Is Hyperliquid decentralized? The doubts of the MAS and Samani

As of July 13, 2026, Hyperliquid liquidates billions of dollars a day in perpetuals (futures without expiry) with only 27 active validators, a node binary whose full source code has yet to be released, and a Foundation that, according to public criticism not denied by the team, can remove validators from the active set — and yet it presents itself as «permissionless» infrastructure. This tension boiled over on June 26, when the Monetary Authority of Singapore (MAS, the country's central bank and financial regulator) added Hyperliquid to its Investor Alert List, and investor Kyle Samani, formerly of Multicoin Capital, took the opportunity to publicly question the label. This article separates two things that most coverage conflates: the regulatory signal from Singapore (which is neither a sanction nor an accusation of fraud) and the technical critique of decentralization (which is verifiable, point by point). To answer the fundamental question —is Hyperliquid truly decentralized?— we cross-reference what the definition of «permissionless» would require with what the network actually does, layer by layer, with figures and dates.

What exactly did the Singapore MAS do on June 26, 2026?

On June 26, 2026, the MAS added Hyperliquid to its Investor Alert List (IAL), a public registry of entities that Singapore residents might mistake for firms licensed or authorized by the regulator when they are not. The MAS noted that Hyperliquid is not licensed or authorized to provide financial services in the country. There was no fine, cease-and-desist order, or accusation of wrongdoing.

Hyperliquid responded on its official X account that the inclusion "does not constitute a prohibition, an enforcement action, or a finding of misconduct," and reminded that it has never claimed to be licensed by the MAS: as permissionless infrastructure, users maintain self-custody of their funds and all operations are settled transparently on-chain. This nuance matters, because an IAL does not state that a platform is fraudulent; it states that it is not under the regulator's umbrella. It defines which protections the Singaporean retail investor loses, and nothing more.

Why is an Investor Alert List not a sanction?

The IAL is a warning tool, not an enforcement one. Its function is to warn retail investors that if they trade with an entity on the list, they do not have the protections that the MAS requires from regulated firms. Hyperliquid is not an isolated case: the MAS added Bybit to the same list on June 17, 2026, and KuCoin and Bitget were already previously listed. It is a pattern of risk framing directed at global exchanges without local licenses, rather than a campaign against a specific actor.

What makes the Hyperliquid case unique is the label it carries. Bybit, KuCoin, or Bitget are centralized exchanges: no one disputes that an operator controls them. Hyperliquid defines itself as decentralized and permissionless, and that is where the regulatory alert—however legally innocuous—served as the spark for the question the MAS itself did not ask: how many hands does it take to stop this network?

What is Kyle Samani's critique of the "permissionless" label?

On June 26, almost in parallel with the MAS news, Kyle Samani—co-founder of Multicoin Capital, the firm he left in February 2026, and chairman of Forward Industries—argued that Hyperliquid does not meet the standard of a genuinely permissionless chain. His thesis has three specific and verifiable pillars:

First: a permissionless network should run open-source validator software, yet the Hyperliquid node distributes signed binaries—pre-compiled executables—instead of the full source code. Second: validators should be globally distributed, not concentrated in a small set. Third: Samani contends that the Hyperliquid Foundation can "jail" validators—removing them from the active set—and force software updates on nodes that do not control their own instance. None of these three points are opinions on price or product quality: they are claims about architecture, and they can be verified one by one.

How many validators does Hyperliquid have and who controls the code?

The specific numbers, as of July 13, 2026: the network operates with 27 active validators, expanded from 24 on June 7, 2026; following the June redelegations, the Foundation's validators retain 49.3% of the stake. The node repository distributes signed binaries and the team has stated they will open the full source code when HyperCore (the chain's order book engine) reaches "feature completion" — a condition with no associated public date. We will not re-narrate the mechanics of HyperBFT and HyperCore here, which we broke down in the architecture of HyperCore and HyperEVM; what is relevant for this question is the contrast with what the definition of "permissionless" would require.

The first row is the one Hyperliquid defends most strongly: for the user opening a position, the platform is effectively permissionless—it does not ask for identity, does not custody funds, and settles on-chain. The following four rows are what support Samani's critique. Decentralization in crypto is not an on/off switch, but a gradient measured by layers; and in three of the five, Hyperliquid is far from the extreme that the word "permissionless" suggests to a non-technical reader.

The number of validators is not a cosmetic figure. Byzantine Fault Tolerance (BFT) consensuses —the family to which HyperBFT belongs— require at least two-thirds of validators to act honestly for the chain to progress securely. With 24 nodes, that threshold is crossed with the coordination of a handful of actors; with Ethereum's ~900,000 validators, malicious coordination is economically unfeasible. Many high-performance chains deliberately sacrifice decentralization for latency, and 24 is not a "bad" number in itself; the problem is that this compromise falls outside of what the "permissionless" label conveys to non-operators. A small set also means fewer jurisdictions of residence for operators, precisely the point Samani emphasizes: a geographically concentrated network is easier for a single regulator to pressure.

What was the JELLY incident and why does it matter in this debate?

The "intervention history" row is not theoretical. In March 2025, an attacker manipulated the price of the JELLY token to damage the HLP (Hyperliquidity Provider, the community vault acting as the system's counterparty), which accumulated up to $13.5 million in unrealized losses. The response was a validator vote to manually delist the token and close the short position at a fixed price of $0.0095, protecting the vault from the loss. It worked as a lifesaver, but it set a precedent: a small set of validators can intervene in a market by discretionary decision when the system is at risk.

For the MAS and Samani debate, JELLY is proof that the capacity for centralized intervention has already been exercised; it is no longer just a whitepaper concept. Those who argue that the network is "permissionless" must explain why a handful of validators were able to remove a market overnight. Those who criticize it must acknowledge that the intervention saved the vault from an unrealized loss that reached approximately 13.5 million dollars. Both interpretations are supported by the same fact.

Does the trade.xyz "rebase" on SpaceX add to or subtract from the argument?

A second, more recent case feeds the same question from another angle. HIP-3 is the October 2025 update that allows anyone to deploy perpetual markets on Hyperliquid by staking 500,000 HYPE. On paper, it is the most "permissionless" face of the system; in practice, a single builder—trade.xyz, from the Hyperunit team—concentrates more than 90% of the open interest of all HIP-3 markets, which grew from about $790 million in January 2026 to a peak of $3.2 billion in June.

The controversy arrived with the SpaceX pre-IPO contract. According to PANews (June 11, 2026), SpaceX's S-1 prospectus revealed an actual share capital of 13.08 billion shares, about 10% more than the 11.87 billion the market had been assuming. At a constant valuation, the theoretical price per share should have adjusted downward by about that 10%. Traditional exchanges apply a rebase—an automatic contract readjustment—in these cases. trade.xyz refused: it maintained that its product logic does not depend on capital data and let the order book recalibrate itself. Result: longs absorbed the dilution as a direct loss, with liquidations for leveraged traders and no compensation. This is a platform decision—made by a builder, not the market—that reproduces on a smaller scale the same tension as the JELLY case. We covered the full pre-IPO setup in the Trade.xyz framework on Hyperliquid and the subsequent convergence in the SPCX price post-mortem.

Does Kyle Samani have a conflict of interest in criticizing Hyperliquid?

Yes, and it is worth putting on the table without it invalidating his technical argument. Two facts provide verifiable context. In January 2026, days before Samani's first public attack (February 8), a wallet attributed to Multicoin—the firm he co-founded and left that same month—accumulated more than $40 million in HYPE, according to cryptonews.com; Samani responded that he no longer works at Multicoin. He also chairs Forward Industries, a treasury linked to Solana, an ecosystem that competes with Hyperliquid. Neither fact invalidates his technical argument; both are legitimate context.

That being said, a conflict of interest affects the motivation of the speaker, not the truthfulness of what is said. The fact that Hyperliquid operates with 27 validators, distributes signed binaries, and retains the power to remove validators is verifiable regardless of who points it out. The strategy of dismissing the message based on the messenger works in the realm of reputation; it does not change a single figure in the table above. This is why the previous table uses only figures that neither party disputes: 27 validators, signed binaries, and jail power.

So, is Hyperliquid decentralized or not?

The honest answer as of July 13, 2026, is: it depends on the layer you measure, and Hyperliquid itself does not deny the technical facts—it only reframes what "permissionless" means for its model. At the user access layer, the label holds up: no KYC, real self-custody, and on-chain settlement. At the validator, code, and governance layers, the network is currently closer to infrastructure managed by a small core than to an open network in the style of Ethereum. That is the gap between what the word promises a retail user and what the architecture delivers.

The MAS move and Samani's critique point to different problems that should not be confused: Singapore warns that the platform is not under its regulation—a licensing issue—while Samani questions the actual degree of decentralization—an architectural issue. The only coincidence is that both, through opposite paths, force the user to look beneath the label. The US regulatory front, which runs in parallel with the CFTC and is a different jurisdiction and angle, is covered in the CFTC pressure on Hyperliquid perpetuals. For those who trade, the practical conclusion involves sizing risk with data rather than abandoning the platform or defending it blindly: how many validators there are, what the Foundation can intervene in, and what precedents exist—all summarized in the verifiable table of this article.

Sources and links: CryptoBriefing · Hyperliquid added to MAS Investor Alert List (06-26-2026) · crypto.news · MAS adds Hyperliquid as exchange responds · The Crypto Times · Kyle Samani challenges "permissionless" label · Yahoo Finance · Hyperliquid criticized over decentralization claims · Open Source For You · validator model under open source scrutiny · Phemex · Hyperliquid to expand active set to 27 validators · Halborn · JELLY incident explained (March 2025) · OAK Research · context and solution of JELLY attack · PANews · trade.xyz rebase refusal tests pre-IPO market · Datawallet · Hyperliquid statistics (HIP-3 concentration) · cryptonews.com · Samani's conflict of interest (Multicoin)