While DeFi lost over $600M in the first months of 2026 to weak key management and dangerously low multisig thresholds, Felix chose a different path. This is the story of how Felix used HyperStone to launch the first live HIP-3 markets, and how their choice of a 4-of-6 multisig standard is setting a new bar for DeFi oracle security.
Key Results in Numbers
Partner Perspective
What is HIP-3
HIP-3 is Hyperliquid’s framework for creating fully permissionless perpetual markets. In native HyperCore markets, Hyperliquid manages the price infrastructure, but with HIP-3, the deployer takes on full responsibility for the oracle. Anyone can launch a market for any asset, but once they do, they are fully responsible for the pricing stack.
This design offers a lot of flexibility but also carries significant responsibility. For protocols using HIP-3, the oracle layer is not something you set up once and ignore. It is the core security decision on which the entire protocol depends.
Felix was the first team to take this responsibility seriously and get it right from the very beginning.
The Challenge: Single Points Of Failure Are An Industry-Wide Problem
In the first four months of 2026, DeFi suffered over $600M in direct losses from the same root cause. It was not smart contract bugs or economic exploits, but key management failures and dangerously low multisig thresholds. These setups leave entire protocols exposed as soon as one signer is compromised.
The KelpDAO attack on April 18 showed how quickly a single weak link can cause widespread damage. Attackers compromised the only DVN verifier protecting its LayerZero bridge. With a 1-of-1 DVN setup, just one compromise was enough to approve a fraudulent cross-chain transaction. They minted 116,500 unbacked rsETH tokens worth $292M, triggering emergency market freezes across all lending protocols that used rsETH as collateral. Aave alone saw $10B in withdrawals within 48 hours and faced up with $230M in bad debt from rsETH positions. In less than two days, total DeFi TVL dropped by over $14B, a 14% decline.
A Dune Analytics review of 2,665 active OApp contracts on LayerZero found that 47% still use a 1-of-1 DVN configuration, the same setup that made KelpDAO vulnerable. Only 5% use 3-of-3 or higher.
Dune’s announcement of an open analysis of DVN security configurations across every active OApp on LayerZero. Source: Dune’s X.
Drift Protocol showed that low multisig thresholds can also be a social engineering risk. Attackers spent six months building trust with contributors, even meeting them at conferences in different countries. Their patience paid off. By targeting Drift’s 2-of-5 multisig through social engineering, they drained $285M in just twelve minutes. The impact spread quickly to over 20 Solana protocols, causing temporary halts and leaving users unable to access funds. Drift’s TVL fell from $550M to under $250M, and the DRIFT token lost over 40% of its value. Just two signatures were enough.
Resolv proved that the problem is not just about multisig setups. In this case, a single private key stored in AWS Key Management Service was enough. Once compromised, the attacker minted $80M in unbacked USR with only $200K in collateral. Direct losses were about $25M, but the ripple effects were much larger: USR lost 80% of its value, Curve liquidity providers lost an estimated $18M, the depeg caused about $180M in liquidations on Morpho, and Fluid saw roughly $330M in outflows. One compromised key led to over $500M in ecosystem damage.
According to solgov.xyz, 15 out of 50 tracked Solana protocols currently use 2-of-5 or weaker setups. That is 32% of the protocols tracked. Similar shortcuts are found in EVM projects, HIP-3 deployments, and oracle infrastructure across the ecosystem. Drift, Resolv, and Kelp were exploited in different ways: a weak multisig threshold, a compromised cloud key, or a single DVN verifier. The technical details may differ, but the root cause is the same: each had a setup in which a single point of failure was enough to cause major losses.
For Felix, launching the first HIP-3 markets for equities and commodities on Hyperliquid meant making every infrastructure decision in this context. Choosing a weak signing setup was not just a technical risk; it would have sent a message about the kind of protocol Felix wanted to be.
The Solution: Hyperstone, A Purpose-Built Three-Tier Oracle Stack For HIP-3
Co-founder and COO of RedStone, Marcin Kaźmierczak, on the impact of HyperStone.
RedStone created HyperStone to address this exact problem. It is a three-tier oracle stack designed for HIP-3, with infrastructure located in Asia to match Hyperliquid node latency. At its core is a 4-of-6 decentralized verification quorum, and it uses a dual-state pricing system to handle the fact that equities and commodities do not trade 24/7.
The verification quorum is the key design choice. There are six independent signers, and four are needed to carry out any administrative action. This is not a 2-of-5 setup, and no single private key is stored in the cloud. The system can handle up to two signer compromises before becoming vulnerable. This standard shows how seriously RedStone and Felix take the threat model that has cost the industry hundreds of millions in 2026 alone.
The second layer is infrastructure colocation. The time between an oracle update and a Hyperliquid block is essential for price integrity. HyperStone’s infrastructure is physically located in Asia to align with Hyperliquid Foundation node timing, ensuring oracle updates arrive in sync with block production.
The third layer is the pricing architecture, which enables HIP-3 markets for traditional assets. HyperStone uses independent primary and fallback price states, each with its own offset, ensuring redundancy from the start. For assets like equities and commodities that close during regular market hours, HyperStone uses institutional data when markets are open and switches to alternative price sources during off-hours. This way, Felix’s perpetual markets stay live 24/7 with no gaps in price integrity, even when the New York Stock Exchange is closed.
HyperStone’s data flow follows this architecture at every step:
Institutional data sources (market hours) > Alternative aggregation (off-hours) > Primary and fallback price states with independent offsets > 4-of-6 verification quorum > HIP-3 market feed.
Felix used this infrastructure to launch the first live HIP-3 market, giving Hyperliquid traders onchain access to Tesla stock. Since then, they have expanded to 15 HIP-3 markets covering both equities and commodities, all using the same stack.
Business Impact
A chart showing the trading volume of chosen HyperStone-powered Felix’s HIP-3 markets in May 2026. Source: Loris.tools.
Since launch, HyperStone has had no downtime and no mispricing incidents across all 15 HIP-3 markets.
Because the infrastructure is located in Asia, oracle updates are always in sync with Hyperliquid block production. The primary-fallback setup ensures that pricing continues even if one data source fails. Felix’s perpetual markets run 24/7, even for assets that a regular oracle stack could not support.
With a 4-of-6 multisig quorum, the system can handle up to two signer compromises before becoming vulnerable. There are no single private keys in the cloud, no 2-of-5 setups that social engineering can exploit with just two relationships, and no single DVN-style verifiers that could approve fraudulent transactions if compromised. Every administrative action needs four independent signatures from six different parties. The separate primary and fallback price states add another layer of data integrity, so if one price path fails, it does not degrade the feed quality.
HyperStone has secured $3.4B in total trading volume across 15 HIP-3 markets. It made the first live HIP-3 market on Hyperliquid possible and proved that institutional assets, equities, commodities, and assets with market-hour limits can run as perpetuals onchain with full price integrity. This has set a production benchmark for every team now considering HIP-3 deployment.
TL;DR
- RedStone built HyperStone, a three-tier oracle stack purpose-built for Hyperliquid’s HIP-3, and deployed it with Felix to power the first live permissionless perpetual markets on the network.
- At its core is a 4-of-6 multisig verification quorum, a direct and deliberate counter to the industry pattern of 1-of-1 and 2-of-5 configurations that have cost DeFi over $600M in direct losses in 2026 alone, and far more in cascading damage.
- The infrastructure has since secured $3.4B in trading volume across 15 HIP-3 markets with zero downtime and zero mispricing events.
- For builders evaluating oracle infrastructure on Hyperliquid, HyperStone is the production-tested baseline.
