How to keep a Hyperliquid account safe

Hold the account on a cold wallet, open Hyperliquid only from a bookmark, keep a separate trading account, and trade with an API wallet that can't withdraw. Coldfront, a free Chrome extension, keeps that API wallet encrypted and locks by itself, so no browser wallet has to be connected while you trade.

1. Open Hyperliquid from a bookmark

Type app.hyperliquid.xyz once, bookmark it, and always use the bookmark. Fake sites often come from search ads. In August 2026 a trader lost $550,000 after a fake Hyperliquid search ad led to a drainer site.

2. Hold the account on a cold wallet

A Ledger, Trezor, Keystone or OneKey keeps the account's key off your computer, so withdrawals need the device in your hand.

3. Keep a separate trading account

Add a second account on your cold wallet for trading and keep only what you trade with there. The rest of your holdings stay on an account that never touches a trading site.

4. Trade with an API wallet that can't withdraw

Authorize an API wallet once and trade with that. Coldfront stores it encrypted and gives it to the official app, so no browser wallet is connected while you trade and there is nothing for a fake site to ask you to sign.

5. Let it lock

Set Coldfront to lock after a short time and when your computer goes idle. Locking reloads every Hyperliquid tab so the app forgets the API key.

6. Clean up old API wallets

On the API page, remove API wallets you no longer use, and any you think might have leaked.

7. Check what you install

Install extensions only from their official links, and check the extension ID. Coldfront's is ijhlfmhnpbgknhabconhepgdaabaeogg.

What none of this protects against

Malware on your computer while you're trading, a compromised Hyperliquid website, and trades you didn't mean to make. The security page goes through each one.

Questions

What's a safe way to trade on Hyperliquid with a cold wallet?

Keep the account on the cold wallet and trade with an API wallet, which can't withdraw. With Coldfront the API key stays encrypted, the official app uses it only while unlocked, and no browser wallet is connected while you trade. Withdrawals still need the cold wallet.

How do Hyperliquid drainer scams work?

A fake copy of the Hyperliquid site, often reached through a search ad or a link in a message, asks you to connect your wallet and sign. The signature approves a transfer or withdrawal to the scammer.

Can someone with my API key steal my funds?

They can't withdraw or transfer them: Hyperliquid doesn't let an API wallet do that. They could still place bad trades, so revoke the API wallet on the API page if you think it leaked.