The ADL Trilemma: What Your Winning Position Costs on a Pooled Permissionless Venue

Hyperliquid’s cross-margin auto-deleveraging mechanism fired for the first time in the venue’s history. In twelve minutes, the system force-closed approximately $2.1 billion of positions at bankruptcy-price levels — not because those positions had themselves breached margin, but because someone else’s defaulted loss exceeded what the venue’s backstop vault and insurance pool could absorb. The traders whose books were closed had, in many cases, called the move correctly. The mechanism settled their winning legs at a price that did not reflect the gain they had ridden their positions to.

an arxiv preprint. Its central result is uncomfortable: no auto-deleveraging policy can simultaneously satisfy exchange solvency, exchange revenue, and trader fairness. The three goals form an impossibility trilemma. Every real-world implementation sacrifices at least one of them, and the trade-off is structural rather than tunable.

CME Group runs 24/7 crypto futures on Globex with central clearing through CME Clearing, the contrast becomes architectural rather than rhetorical. Two questions follow. What is an institutional desk actually exposed to when it trades on a pooled-architecture permissionless venue? And how is the cost of that exposure priced — or, more often, mispriced — against the funding rate, spread, and fee economics that drive venue selection today?

What ADL is, and where it sits in the waterfall

Every leveraged perpetuals venue carries a default-management waterfall. Five stages, in order.

Stage one: orderbook liquidation. When a trader’s collateral breaches maintenance margin, the venue’s engine attempts to close the position into open bids or offers on the book. If depth is adequate and the spread is tight, the venue takes the difference between the trader’s bankruptcy price and the actual fill as liquidation revenue. The waterfall ends here in most cases.

Stage two: backstop vault. When orderbook depth is insufficient, the position rolls to a designated liquidity vault that absorbs the trade at the bankruptcy price. On Hyperliquid, this is the HLP — the Hyperliquid Liquidity Provider — partitioned into sub-pools that take over one liquidation at a time. HLP earns the spread when it subsequently closes the position above the bankruptcy price and eats the loss when it cannot.

Stage three: insurance fund. When HLP or its equivalent on other venues is exhausted, the venue draws on its insurance fund — a pool of capital seeded by the venue, sometimes augmented by skimmed liquidation profits, sometimes funded by protocol fees. The fund pays the difference between the bankruptcy-price loss and what earlier stages recovered.

Stage four: auto-deleveraging. When the insurance fund cannot absorb the loss, the venue activates ADL. It force-closes profitable counterparty positions at the bankruptcy price of the defaulting trader. The selection is typically ranked by some product of profitability and leverage — the most profitable, highest-leverage positions on the opposing side are closed first. The trader being closed receives the bankruptcy-price proceeds, not the mark-to-market PnL the position carried at the moment of closure.

Stage five: socialised loss. If even ADL is insufficient, the loss is distributed across remaining open positions or absorbed by the venue’s general balance sheet. This is the configuration that has bankrupted permissionless venues historically and remains the rationale for the four stages that precede it.

The reason ADL is the institutionally consequential stage is that stages one through three operate on the defaulting trader’s capital and the venue’s own balance sheet. Stage four operates on uninvolved counterparties’ capital. A trader who has done nothing wrong — has not breached margin, has not over-leveraged, has not mis-managed risk — has their winning position closed because the venue’s earlier defences were inadequate to absorb a different trader’s defaulted loss. This is not a bug. It is the architectural decision the venue made when it chose to pool counterparty exposure rather than isolate it.

The impossibility trilemma

The December 2025 paper formalises what experienced derivatives engineers have understood for some time. Suppose you want an ADL policy that delivers three things at once. Solvency: after every cascade, the venue remains capitalised to continue operating. Revenue: the venue’s earnings structure — liquidation revenue, fee revenue, market-making spread — is preserved through the cascade rather than wiped out. Fairness: the traders being closed receive proceeds proportional to what their positions would have realised under a normal close.

The three goals form a constraint set with no feasible solution. Maximise solvency and revenue, and you close winners at bankruptcy price — the fairness violation that defines real-world ADL events. Maximise solvency and fairness, and you eat venue revenue by paying out at mark-to-market — which compromises the going-concern viability that solvency was supposed to deliver. Maximise revenue and fairness, and you cannot guarantee solvency in tail scenarios. Every real-world policy makes one of these trade-offs explicit and the others implicit.

Hyperliquid’s October 10, 2025 cascade is the cleanest available case study. The venue chose solvency and revenue. Traders on the closed side absorbed the fairness cost — measured not in their own trading decisions, but in the gap between bankruptcy-price proceeds and the realised PnL the positions had carried into the cascade. The post-event coverage focused on the cascade trigger and the speed of the unwind. The structural property that drove the outcome — the fact that ADL had to fire at all, because the venue’s architecture pools counterparty exposure and the pool ran out of capacity — received less attention than it warranted.

What the trilemma costs at institutional size

The retail framing of ADL exposure is that it is a tail-risk event affecting highly-leveraged speculative positions. This framing understates the institutional cost in two ways.

The first understatement is the asymmetry of the ranking. ADL closes the most profitable, highest-leverage positions on the opposing side first. An institutional desk running a successful directional position into a cascade is precisely the configuration ADL is designed to close. The desk’s success at calling the move is the property that puts it at the front of the queue. A losing position is, mechanically, less likely to be ADL’d than a winning one.

The second understatement is the structural effect on hedged strategies. Consider a $50 million long-spot, short-perp basis trade — spot held off-venue at a regulated custodian, short perp on a pooled permissionless venue. The position is delta-neutral by design. Directional exposure is zero. The desk is harvesting funding. In a cascade event, the venue ADLs the desk’s short perp leg. The spot leg is now naked long, directionally exposed in the middle of a falling market the desk did not intend to position against. Two simultaneous problems emerge: a directional loss on the unhedged spot leg that was never part of the strategy’s risk profile, and a re-execution cost to rebuild the hedge at a different price level than the original entry.

The structural point is that ADL violates the trader’s risk-management premises. A trader can hedge delta. A trader can size leverage. A trader cannot ex-ante hedge against the venue itself force-closing the winning leg of a paired position to balance its own books. The only structural defence is to not trade on an ADL-enabled venue at size when cascade conditions are plausible — which, for an institutional desk operating across multiple cycles, is most of the time.

What CME’s May 29 launch puts on the table

CME’s central-clearing model handles defaulted counterparty losses through a different waterfall entirely. The clearinghouse — CME Clearing — sits between every buyer and every seller. When a clearing member defaults, the loss flows through a documented sequence: defaulting member’s posted margin, defaulting member’s guaranty fund contribution, mutualised guaranty fund contributions from non-defaulting members, CME’s own capital, and only at the bottom of the stack do assessments against non-defaulting members apply. No profitable counterparty position is force-closed to fund the cascade. The cost is regulatory perimeter — contract size limits, account-level KYC/AML, no pre-trade privacy, contract specifications that do not match every desired exposure — but the tail-risk property is qualitatively different.

The institutional desk evaluating the May 29 inflection sees this clearly. CME’s market-microstructure cost is regulatory. Hyperliquid’s market-microstructure cost is ADL tail-convexity. These are not the same trade-off in different packaging. They are different architectural decisions with different failure modes, and the right venue for a given strategy depends on which trade-off is binding for that strategy.

The configuration where neither trade-off works is the institutional desk that needs block execution at size, on a permissionless rail, without the regulatory perimeter and without the ADL tail-risk. That configuration is what the third tier of the institutional perp landscape — distinct from the regulated rail and from the prime-brokerage bridge — addresses architecturally. Bilateral per-trade settlement is the structural primitive: each trade settles between a specific trader and a specific solver, in isolation, with no pool to draw from and no waterfall to fall into. Counterparty risk concentrates at the solver level rather than pooling across the book. There is no insurance fund to deplete, and therefore no ADL ranking to fall into.

This is not the institutional case for any particular venue. It is the architectural case for the configuration. The trade-off is real: bilateral isolation exchanges pooled exposure for solver-specific exposure, which makes solver-selection diligence a first-class risk-management task rather than a procurement question. Institutional desks that internalise the trade-off and price it explicitly take a different decision than desks that treat funding rate and fee schedule as the primary venue-selection criteria.

The questions to ask before May 29

The four-week window before the CME launch installs a two-tier mental model — regulated rail versus permissionless DEX — is the available period in which the three-tier picture is the active framing. Three questions are worth running through your execution stack before that window closes.

First: what is your exposure to ADL ranking under cascade conditions? If your strategy runs profitable positions through periods of elevated cross-asset volatility on pooled-architecture permissionless venues, you are at the front of the closure queue precisely when the strategy is delivering. The exposure is not theoretical and not retail.

Second: how are you pricing the impossibility trilemma in your venue-selection economics? If the funding rate, spread, and fee structure are your three inputs, you are pricing the venue’s revenue model — which is one of the three goals the trilemma compromises. You are not pricing the fairness cost the trilemma resolves in the venue’s favour. That cost lands in your realised PnL during cascades, not in your ex-ante economics.

Third: which architectural primitive does your strategy structurally require? Strategies that need pool-backed liquidity provision are not the configuration this piece addresses; they need the pool, and ADL exposure is the cost of using it. Strategies that need block execution at size with pre-trade privacy and bilateral settlement isolation need a different primitive entirely. The conflation of the two configurations under “permissionless DEX” obscures the architectural distinction. CME’s May 29 launch does not resolve the distinction. It surfaces it.

The question is not whether ADL is good or bad. It is whether the trade-off the trilemma forces on every pooled permissionless venue is the trade-off your strategy was designed to make. For most institutional desks running paired or cross-rail flow at size, the answer has been negative for some time. The May 29 launch is the occasion to make the answer explicit before the convergence-narrative framing of the next four weeks installs as default.