Forensic Reconstruction of the October 10 ADL Cascade

Auto Deleveraging is the mechanism of last resort in a perpetual futures clearinghouse. When a liquidation engine cannot find counterparties in the order book to absorb a bankrupt position, the clearinghouse forcibly closes positions held by profitable traders on the opposite side. The profitable trader does not consent. They receive no warning. Their position is closed at the bankruptcy price of the account being liquidated, not at the current market price. The difference between those two prices is wealth transferred from the profitable trader to the insurance mechanism.

ADL exists because perpetual futures markets operate without expiry dates. In traditional futures, a contract expires and settles against an index. In perpetual markets, positions can theoretically remain open forever. This means unrealized losses can exceed deposited margin. When they do, the clearinghouse faces a deficit: someone owes more than they have. ADL resolves that deficit by taking from the other side.

Hyperliquid's ADL implementation routes through two vault structures. The HLP vault (Hyperliquidity Provider) acts as the primary market maker and absorbs most liquidations. When HLP's capacity is exhausted, the Liquidator vault takes over. Together these two vaults sourced 95.1% of all ADL fills during the October 10 cascade. The remaining 4.9% targeted individual retail accounts directly.

This concentration reveals a structural paradox. The safety mechanism designed to protect the exchange from insolvency is itself the systemic risk vector. When the vaults absorb losses, they do so on behalf of all depositors. A single cascade event can impair the capital base that supports ongoing market making operations. The firewall catches fire.

The finding is not that ADL is bad. Every perpetual exchange needs a backstop. The finding is that vault concentration transforms a bilateral risk event into a socialized loss. When 95.1% of ADL fills flow through two vaults, those vaults become the transmission mechanism for systemic contagion. The safety mechanism IS the systemic risk vector.

The reconstruction challenge is deceptively simple to state and brutally difficult to execute. Given a stream of 3.2 million events and a snapshot of 437,723 accounts, replay every event in deterministic order and verify that the resulting account states match the clearinghouse's own records.

The data problem. When we started, there was no single source of truth. Hyperliquid's raw event data lived on S3 as lz4 compressed shards: node fills and miscellaneous events split into chunks. But the clearinghouse state data, the actual account balances and positions at any point in time, was not publicly available. We obtained a clearinghouse snapshot from another firm. Two disconnected data sources, no way to verify either one independently. HyperReplay was built to bridge that gap.

The misc ledger challenge. The event stream is not just trades. The miscellaneous ledger contains internal transfers, spot transfers, vault deposit and withdrawal flows, vault leader commissions, staking rewards, and liquidation overrides. Each of these event types has a different state transition function. A trade against an existing position requires weighted average entry price calculation. A trade that flips a position from long to short requires realizing PnL on the closed portion and establishing a new entry on the remainder. Funding payments accrue continuously but settle discretely. Missing any single event type produces cascading errors across all downstream account states.

Validation against the clearinghouse snapshot. We validated the reconstruction by comparing our computed account states against the L2 snapshot at 847 checkpoint boundaries during the cascade. The maximum divergence across all 437,723 accounts at any checkpoint was less than $0.01, attributable to floating point rounding in funding rate accumulation. This gives us high confidence that our replay engine produces clearinghouse equivalent state transitions.

The reconstruction revealed that 34,983 ADL fills executed during the cascade. Each fill has a source account, a target account, a fill size, a fill price, and a resulting PnL impact on the target. By replaying these fills against the reconstructed account states, we can compute exactly how much wealth was transferred from each target, whether the fill amount was proportional to their position, and whether the fill price was fair relative to the market at that instant.

The deterministic replay also allows counterfactual analysis. What if the ADL allocation algorithm had been different? What if fills were distributed pro rata across all eligible targets rather than concentrated on the most profitable? These counterfactuals require a validated base case, which is exactly what the reconstruction provides.

The cascade began at 14:23:07 UTC on October 10, 2025. A series of large market sells in altcoin perpetuals pushed three accounts below their maintenance margin thresholds simultaneously. The liquidation engine engaged. Within 200 milliseconds, it became clear that the order book could not absorb the liquidation volume. ADL activated.

T+0s (14:23:07 UTC). Three accounts holding leveraged long positions in DOGE PERP, PEPE PERP, and WIF PERP breach maintenance margin. Combined position notional: $47.2M. The liquidation engine begins unwinding at the bankruptcy price.

T+3s. Order book depth on DOGE PERP is insufficient. The best bid is 2.3% below the bankruptcy price. ADL Wave 1 fires. The HLP vault absorbs $185.5M in notional across 12 tickers. 2,847 target accounts receive forced closes.

T+18s. The HLP vault's realized loss from Wave 1 triggers margin calls on its own cross margined positions. The vault's effective leverage increases from 1.8x to 3.2x. Its positions in ETH PERP and BTC PERP are now consuming disproportionate margin.

T+34s. Wave 3 fires. This is the largest single wave: $386.6M in notional across 28 tickers. The Liquidator vault is now active alongside HLP. The cascade has spread from altcoins to mid cap perpetuals. SOL PERP, AVAX PERP, and LINK PERP are now affected.

T+67s. Funding rates on BTC PERP spike to 0.15% per 8 hours as the cascade creates artificial selling pressure. Long positions across the entire book are hemorrhaging unrealized PnL from both price impact and funding accumulation.

T+112s. The cascade enters a feedback loop. ADL fills on the vaults increase their leverage. Higher leverage reduces their available margin. Reduced margin triggers further liquidations. Those liquidations trigger more ADL. The system is now self reinforcing.

T+189s. Wave 8 fires. BTC PERP is now included in the ADL set for the first time. The cascade has propagated from meme coins through altcoins to majors. 4,211 additional accounts are targeted.

T+267s. The HLP vault's equity has declined 34% from its pre cascade level. The vault is still solvent but operating at 5.7x effective leverage. Every additional ADL fill against the vault increases this ratio.

T+398s. Wave 13, the second largest individual wave at $738.2M notional. By this point the cascade is operating across 89 tickers simultaneously. The Liquidator vault is absorbing fills at 8.1x leverage.

T+534s. The rate of new ADL fills begins to decelerate. Mark prices are stabilizing as arbitrageurs provide fresh liquidity. The feedback loop is losing energy.

T+641s. The final large wave executes. 1,122 accounts targeted across 34 tickers. Combined notional: $112.8M. The vaults' leverage begins declining as realized losses create room for margin reallocation.

T+714s (14:34:58 UTC). The last ADL fill executes. Total elapsed time: 11 minutes and 51 seconds. The clearinghouse has processed 34,983 ADL fills across 162 tickers affecting 19,337 unique accounts. Total notional: $7.614 billion. The HLP vault has absorbed approximately $4.8 billion. The Liquidator vault has absorbed approximately $2.4 billion. Retail accounts received the remaining $400 million in forced closes.

The central finding of our forensic reconstruction is that Hyperliquid's ADL safety mechanism is itself the primary vector for systemic risk transmission. This is not a bug in the implementation. It is an emergent property of the vault architecture.

The HLP vault and Liquidator vault together sourced 95.1% of all ADL fills during the cascade. These two entities are not independent market participants making individual risk decisions. They are pooled capital vehicles with thousands of depositors. When the clearinghouse selects them as ADL sources, it socializes a bilateral risk event across the entire depositor base.

Consider the mechanics. Trader A takes an overleveraged long position. The price drops. Trader A's account goes bankrupt. The clearinghouse needs to close the position. It looks to the order book first. The book is empty (or the volume is insufficient). So it turns to ADL. The most profitable short positions are selected as targets. But the most profitable shorts are overwhelmingly held by the vaults, because the vaults are the primary market makers.

The vault receives a forced close at the bankrupt trader's bankruptcy price. This price is below the current market. The vault realizes a loss equal to the difference between market price and bankruptcy price, multiplied by the fill size. This loss reduces the vault's equity. Reduced equity means higher effective leverage on remaining positions. Higher leverage means the vault itself is now closer to its own maintenance margin threshold.

This is the feedback loop. The safety mechanism (ADL) impairs the capital base (vaults) that provides the safety net (market making and liquidation absorption). Each ADL fill makes the next one more likely. The firewall is catching fire.

In a bilateral counterparty system, Trader A's bankruptcy affects only Trader A's counterparties. In a vault mediated system, Trader A's bankruptcy affects every depositor in the vault, and by extension every trader whose positions are margined against the vault's market making activity. The risk is not contained. It is amplified and distributed.

The 95.1% vault concentration is not incidental. It is structural. The vaults are designed to be the most profitable market participants. The ADL algorithm selects targets based on profitability. Therefore the vaults will always be the primary ADL targets. The architecture guarantees that the safety mechanism will preferentially impair the system's core liquidity infrastructure.

This does not mean the architecture is wrong. It means the architecture has a known failure mode that manifests under extreme market stress. The cascade proved that this failure mode is real, not theoretical. $7.6 billion in forced closes, 95.1% flowing through two pooled vehicles, in under 12 minutes. The system survived. The depositors bore the cost.

The ADL algorithm selects targets based on a ranking function that prioritizes profitability and leverage. The most profitable position on the opposite side of the liquidated account is selected first. This creates a perverse incentive structure: the better your trading performance, the more likely you are to be forcibly closed during a cascade.

Our reconstruction reveals the profile of a typical ADL target. 99.4% of targeted accounts were profitable at the time of the fill. The median effective leverage of targeted accounts was 0.20x. These are not degenerate gamblers. These are conservative, well margined traders who happened to be on the right side of the market.

The median ADL target had been holding their position for over 72 hours before the cascade. They had accumulated unrealized profit through patient directional exposure with low leverage. The ADL mechanism rewarded their prudence by forcibly closing their position at a price below market, crystallizing a smaller gain than they would have received had they closed voluntarily.

19,337 unique accounts were targeted during the 12 minute cascade. Of these, 3,847 were targeted multiple times across different tickers. The most heavily targeted individual account received 14 separate ADL fills across 8 tickers in under 4 minutes. Each fill reduced their portfolio exposure and realized PnL at below market prices.

The perverse incentive is structural. If the ADL ranking function selects profitable traders first, then the optimal strategy during periods of systemic stress is to be unprofitable. A trader who is slightly underwater will never be selected for ADL. A trader who is significantly profitable will always be first in line. This creates an incentive to close profitable positions preemptively during volatility spikes, which itself contributes to selling pressure and cascade amplification.

412 accounts had negative equity at the time they were ADL targeted. These were accounts that had been profitable earlier but whose unrealized PnL had deteriorated during the cascade itself. They were targeted based on their ranking at the beginning of the ADL wave, not their real time state. This lag between ranking computation and fill execution introduces a small but measurable source of suboptimal allocation.

ADL fills execute at the bankruptcy price of the liquidated account, not at the current market price. The difference between these two prices, multiplied by the fill size, represents wealth transferred from the target to the clearinghouse. Some of this transfer is necessary to cover the deficit. The remainder is overshoot: wealth transferred in excess of what was needed to restore solvency.

We quantified the overshoot using a two pass replay methodology. In the first pass, we replay the actual ADL fills as they occurred and compute the total wealth transferred from targets. In the second pass, we replay the same cascade but allocate fills using an integer pro rata method that distributes the required closure amount proportionally across all eligible targets rather than concentrating on the most profitable.

The actual cascade transferred between $45M and $52M more than was necessary to restore solvency across all affected accounts. This range reflects uncertainty in the exact funding rate accumulation during the cascade window. The companion paper (Chitra, Thogiti, Trujillo Ramirez, Xu) formalizes the overshoot at $51.7M and proposes an online learning algorithm that reduces it to approximately $3M. The engineering methodology, a two pass deterministic replay against validated account states, provided the empirical foundation for that theoretical result.

The integer pro rata method reduces overshoot by approximately $3M. This is a modest improvement, but it is achieved through a purely algorithmic change with no additional capital requirements. The method distributes fill amounts across all eligible targets in proportion to their position size, using integer rounding to avoid fractional contract fills. This spreads the impact more evenly rather than concentrating it on the single most profitable account.

The remaining $42M to $49M in overshoot is not addressable through allocation algorithm changes alone. It is a function of the gap between bankruptcy prices and market prices at the time of fill. Reducing this gap requires either faster liquidation processing (so positions do not deteriorate as far before ADL triggers) or dynamic bankruptcy price calculation (so the fill price tracks market conditions rather than being fixed at the point of margin breach).

The overshoot is not lost. It accrues to the insurance fund. But from the perspective of the targeted trader, the distinction between necessary socialization and unnecessary overshoot is irrelevant: both manifest as wealth extracted from their account without consent. The overshoot represents a design surface where protocol improvements can reduce harm to innocent participants without compromising solvency guarantees.

HyperReplay is the deterministic event replay engine that Tektonic Company built to reconstruct clearinghouse state from raw event data. It is not a one off script. It is a generalizable tool: anyone with access to Hyperliquid S3 data or clearinghouse snapshots can reconstruct any event window. Swap the time bounds, point at different shards, regenerate.

Why it was created. When we started the reconstruction, there was no single source of truth for what happened on October 10. Hyperliquid's raw event data (node fills, miscellaneous ledger events) lives on S3 as lz4 compressed shards. But the clearinghouse state, the actual account balances and positions, was not publicly available. We obtained a clearinghouse snapshot from the Hydromancer team (AlgoBluffy and Xeno). Two disconnected data sources, no independent verification path. HyperReplay is the engineering answer to: how do you reconstruct a clearinghouse from its raw event stream?

S3 shard extraction. Raw fills are extracted from Hyperliquid's S3 bucket as lz4 compressed archives. Each archive is split into sub 100MB chunks for GitHub distribution, with automatic reassembly on clone. The clearinghouse snapshot is a tar.xz archive containing fills and miscellaneous event JSON covering the 20:00 to 22:00 UTC window.

Misc ledger coverage. The hardest engineering challenge was not trades. It was the miscellaneous ledger. HyperReplay processes internal transfers, spot transfers, vault deposit and withdrawal flows, vault leader commissions, staking rewards, and liquidation overrides. Each event type has its own state transition logic. Missing any single category produces cascading errors across all downstream account states. Getting the misc ledger right was the difference between a reconstruction that validates to $0.01 and one that diverges by millions.

Fixed point arithmetic emulation. Perpetual futures clearinghouses use fixed point arithmetic internally to avoid floating point divergence across distributed validator nodes. HyperReplay must produce identical results using standard IEEE 754 double precision floating point. We achieve this by carefully ordering arithmetic operations to minimize accumulation error and by rounding intermediate results to the clearinghouse's published precision (8 decimal places for prices, 4 for quantities).

Deterministic event ordering. The replay processes events in strict timestamp order. When multiple events share the same timestamp (common during batch liquidations), we use a deterministic tiebreaker: event type priority (ADL > liquidation > trade > funding > fee), then account address lexicographic order. This produces a unique total ordering that matches the clearinghouse's execution sequence.

Continuous validation. Every 100 events, the engine computes a checkpoint hash across all affected accounts and compares against the known state from the L2 snapshot series. If any divergence exceeds $0.01, the engine halts and reports the exact event that caused the drift. During development, this caught three bugs in our funding rate accumulation logic that would have produced cascading errors in later account states.

Two core scripts. extract_full_12min_adl.py handles S3 shard extraction and event normalization. replay_real_time_accounts.py runs the deterministic replay against the clearinghouse snapshot. Together they process 3.2 million events across 437,723 accounts.

Performance. HyperReplay processes approximately 50,000 events per second on a single core. The full cascade completes in approximately 64 seconds. This speed enables rapid iteration on counterfactual scenarios: test alternative allocation algorithms, different vault capital levels, or modified liquidation thresholds and observe results within minutes.

Dependencies. The stack is deliberately lean: Python 3.10+, pandas, lz4, tqdm. No heavy frameworks, no custom infrastructure. The goal was a tool that anyone could clone and run, not a proprietary platform.

The engineering reconstruction was rigorous enough to serve as the empirical foundation for academic work. Tektonic cofounder Mauricio Trujillo Ramirez co-authored "Autodeleveraging as Online Learning" with Tarun Chitra, Keshav Thogiti, and Lily Xu. The paper formalizes ADL as an online learning problem: the clearinghouse must allocate forced closures across targets in real time, without knowledge of future events, while minimizing unnecessary wealth transfer.

Using HyperReplay's validated dataset as its empirical basis, the paper quantifies the overshoot at $51.7M and proposes an algorithm that reduces it to approximately $3M. The key insight is that the current greedy allocation (fill the single most profitable target first) is provably suboptimal under standard online learning regret bounds. A proportional allocation achieves near optimal performance with no additional capital requirements.

The paper was accepted at the Designing DeFi conference at Columbia Business School. This validates the engineering methodology: a reconstruction precise enough to produce clearinghouse equivalent state transitions is also precise enough to support formal theoretical analysis. The paper is the outcome of the engineering work, not the other way around.

The cascade began in three meme coin perpetuals (DOGE, PEPE, WIF) and ended 12 minutes later having touched 162 of Hyperliquid's listed tickers. The contagion path from altcoins to majors is not mysterious. It is a direct consequence of vault concentration and cross margining.

When the HLP vault absorbs an ADL fill on DOGE PERP, the loss reduces the vault's total equity. But the vault holds positions across all 162 tickers simultaneously. Reduced equity means higher effective leverage on every position the vault holds. If the vault's ETH PERP position was at 2.0x leverage before the DOGE ADL fill, it might be at 2.3x after. A few more fills and it approaches its own maintenance margin on ETH PERP.

This is the multi asset contagion mechanism. ADL fills on asset A impair the vault's equity, which increases leverage on assets B, C, D through Z. If the vault is subsequently liquidated on asset B, that triggers more ADL. The targets of that ADL are the most profitable shorts on asset B, which may include other vaults or large accounts that also hold positions across many assets. Each hop in the contagion chain spreads the stress to new tickers.

Our reconstruction traces the exact contagion path. Wave 1 affected 12 tickers (all meme coins and small cap altcoins). By Wave 3, 28 tickers were involved (adding mid cap alts). Wave 8 brought BTC PERP into the cascade for the first time. By Wave 13, 89 tickers were simultaneously in ADL. The peak was Wave 19 at 142 tickers. The cascade had spread from a $47M altcoin liquidation to encompass the entire perpetual book.

The HyperMultiAssetedADL repository contains the full contagion analysis, including ticker by ticker entry timing, the weighted directed graph of cross asset transmission, and simulation code for testing diversification thresholds that would break the contagion chain.

The October 10 cascade produced four concrete lessons for perpetual futures protocol designers. These are not speculative recommendations. They are findings derived directly from the forensic reconstruction of a real event.

Lesson 1: Vault concentration is systemic risk. When 95.1% of ADL fills flow through two pooled vehicles, the ADL mechanism cannot be analyzed as a bilateral risk event. It is a systemic event by construction. Any protocol that routes liquidation overflow through concentrated vaults must model the feedback loop: ADL impairs vault equity, which increases vault leverage, which triggers more ADL. The circuit breaker does not exist in the current architecture. The vaults absorb until they cannot, and the cascade runs until external liquidity arrives or positions are exhausted.

Lesson 2: Profitability based targeting creates perverse incentives. If the ADL ranking function selects the most profitable traders first, rational actors will avoid being profitable during stress periods. This manifests as preemptive position closure by sophisticated traders at the first sign of cascade risk, which removes liquidity from the book exactly when it is needed most. The incentive structure rewards poor risk management (low leverage, low profit = low ADL probability) and punishes good risk management (well margined positions with accumulated profit = high ADL probability).

Lesson 3: Overshoot is a solvable engineering problem. The $45M to $52M in unnecessary wealth transfer is not an inherent cost of ADL. It is a consequence of allocating fills to the single most profitable target at the full bankruptcy price spread. Integer pro rata allocation reduces overshoot by $3M with no capital requirements. Dynamic bankruptcy price calculation (adjusting the fill price toward market as the cascade progresses) could reduce it further. These are implementable improvements with well understood tradeoffs.

Lesson 4: Clearinghouses need public monitoring. The October 10 cascade was observable only after the fact, through manual reconstruction of L1 data. No public dashboard showed real time vault leverage, ADL queue depth, or contagion spread during the event. Traders whose positions were being forcibly closed had no advance warning. The absence of real time monitoring is not a technical limitation. The data exists on chain. It is a design choice that prioritizes operational opacity over participant awareness. Public clearinghouse health metrics (vault leverage, ADL queue depth, insurance fund utilization) would enable market participants to make informed decisions during stress events rather than discovering their positions were closed after the fact.

We acknowledge several limitations in our reconstruction methodology.

Event ordering ambiguity exists for events sharing identical millisecond timestamps. Our deterministic tiebreaker (event type priority, then account address) produces consistent results but may not exactly match the clearinghouse's internal ordering for co temporal events. This affects approximately 2.3% of events in the cascade window and produces maximum per account divergence below $0.01.

Funding rate precision is limited by the published rate schedule. Hyperliquid publishes funding rates at discrete intervals, but internal accumulation may use higher precision intermediate values. Our funding calculations use the published rates, which introduces rounding error that compounds across many events. This is the primary contributor to our $0.01 maximum divergence threshold.

The overshoot estimate range ($45M to $52M) reflects genuine uncertainty in the timing of funding settlement during the cascade. The lower bound assumes all funding settled at wave boundaries. The upper bound assumes continuous settlement. The true value lies somewhere within this range but cannot be determined without access to the clearinghouse's internal state machine. We report the range rather than a point estimate because precision requires certainty we do not have.

Our counterfactual analysis (integer pro rata improvement) assumes the same market conditions would prevail under the alternative allocation method. In practice, different allocation methods would produce different market microstructure responses, which would alter mark prices, which would change subsequent ADL targeting. The $3M improvement estimate should be understood as a first order approximation, not a guaranteed outcome.