run non-targeted order-pick-pick operations, which was costly for participants and net negative for exchanges. Retail market-making bots like @tread_fi, @PlanemoTrading, and @origamitech_ replace order washing with truly valuable market making. Every order these products place is post-only, so wallets are adding liquidity to the order book, not consuming it.
As @davidyjeong, CEO of @tread_fi, stated: "Before the advent of retail market-making solutions, manipulating scores on perpetual DEXs meant order washing, artificially inflating trading volume at the expense of execution fees, slippage, and the risk of account suspension. We solved this problem with a completely new score-manipulation solution: the bot only places maker orders on both sides. Users can manipulate scores at a lower cost and often profit from the captured spreads. A byproduct is that the market gains genuine top-tier liquidity, which is exactly what HIP-3 perpetual stocks desperately need during nighttime and weekends when traditional market makers are unwilling to do market-making. This is a better way to manipulate scores and is the reason why the HIP-3 market has such an excellent execution experience today."
The contribution of these market-making bots to the market is most evident during periods when traditional market makers are absent. CME WTI futures close on Friday afternoon and open on Sunday evening, and perpetual stocks also face the same "overnight plus weekend" gap. During these periods, retail market-making bots prop up the order book tops in markets like xyz:CL and xyz:TSLA.
It should be noted that in this analysis, we categorize wallets that use these algorithmic product routes as airdrop-obtaining accounts, but their transaction behavior and impact on the market are structurally completely different from the witch activities.
Wallet-embedded Builders are perpetual contract interfaces embedded within consumer-grade wallets. Since early 2026, these integrations have become one of the largest sources of retail order flow on HIP-3. This group includes @phantom, @MetaMask, @Rabby_io, @rainbowdotme, and @OneKeyHQ. Their median transaction volume per wallet ranges from $1,000 to $3,000, which aligns with the order size of a retail investor group that prioritizes ease of use over marginal builder fees.
Application-oriented Builders are standalone, perpetual front-ends and integration products: aimed at traders, providing dedicated workflows and serving users who find wallet plugins insufficient and require better order placement, charting, position management, and execution tools. This group has fewer wallets than embedded wallets, but higher trading volume per wallet, aligning with a high-end user group that values feature depth over plug-and-play functionality. These products include @InsilicoTrading terminal, @liquidtrading, @hypurrdash, @BasedOneX, @Dreamcash, @infinex, @pear_protocol, @defiapp, and @pvp_dot_trade.
@0xVKTR, Head of Growth at InsilicoTrading (the team behind the Insilico endpoint), describes it this way: "At Insilico, we see the HIP-3 market as the next step in bringing real-world exposure native to the crypto track. Traders don't just want another front-end. They want fast execution, clean market access, and the ability to seamlessly switch between crypto and macro assets without leaving their existing workflows. Trade.xyz is one of the clearest examples of this demand. Order flows routed through Insilico prove that on-chain perpetuity has a real high-level user base when the trading floor has depth, useful products, and a trading experience built for serious participants."
Who is Trade.xyz's largest market maker?
The market-making landscape on Trade.xyz is highly concentrated. The top 5 market makers account for 50% of the market-making volume, the top 13 account for 80%, and the top 21 account for 90%. A handful of market-making desks support the vast majority of the exchange's market-making ledger.
The second largest market maker is the most interesting wallet in the entire sample. 0xc926ddba…98d3 has a trading volume of $4.39 billion and a turnover rate of 0.52%, a textbook example of a maker profile. Arkham has labeled this address as "Powell" on Polymarket. One of the largest market makers on Trade.xyz is surprisingly a Polymarket user running a market-making ledger across multiple markets on HIP-3.
Other market makers worth noting:
Jump Crypto ran two wallets totaling $3.15 billion, with funds originating from 0xf584…d621, a wallet clustered by Arkham as Jump Treasury, holding over $160 million in diversified holdings covering LINK, LIT, EIGEN, BNB, ETH, USDC, and USDT.
Selini Capital ran three wallets: two purely maker-based quotes (0x44a3e1…35dd, 0x76987c…4480) and one purely aggressive taker (0x427be6…d1d9), all via API. Selini's total value was $1.03 billion. The Hyperliquid order book label distinguishes Selini's market-making wallet from its HFT wallet, indicating that the same market maker is simultaneously operating on both sides of the order book.
Wintermute runs a market-making wallet with $229.6 million (0xecb63caa…2b00), smaller than Jump or Selini. Funding comes from @okx.
Aside from these named market makers, most of the market-making volume comes from wallets without physical attribution but with clean funding sources: @krakenfx, @binance, @coinbase, @unitxyz bridges, or HL native funding. Their behavior is characteristic of market making, but the operators have never touched any tagged services that Arkham can reconstruct their identities from.
The median order-to-execution ratio for market makers is 19.4, meaning that for every trade executed, approximately 18 orders were placed and then withdrawn as part of a two-sided quote. The same top 5 market makers appearing repeatedly across all four XYZ markets indicates that these are cross-market quoting platforms, rather than four independent businesses.
During the window period, the market maker liquidation rate was 19.2%, almost on par with the retail investor rate of 20.4%. Market makers on Trade.xyz assume targeted exposure when their quotes are snapped up: a sell order matched with a bid order turns the market maker into a long position; a buy order matched with an ask order turns the market maker into a short position. During the sharp fluctuations in crude oil prices in March, the accumulated inventory on the books moved backward faster than the market makers could hedge, resulting in one-fifth of the market makers experiencing at least one liquidation.
Statistical arbitrage for single-sided trading / mid-frequency trading robot
SAT is the counterparty to the market-making ledger. These wallets handle 90%+ of IOC (Immediate or Cancel) order combinations, acting as purely aggressive order takers, specifically targeting the quotes posted by market makers.
Of the $3.5 billion in the SAT's books, the top four SATs account for $3.1 billion, a concentration of 89%. Two of them run 100% IOC, meaning that every order they place is "immediately executed or cancelled," with absolutely no maker intent.
Funding source clustering points to @Bybit_Official as the main SAT profile. A large portion of the trading volume of the top SATs can be traced back to wallets funded by Bybit, which aligns with the profile of a single bot operating entity or a small circle of bot operators.
Three of the SATs have Polymarket accounts: loracles (trading volume $15.5 million, HL cumulative profit/loss + $25.7 million), Conduit ($5.3 million), and ChadwickLongman ($3.7 million). Polymarket appears here for the same reason it dominates the retail investor section below: prediction market participants are the most common cross-platform identity on Trade.xyz.
During the window period, SAT's liquidation rate was 8.1%, about half that of market makers and retail investors. This group represents the most risk-managed group on the books, as they hedge their positions externally and almost never trigger margin calls.
The retail investor group and Polymarket highly overlap.
We conducted an in-depth analysis of 400 retail wallets with the highest trading volume, which route orders through the Hyperliquid UI and the wallet's embedded front-end. Algorithmic products mentioned earlier (Tread.fi, Planemo Trading, and the broader group of algorithm builders) were excluded.
Polymarket: A Polymarket account that can be identified through the Arkham on-chain tagging system.
@ensdomains / Social Identity: Accounts with an ENS name or other social graph identifier that cannot be traced back to Polymarket.
CEX deposits: Funds originate from anonymous wallets on centralized exchanges.
Bridged top-up: Anonymous wallets that top up via cross-chain bridges.
Other: Self-hosted EOA, Contract Infrastructure, Empty Address Activity.
The most striking aspect is Polymarket's dominance. Of the top 400 retail investor wallets, 94, or 22%, of the top retail investor trading volume ($1.63 billion) comes from verifiable Polymarket users. This is the largest single identifiable group within the retail investor segment. Adding together Polymarket-affiliated market makers ($Powell, $4.39 billion) and three Polymarket-affiliated SATs ($24 million), Polymarket's total footprint on Trade.xyz is approximately $6 billion.
Among the top 15 retail wallets ranked by trading volume, some of the Polymarket wallets included are:
This overlap is reasonable. Polymarket and Trade.xyz provide crypto-native users with exposure to real-world outcomes through two different market structures: prediction markets and perpetual futures. Wallet-level data shows that the same group of people are operating back and forth between the two ledgers, originating from the same EVM address.
ENS holders contributed 26 retail wallets, totaling approximately $400 million. Notable wallets include caydenb.eth ($33 million), eggnoodle.eth ($33 million), ethmerg.eth ($19 million), baitf1sh.eth ($16 million), and wanyekest69.eth ($6.8 million, with accumulated profits and losses of +$17.6 million).
Identityless wallets split by source of funds:
@krakenfx dominates the CEX deposit group. Hyperunit and @debridge dominate the bridging deposit group, with @StargateFinance and a long list of other bridging platforms making up the remainder. In other words, the retail investors truly driving Trade.xyz's order book fall into three categories: Polymarket cross-venue traders, independent traders depositing through Kraken, and DeFi natives entering via Hyperunit or deBridge.
By combining the three groups of market makers, SATs, and retail investors, we get a compact profile of Trade.xyz's core participants, stripping away the witch layer that will be discussed below.
A few professional market makers provide quotes to a few teams of bots, plus a long tail of Polymarket veterans and independent traders depositing into CEXs, placing targeted bets through the Hyperliquid UI—this is the combined view of the Trade.xyz ledger.
Summarize
Recent discussions surrounding Trade.xyz have focused on one question: Is the participation genuine, or is the exchange actually dominated by societal figures who are drawn by expectations of TGE? The analysis provides a layered answer.
Like any DeFi market before TGE, Trade.xyz does have a Sorcerer layer, typically where an operator uses a "relay race" style of profiteering to run tens of thousands of wallets. However, the Sorcerer layer inflates the number of wallets, not the volume of USD transactions.
We found no evidence of a separate, high-volume order manipulation operation designed to artificially inflate USD trading volume. The parts of the data that appear to be manipulated are mostly actually run by retail investor market-making bots: wallets place orders on both sides, adding depth to the top of the order book instead of consuming it.
The real trading volume comes from identifiable ledgers. A significant portion of top retail wallets bear Polymarket accounts, ENS records, or social graph identifiers, while the largest crypto liquidity providers (Jump Crypto, Selini Capital, Wintertermute) also leave clear traces, alongside the targeted fund Abraxas Capital. The high degree of overlap between the retail investor base and Polymarket is unusual, given that the latter is essentially a product built around the same speculative preferences.
The surge in wallet activity was a predictable phenomenon before TGE, but it does not extend to dollar transaction volume or the identifiable groups that carry that volume.
Special thanks to HyperTracker and the many contributors for their help with data availability.
For the complete methodology, please visit our blog .
