This article is published for informational and educational purposes only and does not constitute investment advice. Arrakis has made reasonable efforts to verify the accuracy of the data presented but does not warrant that all information is accurate, complete, or current.

Thank you to 0xArchiveIO, HyperTracker (by Coinmarketman), and Stacy Muur for their contributions to this research.

Abstract

When we wrote our first article on ‘Who’s trading on HIP-3’, the attribution was statistical. We classified each wallet based on their trading behaviour over past 3 months: addresses with maker-dominated were classified market makers, addresses with high-frequency taker activity were classified arbitrageurs, addresses with low fill rates and builder tagged orders were deemed retail. While this revealed interesting pattens in the market structure, this classification was probabilistic, and the method left roughly 70% of wallets in the market unclassified.

This piece replaces statistical inference with mechanical classification. Every order on Hyperliquid carries a deterministic set of tags that the exchange itself signs and publishes: time-in-force (ALO, GTC, IOC, FrontendMarket), builder code, fill flag, hold time. We used this order metadata to classify each wallet into one of four buckets: Retail, Market Maker, Arbitrage Bot, or Airdrop Farmer.

The second step identified the wallets behind these buckets, pulling identity and trading-behaviour data from the Arkham and HyperTracker APIs. The top 450 wallets carry 78% of total volume. Within that set we identified several Polymarket-associated handles, Jump Crypto, Selini Capital, Wintermute, Abraxas, and others.

Several patterns emerged from this two-step classification. We examine them in detail below.

The Wallets

We observed a period of 21 days, from 10 March, 2026 to 31 March, 2026. Across that period, the four Trade.xyz markets (xyz:CL for oil, xyz:SILVER, xyz:TSLA, and xyz:XYZ100) recorded 79,622 unique participating wallets and $51.95B of aggregate volume.

The 79,622 participating wallets across 21 days, decomposed by trading volume. Market makers carry 63% of every dollar despite representing under half a percent of the wallets.

Wallets classified by number of wallets instead of volume. The Airdrop Farmer bucket alone holds 35,091 wallets, almost half of the total number of wallets identified.

The Airdrop Farmer bucket was one of the largest classifications by wallet count and the smallest by volume share. 35,091 wallets represented 44.07% of the total wallets but generated only $0.40B in trade volume across the window, or 0.77% of the venue's $51.95B total. Nearly half of all active wallets on Trade.xyz produced under one percent of the total volume in the market.

Breaking them down by the market they participated in reveals another striking pattern.

Wallet population split by market. xyz:CL absorbs 99.3% of the Airdrop Farmers due to best execution.

Of the 35,091 wallets in the Airdrop Farmer bucket, 34,859 (99.3%) traded xyz:CL during the window. The remaining 232 wallets are spread across xyz:SILVER, xyz:TSLA, and xyz:XYZ100. This pattern is consistent with airdrop farming: each wallet places small back-to-back trades in both directions, registering volume without taking on price risk. This approach depends on tight execution costs and benefits from minimal slippage. xyz:CL was the deepest of the four Trade.xyz markets, which makes it a natural venue for the activity.

Another interesting observation was who was behind these addresses. The onchain trace presented later in the piece links 34,553 of those farmer wallets to a single Polymarket operator. That entity alone accounted for 43.4% of all participating wallets on Trade.xyz over the window.

At the opposite extreme of this classification was market making. 363 wallets, or 0.46% of the total active addresses, moved $32.75B during the window: 63% of every dollar traded on Trade.xyz. The three remaining categories occupied the space between. 522 SAT/HFT bots ran $3.50B (6.7% of volume). 38,307 wallets classified as Retail moved $8.70B (16.7%). 5,339 wallets in the Unclassified bucket accounted for $6.61B in volume (12.7%).

The 12.7% of volume sitting in Unclassified cannot be assigned to a definitive strategy from the metadata alone. It's reasonable to assume that a meaningful share of this volume reflects retail participants placing limit orders through the Hyperliquid frontend, or market and limit orders through the Trade.xyz frontend. Since, neither of these channels attach an explicit builder code or dedicated TIF tag to these type of orders, leaving these fills invisible to a metadata-driven classification.

Time-in-force mix by category, weighted by order count. Unsurprisingly market makers run 98.5% ALO and Arbitrage bots do 100% IOC orders. The Unclassified bucket leans 71.5% GTC, the signature of frontend participants resting limit orders manually.

The TIF composition supports this assumption, 71.5% of the orders aggregated into the unclassified bucket carry the GTC (Good Till Cancel) time-in-force, a tag that is typically used by frontend participants posting resting limit orders.

Meet Themino. And Themino. And Themino.

Over the past few weeks there has been considerable discourse on whether Trade.xyz's headline user count reflects genuine human participation, or whether it has been inflated by airdrop-farming activity in anticipation of the venue's expected TGE. While we are not in a position to comment on the broader landscape of farming behaviour across the venue, upon analysing the fill-level data for the four Trade.xyz markets in March, it surfaced one pattern worth presenting.

Out of 34,553 of the 34,602 wallets classified as Airdrop Farmers, 99.9%, trace back to a single Polymarket identity going by the handle "Themino".

The Themino complex. One Polymarket Arbitrum identity seeds 70 distinct linear chains spanning 34,553 farmer wallets.

How this worked. Hyperliquid's L1 has an internalTransfer primitive that moves USDC wallet-to-wallet for a flat $1 fee regardless of amount. Themino's operator used that primitive to walk a single seed deposit through tens of thousands of fresh wallets. Each wallet ran the same five-step sequence in roughly 26 seconds:

Receive $X from the previous farmer wallet via internalTransfer, losing $1 to the HL transfer fee on the way in.
Send $14 into the xyz sub-account.
Execute two IOC orders on xyz:CL, one buy and one sell, generating two fills and roughly registering some trade volume.
Send ~$13.99 back to the main account (the cent gap assumes execution slippage and trading fees).
Send $X minus 1 onward via internalTransfer to the next farmer wallet.

The next wallet then repeats the sequence.

Across the operation's 34,510 internal-transfer events, Themino lost $34,510 in protocol fees, a pattern consistent with their Polymarket trading history.

Themino also lost ~$80k betting no on "US strikes Iran by February 28, 2026?" on Polymarket. The strikes happened on February 28.

The builders

Hyperliquid attaches an identifier to orders routed through third-party frontends to enable apps to charge custom frontend fees. This identifier is the builder code, and it is the most direct read on which interface a wallet traded through, if any. Across the wallets that traded on the four markets, the builders can be grouped into three archetypes.

Algorithmic Builders. These are products that retail users use to maximise their volume on DEXs to farm points for potential airdrops. Before late 2025, farming on a perp DEX meant wash trading or non-directional taker-taker orders run algorithmically, these were not only costly for the participant but also net negative for the exchange. Retail market-making bots like Tread.fi and Planemo replaced wash trading with valuable market making. Each order through these products is post-only, so the wallet adds liquidity to the book rather than consuming it.

As David, founder of Tread.fi, put it:

"Before retail market-making solutions existed, farming on perp DEXs meant wash trading, inflating volume at the cost of execution fees, slippage, and risking a ban. We solved this by building a novel farming solution: bots that would only quote maker orders on both sides. Users pay lower costs to farm, often making money on the spread they capture, and the by-product is genuine top-of-book liquidity for the market, exactly what HIP-3 equity perps need on nights and weekends when traditional market makers won't quote. It's a better way to farm, and the reason why HIP-3 markets have great execution today."

The contribution of these market making bots to the markets is clearest at the times traditional market makers are not quoting. CME's WTI futures close Friday afternoon and reopen Sunday evening, and equity perps face the same overnight-and-weekends gap. Across those windows, retail MM bots have populated the top of the book on xyz:CL, xyz:TSLA, and similar markets.

Note that while we classified wallets routed through these algorithmic products as Airdrop Farmers in this analysis, the trading behaviour and effect on the market is structurally different from sybil activity.

Wallet-integrated Builders are the perps interfaces embedded inside consumer wallets. Since the start of 2026, these integrations have collectively become one of the largest sources of retail orderflow on HIP-3. The group includes Phantom, MetaMask, Rabby, Rainbow, and OneKey. Median per-wallet volume sits between $1K and $3K, consistent with ticket sizes from a retail audience that values ease of access over the marginal builder fee.