One share traded. Fifty seconds later, $57.4 million was gone.
liquidated on xyz:SKHX across about 960 long accounts, in 50 seconds, on a price that came from a market where one share had traded. Reconciled against Hyperliquid candles for that market on 2026-09-16.
Sentinel is an independent integrity monitor for Hyperliquid HIP-3 markets. It does not sell prices. It audits the one your deployer publishes, weights it against markets the deployer does not control, and says so before the liquidations rather than in the postmortem.
- Date
- 27 July 2026, 23:00 UTC08:00 KST, the Korean pre-open
- Market
- xyz:SKHXSK Hynix perpetual, deployed by Trade.xyz under HIP-3
- Trigger
- One sharetraded on Nextrade at 1,272,000 KRW, near the daily limit
- Oracle
- $1,131.40 to $954.99about 16%, in roughly 20 steps
- Mark
- $1,127.90 to $917.2517.9%, stopping just inside the 19% floor
- Duration
- 50 secondsthen the price recovered
- Liquidated
- about $57.4Macross about 960 long accounts, about $17.3M realized
- Then
- ADL, about $10.8Mabout 100 short accounts, auto-deleveraged
- Margin mode
- Crossunlike the Samsung and Hyundai perps on the same venue
- Deployer
- Reimburseda discretionary backstop targeting about $60M
The deployer’s own account of it: “the oracle system worked as intended according to its specification.” It did. The design was wrong.
What it does
It audits the price your deployer publishes. It does not sell prices.
Is this price real?
A deviation is only as meaningful as the market it deviates from. We weight the independent reference by each venue’s depth, so a 19% gap from a venue that traded one share is read as a data artifact rather than news.
Rests on: the venue’s own reconstructed book, plus reference venues the deployer does not control.
Is the deployer’s number driving it?
A HIP-3 mark is the median of two deployer submissions and the local book. When both submissions sit on the same side, the deployer’s numbers decide who gets liquidated — and the public per-round sourcing class says which input was used.
Rests on: public on-chain submissions and the venue’s own sourcing class. No cooperation required.
Is this market behaving badly?
Stale oracles, fallback rounds, thin books, and open interest pressed against its cap. Each of these is the precondition for a single print to move a mark, and each is visible before the move rather than after it.
Rests on: public market state, polled continuously. Computable from one venue.
The receipt is the part that outlives the argument: the readings behind each finding are committed to a Merkle root on HyperEVM mainnet on a fixed schedule, so a claim about a price can be checked by anyone afterwards rather than taken on our word.
The record
What the machine wrote on an ordinary night
Nothing here is a scenario. This is a window out of the collector’s own database, chosen because it is the one stretch in the record where the independent reference was frozen at the previous session’s close and then printed, so both regimes are on screen with a real transition between them.
SKHX · xyz:SKHX
- Mark samples
- 842bucketed to 20 seconds
- Reference prints
- 282one a minute, KRX
- Findings written
- 18every one of them quoted below
- Retracted
- 1see what we got wrong
No customer lost money in this window. The machine had plenty to say anyway, which is the point: integrity is not something you check when something has already broken.
Every finding the engine wrote in that window, verbatim
Copied out of the signals table in the order it wrote them, including the one it later took back. The text is the engine’s own, not a summary of it, because a summary is the place where a finding quietly becomes a stronger claim than the one that was actually made.
| UTC | Severity | Detector | What it said |
|---|---|---|---|
| 02:15:31 | elevated | divergence | Mark 1.05% above the depth-weighted reference. |
| 02:15:19 | info | divergence | Reference divergence is no longer active. |
| 01:53:30 | elevated | divergence | Mark 1.08% above the depth-weighted reference. |
| 01:53:15 | info | divergence | Reference divergence is no longer active. |
| 01:53:03 | elevated | divergence | Mark 1.00% above the depth-weighted reference. |
| 01:53:00 | info | divergence | Reference divergence is no longer active. |
| 01:51:27 | elevated | divergence | Mark 1.01% above the depth-weighted reference. |
| 01:51:24 | info | divergence | Reference divergence is no longer active. |
| 00:50:27 | elevated | divergence | Mark 1.02% above the depth-weighted reference. |
| 00:50:24 | info | divergence | Reference divergence is no longer active. |
| 00:42:28 | elevated | divergence | Mark 1.15% above the depth-weighted reference. |
| 00:42:19 | info | divergence | Reference divergence is no longer active. |
| 00:06:26 | info | reversion | Mark reversion is no longer active. |
| 00:04:14 | critical | reversion | Mark peaked 5.51% from the reference and reverted in 177s. Consistent with a bad print rather than a real move. |
| 00:03:56 | elevated | divergence | Mark 1.03% above the depth-weighted reference. |
| 00:03:53 | info | divergence | Reference divergence is no longer active. |
| 00:00:28 | elevated | divergence | Mark 1.78% above the depth-weighted reference. |
| 00:00:28 | info | depth | Book depth is no longer active. |
What we got wrong
The last row in that table is wrong, and we know because we went and checked.
Mark peaked 5.51% from the reference and reverted in 177s. Consistent with a bad print rather than a real move.
The engine read a five and a half percent gap that came back inside three minutes and called it a bad print. The shape was right. The meaning was not. Measured afterwards, that five and a half percent exists nowhere in the live session, which sat between 1.5 and 1.8 percent: the peak was the overnight gap, and the apparent reversion was the Korean market opening and confirming it.
So reference-basis reversion no longer runs outside the regular session. It was not downgraded or annotated. Feeding a detector a series and discounting its answer would still leave a row on the page asserting a bad print that never happened, and a monitor that publishes findings it has privately decided not to believe is worse than one that stays quiet.
The thresholds are the product
Anyone can draw a line on a chart. What makes this usable is that every line has a number behind it, the number is published, and the finding says which one it crossed. These are the collector’s configured values.
| Rule | Value | Why that number |
|---|---|---|
| Stall window | 180s | How long the published oracle value may sit unchanged before the mark is treated as no longer tracking it. Two minutes is roughly forty missed oracle rounds. |
| Mark against the venue book | 10bp | The published mark against the venue’s own reconstructed book. Far tighter than the reference thresholds, because both sides come from the same venue at nearly the same instant, so there is no cross-venue basis risk to allow for. |
| Reference divergence | 1% / 3% | Signed deviation from the depth-weighted reference. Elevated at one percent, critical at three. Weighted by each venue’s depth, so a thin venue moves the reference less than a deep one. |
| Thin book | $25,000 | Resting quote notional over the top ten levels each side. Below it the book cannot absorb an ordinary order, which is the precondition for a single print to move the mark. |
| Reversion | 180s / 25% | A divergence that returns to within a quarter of its peak inside three minutes is classified differently from one that persists. Shape is evidence: a bad print snaps back, a real move does not. |
| Reference confidence | 0.35 | A basket of two full-depth venues scores 1.0 and one scores 0.5. Below this floor the reference is published but the findings resting on it say so in their own text. |
What ships
Three tiers, and the first one needs nobody’s permission
| Tier | Who opts in | What it adds |
|---|---|---|
| Tier 1Permissionless detection | Nobody opts in | Every HIP-3 market on the venue, watched without the deployer’s cooperation. Mark against the venue’s own book needs no external feed at all, so this tier works on markets whose reference we do not have. |
| Tier 2Attested verification | Deployer opts in | The findings and the inputs behind them are committed to a Merkle root on HyperEVM on a schedule, so a claim about a price can be checked by anyone afterwards rather than taken on our word. |
| Tier 3Automated response | Paid | The deployer names an action to take when a condition holds: widen the oracle’s tolerance, pause an order type, raise margin. Tier 2 proves what happened; this changes what happens. |
What it costs
The Fleet stays free, because a referee that hides its work is not one
You can read every market, every finding and every receipt on this page without an account, and you always will be able to. What costs money is being told about it the moment it happens — and scrubbing one market round by round, which is the Replay screen and the only part of the console a free account does not reach.
Free
$0
Anyone
The whole Fleet, every market, live. Every incident window, every finding, and the Merkle root on HyperEVM that proves it. No account, no delay, no market cap.
Alerts
$99/mo
Traders and anyone with a position
The same console plus alerts the moment a threshold is crossed, delivered to Telegram, with your own thresholds per market and the evidence attached to each one.
Desk
Contact
Funds, market makers, and anyone automating against this
Alerts, a read API over the same data this page is generated from, webhooks, historical export, and an SLA. Priced on markets and seats, so it needs a conversation.
Deployer
Contact
HIP-3 deployers
Attestation published for your markets, an exportable report a risk committee can read, and Tier 3 response hooks. Priced against the stake you are already locked into.
Colosseum judges
Redeem COLOSSEUM after signing in and Pro is on your account for the length of the judging period. One code, one per account, no card.
More price-callers reading the same thermometer is not a second opinion.
Sentinel watches SKHX and 35 other HIP-3 markets live, on the console this page shares its colours with. The detection tier needs no cooperation from the venue and no paid feed, which is why it runs on every market rather than on the ones whose deployer asked for it.
Every number on this page comes from the collector’s own database. The chart window is generated from oracle_rounds, reference_quotes and signals for SKHX, 2026-09-18T00:00:00Z to 2026-09-18T05:30:00Z. The incident figures reconcile to Hyperliquid candles for the same market. If a figure here disagrees with the record, the record is right and this page is wrong.
Contact
If a number here is wrong, say so
Especially if you know the incident and think the record is off. Corrections get made in the open and the page gets updated — that is the same commitment the on-chain receipts are making.
Built for
Colosseum, Hyperliquid track. Mainnet HyperEVM, contract 0x3171…41d8, roots published hourly.