What drives protocols and exchanges that claim to be "fair" to flip the table? When we talk about ADL, we cannot only talk about ADL. ADL is the final step of the entire liquidation mechanism. What we need to examine is the complete liquidation mechanism — including liquidation price, bankruptcy price, order book liquidation, insurance fund, and other mechanisms. ADL is merely the final "socialized" outcome. The core is the liquidation mechanism itself — and it is the devastation left after the liquidation mechanism is exhausted that brings us to this moment. (You and I are both responsible.)
As for why ADL is a Greedy Queue — you cannot understand it standing here in the present, amid ample liquidity and calm seas. You need to place yourself in the context of the moment ADL actually occurs, and then you will understand why CEXs design it this way. Because it is the solution with the least risk, the lowest cost, and the smallest psychological burden.
Reading Guide: This article is 7,000+ words and extremely technical. Readers who are unfamiliar with contract liquidation rules are advised to first supplement with some background knowledge before returning:https://x.com/agintender/status/1949790325373026575?s=20
Those who understand the exchange liquidation process can start directly from Chapter Three.
Those only interested in the HLP mechanism are advised to skip directly to Chapter Five.
I. ADL Is the Exchange's Life Preserver — Not a Counterweight for Fairness
ADL (Auto-Deleveraging) is a system-level risk backstop mechanism in perpetual contract markets. When markets experience violent swings, some accounts become insolvent, and the exchange's insurance fund is insufficient to cover these losses — the system activates ADL, forcibly closing a portion of profitable accounts' positions to fill the gap, thereby preventing the entire liquidation system from failing. It is important to note that ADL is not normal operation — it is a "last resort" deployed only in extreme circumstances.
After ADL is triggered, the system reduces positions according to a set of clear but not fully public priority rules. Generally speaking, positions with higher leverage and larger floating profit ratios are more likely to be placed at the front of the ADL queue for "position optimization."
On the core of ADL, here is a passage directly from Binance's own discussion:
[Image: Binance ADL description]
Key points:
The current derivatives mechanism is already prepared for "insolvency."
ADL is the final step of the forced liquidation process.
It only occurs when the contract risk protection fund cannot absorb the losses.
The larger the risk protection fund, the less frequently ADL is triggered.
Activating ADL has a bad impact on the market — it is equivalent to using profitable traders' money to subsidize loss-makers' mistakes (especially since the profitable traders are usually large players, and reducing their profits means offending them).
We cannot prevent ADL, but we will try every possible way to minimize it.
For an exchange or protocol, if the purpose of the liquidation mechanism is to ensure fairness, then ADL is to ensure survival.
II. The Liquidation Waterfall: From Market Execution to ADL Trigger
Since ADL is a component of the liquidation mechanism, to understand the details of ADL triggering, we must start from the source.
Generally speaking, exchanges follow a "waterfall" sequence for liquidations:
Phase One: Order Book Liquidation When a user's maintenance margin is insufficient, the liquidation engine first attempts to place the position as a market order — or split it into multiple smaller limit orders — into the order book.
Ideally, market depth is sufficient: the long close order is absorbed by short limit orders, the position closes, and the remaining margin is returned to the user. But in a crash like 10/11, buy orders dry up and the massive liquidation order directly blows through the order book, causing uncontrollable price slippage and direct insolvency — which triggers the second step.
Phase Two: Risk Protection Fund Takes Over When the order book cannot absorb the order, or the user's position is approaching the Bankruptcy Price, to prevent further price collapse, the exchange's insurance fund intervenes.
The risk protection fund acts as the "buyer of last resort," taking over the position at a price near (or in some exchanges, better than) the bankruptcy price. The fund then attempts to slowly unwind this position in the market. At this point the fund holds a massive losing position (inventory risk). If prices continue to fall, the fund itself incurs losses.
Phase Three: ADL Triggered This is the most critical step. When the risk protection fund is exhausted or reaches a threshold — or when the fund's risk assessment determines that taking over the position would cause its own insolvency — the system refuses to take over and directly triggers ADL.
The system identifies "sacrifices" among the counterparty (i.e., traders who got the direction right and are currently profitable), forcibly closing their positions at the current mark price to offset the imminently insolvent losing position.
Underline this: ADL actually has a very important function here that almost nobody mentions — which is that in conditions of insufficient market liquidity, it uses winners' money to stop the price decline.
Think about it: without ADL, the insurance fund — in order to survive — would keep executing orders in the order book, which would continuously push prices up or down, triggering more and more cascading liquidations.
III. The Transmission Effect of Two Liquidation Modes on ADL
Many people know about ADL, but few probably understand the liquidation modes that precede it. Generally speaking, there are two primary modes — and most of the more innovative liquidation modes today are improvements built on top of these two.
Liquidation is the prelude to ADL. Different liquidation approaches directly determine the frequency, depth, and market impact of ADL triggers. Talking about ADL without discussing liquidation modes is just misleading people.
3.1 Mode A: Order Book Liquidation (Dump Mode)
Mechanism: When a user triggers the liquidation line, the liquidation engine directly throws the position as a market order into the order book for execution.
Role of the insurance fund: Used only to cover "insolvency losses." That is, if the market order hammers the price below the Bankruptcy Price, the gap is covered by the insurance fund.
ADL trigger logic: ADL is only triggered when the risk protection fund goes to zero, or the order book is completely exhausted (no buyers at all). However, most exchanges have now changed their algorithms so that ADL triggers when the risk protection fund falls below a certain threshold (generally when the fund balance has fallen x% from its recent peak over some time period) — not only after the fund hits zero. (Therefore, trigger frequency is increasing.)
Market impact:
Advantage: Respects market pricing as much as possible; does not interfere with profitable users.
Disadvantage: In extreme conditions like 10/11, a massive liquidation order instantly blows through liquidity, causing cascading liquidations. Prices crash because of the liquidation orders themselves, causing more liquidations — rapidly exhausting the risk protection fund.
3.2 Mode B: Backstop / Absorption Mode
Mechanism: When a user triggers the liquidation line, the system does not immediately dump into the order book. Instead, a liquidity provider / insurance fund directly takes over the position.
Role of the risk protection fund: It "buys" the user's liquidated position at the bankruptcy price. After absorbing it, the fund attempts to sell the position in the market at an opportune time. If the execution price is better than the position price, the profit is credited to the insurance fund; otherwise, the loss is borne by the insurance fund.
ADL trigger logic: This is the most critical distinction between the modes.
In Mode A, ADL is triggered when market liquidity is exhausted and the insurance fund runs out of money to cover losses.
In Mode B, ADL is triggered by the risk control thresholds of the risk protection fund.
IV. Deep Validation and Simulation of Both Liquidation Modes
To answer "how do different liquidation mechanisms affect ADL," let us first establish a mathematical model to simulate the behavior of Mode A and Mode B in extreme market conditions.
4.1 Scenario Assumptions
Market environment: ETH price crashes instantaneously. Current market depth is extremely poor; buy orders are scarce.
Defaulting account (Alice):
Position: Long 10,000 ETH
Liquidation trigger price: $2,000
Bankruptcy price: $1,980
Current order book:
Best bid: $1,990 (only 100 ETH)
Second bid: $1,900 (only 5,000 ETH) — cliff-like depth gap
Third bid: $1,800 (10,000 ETH)
4.2 Mode A: Order Book Dump Mode
Mechanism: The liquidation engine, without any buffer, directly throws Alice's 10,000 ETH as a market sell order into the order book.
Simulation: (simplified calculation — just follow the big picture)
Execution:
100 ETH @ $1,990
5,000 ETH @ $1,900
4,900 ETH @ $1,800
Volume-Weighted Average Price (VWAP):
[(100 × 1,990) + (5,000 × 1,900) + (4,900 × 1,800)] / 10,000 = $1,852
Insolvency loss:
Alice's bankruptcy price is $1,980.
Loss per ETH: $1,980 − $1,852 = $128
Total insolvency loss: $128 × 10,000 = $1,280,000
ADL trigger:
If insurance fund balance < $1.28M → system must immediately trigger ADL.
The system finds Bob, a large profitable short, and force-closes him at $1,980 (even though the current market price is already $1,800 — Bob could have earned much more).
Mode A causes the price to instantly crater to $1,800, creating enormous slippage losses, directly blowing through the insurance fund and causing ADL to trigger immediately and at scale.
4.3 Mode B: Backstop / Absorption Mode
Mechanism: The liquidation engine does not dump into the order book. The insurance fund (or HLP pool) directly takes over Alice's position at the liquidation price ($2,000) or slightly better than the bankruptcy price ($1,990).
Simulation:
Takeover: The risk protection fund pool instantaneously holds a long position of 10,000 ETH, with an entry cost recorded at $1,990.
Market reaction: Order book price remains at $1,990 (because there is no sell pressure dumping). The market looks "calm."
Inventory risk: One minute later, the external market (e.g., Coinbase) drops to $1,850. The fund pool's 10,000 ETH now has a floating loss:
($1,990 − $1,850) × 10,000 = $1,400,000
ADL trigger assessment:
The system does not trigger ADL because of "no money to pay" (since it hasn't sold yet). But it conducts a risk check:
If HLP's total capital is $100M → absorbing a $1.4M loss is manageable → ADL not triggered.
If HLP's capital is only $5M → a $1.4M loss is too large a proportion → to protect LPs, the system decides to throw away this hot potato → ADL triggered.
Mode B protects the order book price from being instantly crushed in the first second of the crash, preventing cascading liquidations. But it concentrates risk inside the insurance fund's belly. If subsequent prices fail to recover, the insurance fund's losses keep growing — ultimately potentially leading to an even more violent ADL (or, as with Hyperliquid on 10/11, aggressively triggering ADL to prevent HLP from being wiped out).
One more note: the reason Hyperliquid triggered ADL on a large scale on 10/11 was not because the system ran out of money — it was because the HLP Vault, to protect itself, proactively transferred risk to profitable users. This was to prevent a repeat of the earlier "Whale Slap" incident (where a whale exploited insufficient liquidity to harm HLP).
Mode B protects the order book price from being instantly crushed, but it concentrates "inventory risk" onto HLP. Once HLP becomes frightened (reaching its risk control threshold), it will extremely aggressively "kill" profitable users' positions via ADL to balance its books and ensure its own survival. Imagine if HLP experienced a 30% drawdown in a single day — what would most people do? They would immediately withdraw funds, causing a bank run.
One additional note: long-time followers know I have repeatedly said that the current generation of Perp DEXs copied the CEX liquidation mechanism wholesale — and that sooner or later this would cause serious problems. I think you can all start to understand what I meant now. Hahaha.
V. Hyperliquid's Special Architecture: HLP and ADL Sensitivity
Hyperliquid's distinctive characteristic is that it does not have an opaque, enormous insurance fund cushioned by years of accumulated exchange profits like Binance or OKX. Its insurance function is borne by the HLP Vault.
5.1 HLP: Both Market Maker and Insurance Fund
HLP is a capital pool composed of USDC deposited by community users. It has a dual personality:
Market Maker: It provides liquidity on the order book, earning the bid-ask spread.
Liquidation Backstop: When the above "Phase Two" occurs, HLP is responsible for taking over users' liquidated positions.
This structure causes Hyperliquid's ADL trigger mechanism to differ fundamentally from that of centralized exchanges:
Binance model: The insurance fund is the exchange's "private savings" — typically having accumulated billions of dollars (presumably — I'm speculating here, no hard evidence). Therefore Binance can tolerate enormous drawdowns and avoids triggering ADL as much as possible to preserve the large-player experience.
Hyperliquid model: HLP is users' money. If HLP loses too much by absorbing a massive toxic position, it will cause LPs (liquidity providers) to panic and withdraw, triggering a "bank run" and killing the exchange. (The Jelly incident already gave HLP a taste of what drawdowns feel like.)
Therefore, Hyperliquid's risk control engine is designed to be extremely sensitive. The moment the system detects that the risk of HLP absorbing a particular position is too high, it immediately skips Phase Two and directly activates ADL. This is why on October 11th, Hyperliquid triggered ADL over 40 times in 10 minutes — while some CEXs, even where they were likely already technically insolvent internally, chose to absorb losses with their own capital.
5.2 Deep Dive: The Liquidator Vault Mechanism
The Liquidator Vault is a sub-strategy within HLP. It is not a separate capital pool but a distinct "liquidation" logic layer.
[Image: Hyperliquid liquidation sequence]
When a trader is liquidated and the market cannot absorb the order (Layer 1 fails), the Liquidator Vault "buys" the defaulted position.
Example: A trader is long 1,000 SOL at $100. Price drops to $90 (liquidation price). Order book buy side is thin. The Liquidator Vault takes over the 1,000 SOL long at $90.
Immediate PnL recognition: The user's remaining margin is confiscated. If the margin covers the difference between the entry price and the current mark price, HLP immediately records a "liquidation fee" profit.
Inventory unwinding: HLP now holds a long position of 1,000 SOL in a crashing market. It must sell these SOL to neutralize the risk. But if these positions cannot be cleared in time and reach the threshold, ADL will be triggered.
VI. Revisiting the 10/11 Event: The Algorithm Game
Now let us return to the core of the controversy: on October 11th, 2025, Hyperliquid processed over $10 billion in liquidations — triggering ADL over 40 times within 10 minutes. Some say this was a complete overreaction. Was it really?
6.1 The Core Controversy: Greedy Queue vs. Pro-Rata
Gauntlet CEO Tarun Chitra pointed out that the ADL algorithm used by Hyperliquid caused approximately $653 million in "unnecessary losses" (opportunity cost).
The focal point of the controversy is the ADL sorting algorithm.
Hyperliquid's algorithm: The Greedy Queue
This is the classic algorithm inherited from the BitMEX era. The system ranks all profitable users by profitability and leverage ratio:
Ranking Score = Profit / Principal × Leverage Multiple
Execution: The system starts from the top-ranked user and completely closes their position until the loss gap is filled.
Result: The "best-performing traders" ranked at the top are "killed." Their positions are gone — while their profits at the time are preserved, they lose the enormous potential gains from the market continuing to fall afterward.
Tarun Chitra's proposed algorithm: Risk-Aware Pro-Rata
Execution: Rather than completely killing the top-ranked user, a partial position reduction (a "haircut") is applied to the top 20% of profitable users — for example, closing 10% of each person's position.
Advantage: Preserves users' partial positions, allowing them to continue benefiting from subsequent market moves. Tarun Chitra's back-testing shows this approach retains more Open Interest (OI) and reduces harm to users.
6.2 Why Does Hyperliquid Persist with the "Greedy Queue"?
Despite Gauntlet's algorithm being theoretically fairer, Hyperliquid founder Jeff Yan's rebuttal articulates the real-world constraints:
Speed and certainty: On an L1 chain, computational resources are expensive. Pro-rata reductions across thousands of users require enormous computation and state updates, potentially causing block delays. The Greedy Queue only needs to sort and cut the top — low computational complexity, extremely fast execution (millisecond-level). In a market crash, speed is life.
HLP's fragility: As discussed above, HLP's capital is limited. Pro-rata ADL means HLP needs to hold partial toxic positions for a longer duration (waiting for the system to slowly compute and execute reductions across all users). For Hyperliquid, rapidly severing risk (by completely closing large players' positions) is more important than so-called "fairness."
VII. What Is the Truth About the Greedy Queue?
If you've read all the way through, you will know that 40+ ADL triggers in 10 minutes is the very essence of HLP's mechanism design. In the face of large traders, the HLP contributors are the true foundation of Hyperliquid.
The Greedy Queue was not invented by Hyperliquid — in fact, it has existed since many years back and is still widely used by major CEXs today. Did they not consider capital pool safety when choosing the Greedy Queue? Did they not face the constraints of computational load and speed? And through all the ADL events in history, did none of the affected large players seek redress? Storm the offices? Obviously not.
The real reason is: for centralized exchanges (CEXs), the Greedy Queue is a solution that, within the existing mechanism, is simultaneously reasonable, relatively fair, and controllable in cost.
Returning to the earlier discussion of liquidation Modes A and B — the conditions for ADL to trigger are:
Violent market swings
Market liquidity essentially in "vacuum" state
The risk protection fund has suffered severe losses
For the large players affected by ADL, they are also aware that at that particular moment, there is insufficient market liquidity to absorb their profitable positions. In earlier years, due to certain technical reasons, during violent market swings people couldn't even log into their exchange accounts — so ADL effectively became a function where the exchange helped them "take profit," since many of those profits at that critical juncture might have been impossible to execute anyway.
Furthermore, psychologically speaking, making less profit is easier to accept than taking a loss — especially when you learn that the exchange itself also took a significant hit. This comparative consolation makes people feel somewhat more at peace.
As for why it must specifically be the Greedy Queue: beyond the slightly strange but intuitive logic of "the more you profit, the more responsibility you bear" — the more primary reason is actually this: fewer people are affected.
What does a CEX fear most? Not insolvency? Not losses? Public opinion. Rather than having a crowd of people suffer losses, they much prefer seeing only a small number of people affected — because then they can resolve it privately, one-on-one or a few-on-one, through back-channel communication. Everyone should understand: the game in the market doesn't end with the liquidation or ADL. There's still the subsequent disputes, complaints, and threats — and many grievances are resolved below the surface.
VIII. Is There a Better Algorithm?
Yes — but not a better ADL algorithm. At this stage, the focus should be on how to prevent ADL from occurring in the first place.
Since this is not the main focus of this article, here is a simple table to cover it briefly. For exchange practitioners, the hints in the chart should be sufficient.
[Image: Prevention framework table]
Of course, if any exchanges have the "courage" to implement a circuit breaker system, that would genuinely stop a lot of unnecessary harm: https://x.com/agintender/status/1990373165957091590?s=20
Know not just the what, but the why.
May we always carry in our hearts a reverence for the market.
Source: https://x.com/agintender