Agent wallets and security
Copy trading needs a key that can place orders while your browser is closed. On Hyperliquid that is an API wallet (an “agent”): a separate key you authorize with your own wallet’s signature. This page explains what it can do, where it lives and how to end it. The Security page shows the live state of your own authorization.
What the agent wallet can and cannot do
It can place and cancel orders and change trading leverage for your account. It cannot transfer or withdraw your funds, approve another agent, or move anything off the exchange. Hyperliquid enforces that limit itself, so it holds whether or not you trust HyperBase.
Authorize copy trading is one signature from your wallet. It costs no gas and moves no funds. Where a trading fee applies, approving it is a separate signature, and its ceiling is shown before your wallet asks you to sign.
Where the key lives
The copy-trading key is generated on our server, never in your browser. It is sealed with RSA-OAEP-256 to a public key before it is stored. The service that answers your browser holds only that public key, so it can seal a key but never open one; the private key is held by the execution engine alone, which opens a key in memory only to sign an order. A database dump cannot open an agent key, and no API ever returns one.
This is not zero-knowledge. While your authorization is active, our servers hold material that can place orders on your account without asking you again — that is what copying trades while you are away means. What limits the exposure is that the key cannot move funds, the authorization expires on its own, and you can end it at any moment.
Expiry, renewal and revoking
An authorization lasts 180 days from the signature. It is marked Expiring soon in its last 7 days, a notification is sent 14 days before, and Renew extends it with one more signature.
Revoke ends it at once. Revoking is an approval of the zero address, as the exchange defines it, so it needs your signature too and does not depend on our cooperation.
When an authorization expires or is revoked, copy trading stops completely and your positions are left exactly as they are: no closing orders are sent, and an open position stays open and unmanaged until you authorize again. If you mean to stop, close what you want closed first.
What you can verify yourself
The agent’s address is shown on the strategies page. The authorization itself is public on Hyperliquid: the agents approved for your account, and any fee ceiling you signed, can be read from any explorer or from the exchange’s own info endpoint.
Restricted regions
In the United States and in sanctioned regions, opening new exposure is refused: creating or activating a strategy, new orders and deposits. Everything that reduces exposure stays available everywhere: pausing or ending a strategy, closing positions, cancelling orders, withdrawing and revoking an authorization.