Derivatives · Risk Management · Crypto

The Foreign Hands in Your Pocket: Crypto's Auto-Liquidation Machine

Julian Gretzinger  ·  August 23, 2026  ·  Substack

Abstract

Perpetual futures exchanges — across the full spectrum from regulated Western platforms to offshore venues — embed a mechanism called Auto-Deleveraging (ADL) that can forcibly close a trader's profitable position to cover losses generated by a failing counterparty. This article examines the structural logic of ADL, surveys which exchanges operate it and which do not, reviews its activation history, and frames the mechanism against the contrasting approach taken by traditional regulated derivatives markets.

ADL occupies the third and terminal step of a standardised risk waterfall: standard liquidation, insurance fund absorption, and — when both are exhausted — forced reduction of opposing profitable positions. Academic analysis formally characterises this as a trilemma: no ADL policy can simultaneously satisfy exchange solvency, trader fairness, and revenue maximisation (Chitra, 2025). The mechanism is industry-wide. ADL activations are documented at Binance, BitMEX, Bybit, OKX, MEXC, Hyperliquid, Aevo, and dYdX, among others. Regulated Western entrants including Coinbase, Bitstamp, and now Kraken US also carry ADL provisions in their derivatives documentation. Bitpanda does not currently offer perpetual futures.

The largest ADL episode in crypto history occurred on October 10–11, 2025, when approximately $19 billion was liquidated across venues in a single session. Multiple exchanges activated ADL simultaneously. On Hyperliquid alone, 34,983 individual ADL executions were recorded across 19,337 distinct wallets and 162 tickers, closing roughly $2.1 billion of positions in a twelve-minute cascade. A subsequent academic study estimated that Hyperliquid's production algorithm overshot the minimum profit haircut required to cover the shortfall by between $45.0 million and $51.7 million in PNL dollars — corresponding, in equity terms, to approximately $653.6 million in additional positions closed. The same study shows the damage is a design choice: replacing the industry-standard queue with an optimised allocation reduces the overshoot to approximately $3 million (Chitra, 2025).

The comparison to CME clearing practices is structurally instructive. Regulated derivatives markets resolve solvency gaps through margin calls, trading halts, and clearing-house guarantees — not by seizing profitable positions. The question for practitioners is therefore not whether ADL is rational from an exchange solvency standpoint (it is), but whether it constitutes a counterparty risk that should be explicitly modelled, disclosed, and priced into trading strategies.

A formal impossibility theorem proves that no ADL policy can be simultaneously solvent, fair, and revenue-maximising — meaning every exchange that runs one has already made a value judgement about which of your interests it will sacrifice first.

#finance#markets#crypto#derivatives#riskmanagement

I — The Mechanism: Structural Logic of ADL

Perpetual futures markets are zero-sum systems. Every open long has a corresponding short; every gain is funded by an equivalent loss elsewhere in the book. In normal conditions, this balances cleanly: a losing position is liquidated into the order book, the margin covers the deficit, and the counterparty's profit is realised. The complication arises in tail events — rapid, disorderly price moves that exhaust liquidity before positions can be closed at viable prices.

To manage this, exchanges operate a sequential risk waterfall. When a trader's equity falls below the maintenance margin threshold, the exchange liquidates the position into the market. If the liquidation price is worse than the bankruptcy price — the point at which the account's equity reaches zero — a shortfall arises. Shortfalls are first absorbed by the exchange's insurance fund, a reserve pool accumulated from liquidation surpluses and exchange contributions. When the insurance fund is itself insufficient, the exchange faces a binary choice: absorb the loss on its own balance sheet, or impose it on counterparties. The latter is ADL (Cube Exchange, 2025).

The three-step risk waterfall

  1. Standard Liquidation The losing position is closed into the order book at or above the bankruptcy price. The account's remaining margin covers the deficit. No further action required.
  2. Insurance Fund Absorption If liquidation proceeds fall below the bankruptcy price, the insurance fund covers the shortfall. The fund is replenished continuously from liquidation surpluses and exchange fees.
  3. Auto-Deleveraging (ADL) If the insurance fund is insufficient or depleted, the exchange forcibly reduces opposing positions held by profitable traders. Positions are ranked by a leverage-weighted profitability score; those highest in the queue are reduced or closed first, at the bankruptcy price of the triggering liquidation (Bybit, 2024).

The ranking formula varies by venue but follows a consistent principle: unrealised profit multiplied by effective leverage, normalised by position size. Highly profitable, highly leveraged accounts are reduced first — a design that targets those with the most to lose and the most systemic exposure (OKX, 2020). A 2025 academic paper formalises this as a trilemma: no ADL policy can simultaneously guarantee exchange solvency, maximise revenue, and treat traders fairly. Every implementation is therefore a policy choice about which property to sacrifice under stress (Chitra, 2025).

Perp markets are zero-sum. There is no warehouse of real bitcoin or ether behind a contract — only cash claims moving between longs and shorts. When bids and buffers refuse to absorb the loss, the venue must rebalance instantly to avoid bad debt and cascading failures. — Doug Colkitt, Ambient Finance, paraphrased by CoinDesk, October 2025

II — Exchange Landscape: Who Carries ADL and Who Does Not

ADL is not a feature unique to any single exchange category, jurisdiction, or regulatory status. It is structural to the perpetual futures product itself — a consequence of the zero-sum clearing model, not of any specific business decision. Regulated Western entrants now carry it alongside offshore venues that pioneered it. The relevant distinctions are in trigger design, transparency, and historical activation frequency.

Exchanges with documented ADL mechanisms

Exchanges without perpetual futures or without documented ADL activation

The emergence of regulated Western entrants — Coinbase, Bitstamp, and Kraken — in the perpetual futures market is significant not because it eliminates ADL risk, but because it brings the mechanism under regulatory scrutiny for the first time. Whether CFTC or MiFID frameworks will impose disclosure standards, trigger transparency requirements, or capital adequacy rules for insurance funds remains an open regulatory question as of mid-2026.

III — ADL Activations: Historical Record

ADL is rare in absolute terms but far from theoretical. Documented activations span the full history of the perpetual futures market and cluster predictably around tail liquidity events (Chitra, 2025).

Notable ADL activation events

A structural finding from the academic study of the October 2025 event is worth stating precisely. Hyperliquid's production ADL queue overshot the minimum profit haircut required to restore solvency by between $45.0 million and $51.7 million in PNL dollars; the same overshoot expressed in equity space — as a stylised wealth-space queue diagnostic — corresponds to roughly $653.6 million of additional positions closed, because winners in the affected cohort held equity roughly 6.66x their positive PNL. Under an optimised queue-replacement algorithm inspired by the paper's online-learning framework, the overshoot falls to approximately $3 million. This implies that the harm imposed on profitable traders is not merely a consequence of market stress, but also of queue design — a policy variable that exchanges have discretion over and that currently carries no regulatory minimum standard. The same paper's diagnostic suggests Binance overutilised ADL by a substantially larger margin than Hyperliquid on the same day (Chitra, 2025).

Portfolio blindness is a documented second-order effect of ADL: the mechanism ranks positions individually by leverage-weighted profitability, without accounting for hedging relationships within a portfolio. In the October 2025 event, one publicly cited case involved a trader with a $5 million long BTC position at 3x leverage hedged by a $500,000 short DOGE position at 15x. The DOGE short — the most profitable and leveraged leg — was closed first by the ADL queue. The BTC long, now unhedged, was subsequently liquidated in the cascade (Incrypted, 2025).

IV — The CME Comparison: A Structural Contrast

The CME Group — operator of the world's largest regulated derivatives exchange — resolves solvency gaps through a fundamentally different mechanism. When volatility spikes, CME activates circuit breakers and trading halts, suspending markets to allow margin posting and position rebalancing. Shortfalls in the clearing system are covered by a mutualised default fund contributed by clearing members — not by seizing positions from profitable non-defaulting counterparties. Margin calls give traders time to respond. The process is transparent, rule-bound, and subject to CFTC oversight.

In ordinary operation, CME does not reach into a winning trader's account to plug a stranger's deficit.

One caveat belongs on the record, because the sophisticated reader will raise it. The recovery frameworks of major clearing houses do contain a distant cousin of ADL: variation margin gains haircutting (VMGH), endorsed in CPMI-IOSCO recovery guidance, under which a CCP in recovery may haircut the variation-margin gains of non-defaulting clearing members (CPMI-IOSCO, 2017). The difference is not the existence of loss socialisation but its position and probability. VMGH sits at the bottom of a waterfall that first consumes the defaulter's margin, the defaulter's default fund contribution, the clearing house's own capital, and the mutualised default fund — and it has never been the operative tool in a major default. It applies only to clearing members, institutions that accepted mutualisation as a condition of membership, not to end clients. ADL, by contrast, is the third step of a three-step waterfall, reaches the retail account directly, and has fired repeatedly, at scale, within a single decade. The distinction is depth, not kind — which is precisely why it should be priced rather than dismissed.

Now invert the frame. Imagine CME ran the crypto playbook: S&P 500 futures crater on a surprise Fed announcement, and rather than halting the tape or issuing margin calls, an algorithm silently reaches into the accounts of profitable short-sellers and closes their positions. The hedge against a market collapse, the position printing money as the world burns, vanishes — instantly, at a price not chosen, to cover someone else's 20x leveraged long.

In a regulated exchange, that would be grounds for congressional hearings. In crypto perpetuals, it is paragraph 14 of the risk disclosure.

The analytical point is not that one model is inherently superior. ADL has a structural logic: in a zero-sum clearing system without a central counterparty guarantee, loss socialisation of some form is mathematically necessary when insurance funds are breached. The regulated model solves the same problem through pre-funded default waterfalls and mutualised risk — a solution that requires member capital commitments and regulatory mandates that do not yet exist in crypto. The question for practitioners is therefore which model they are operating in, and whether their risk frameworks reflect that distinction.

V — The Queue Is a Choice

The trilemma says perfection is impossible. It does not say the current design is defensible. These are different claims, and the gap between them is where the industry currently lives.

The dominant ADL implementation is not the product of a design process. Loss socialisation was introduced by Huobi in 2015; BitMEX formalised it in 2016 as a queue ranked by profit times leverage; Binance adopted the same formula in 2019. That heuristic — a decade old, and never formally studied until late 2025 — now governs well over 95% of global perpetuals volume, on centralised venues and on Hyperliquid alike (Chitra, 2025). It was not chosen. It was copied.

The formal analysis is unkind to it. The queue is provably the worst ADL policy for the top winning trade, and it can violate monotonicity: under the greedy waterfall allocation, the top-ranked winner can be wiped out entirely while a nearly identical position goes untouched. It concentrates losses on precisely the accounts the exchange should most want to retain — a tension the paper formalises as a principal-agent trade-off between short-term solvency and long-term revenue (Chitra, 2025).

Alternatives exist, are published, and are in production. The same paper proves that a capped pro-rata rule — spreading the haircut proportionally across all profitable positions, subject to per-account caps — is the uniquely fair allocation, in both the axiomatic sense (monotonicity, scale invariance, Sybil resistance) and the welfare-maximising sense. Drift and Paradex already run pro-rata mechanisms. A risk-aware variant, weighting haircuts by each account's contribution to solvency risk, is maximally robust to a follow-on price shock. And in the repeated setting, an online-learning policy with incentive constraints achieves vanishing regret — in the October 10 replay, it reduces Hyperliquid's overshoot from up to $51.7 million to roughly $3 million (Chitra, 2025).

The market may already be pricing the difference. Post-event data suggests Hyperliquid lost nearly half its open interest after October 10, while Binance and Lighter — a competing decentralised venue that weathered the event without invoking ADL, relying on its liquidity pool as sole backstop — recovered to pre-event levels. Public commentary has attributed the divergence to Hyperliquid's aggressive queue execution (Chitra, 2025; Incrypted, 2025). Venue selection is beginning to function as a referendum on ADL design.

The obstacle to better ADL, in other words, is not mathematics. It is that the incumbent formula predates the analysis, carries no regulatory minimum standard, and persists by default. That is exactly the kind of gap that closes quickly once regulated venues, institutional counterparties, and eventually supervisors start asking why the industry standard is the provably worst option on the menu.

— Implications for Practitioners

ADL is disclosed. It is not hidden in fine print — every major exchange documents it, and several now display real-time ADL queue indicators on their trading interfaces. The risk is not one of opacity; it is one of underpricing.

A position's expected value in a perpetual futures market is not simply its mark-to-market profit and loss. It incorporates a contingent liability: the probability, in tail scenarios, that the exchange will forcibly reduce or close the position to cover a third party's default. That probability is not zero. It has activated at least twice in major market events (March 2020 and May 2021) before the largest-ever activation in October 2025. ADL therefore represents a second layer of risk — distinct from and additive to directional market risk — that must be explicitly modelled in any serious risk framework (FTI Consulting, 2025).

For hedged portfolios and delta-neutral desks, the exposure is acute. ADL does not recognise portfolio-level hedging relationships. A carefully constructed hedge can be dismantled in a twelve-minute ADL window, leaving the unhedged leg exposed to precisely the market conditions the hedge was designed to survive. Spencer Hallarn, Head of OTC Trading at GSR, described this as a complex problem for multi-component portfolios following the October 2025 event (GNCrypto, 2025).

The practical implications follow directly. Use lower leverage to reduce queue priority. Set take-profit orders to exit profitable positions before ADL conditions arise. Treat insurance fund size, historical activation frequency, and ADL policy design — queue versus pro-rata — as due-diligence criteria when selecting a venue. Recognise that regulated venues — Coinbase Derivatives, Bitstamp, and Kraken Derivatives US — carry ADL provisions too, but operate under disclosure regimes that may evolve toward minimum standards.

You do not own a profit on a perpetual futures exchange. You hold an unrealised gain that is subject to involuntary closure when the exchange's clearing system requires it. The mechanism is structural, not malicious. But it is real — and it has now been activated, at scale, across the entire derivatives market in a single afternoon.

Sources

Julian Gretzinger

Investor and writer on monetary history, real wealth mechanics, and financial markets. substack.com/@juliangretzinger