万字深扒Trade.xyz数据，谁在链上炒美股？

Source: Arrakis Finance

Compiled by Odaily Planet Daily (@OdailyChina); Translated by Azuma (@azuma_eth)

Earlier this month, we wrote an article, "Who's Trading on HIP-3?", which used a statistical inference attribution method, classifying each address based on its trading behavior over the past three months: addresses primarily making orders (maker) were classified as Market Makers, addresses with high-frequency taking (taker) behavior were classified as Arbitrageurs, and addresses with a low fill rate and orders marked with a builder code were considered Retail.

While this method revealed some interesting patterns in market structure, the classification was inherently probabilistic, and approximately 70% of addresses could not be effectively categorized.

In today's article, we employ a mechanical classification attribution method instead of statistical inference. On HyperliquidX, every order contains a deterministic set of tags, signed and published by the exchange (e.g., time-in-force, builder code, fill flag, hold time). Based on this order metadata, we categorize all addresses into four main groups: Retail, Market Maker, Arbitrage Bot, or Airdrop Farmer.

The second step is to identify the specific identities behind these categories. We extract identity and trading behavior data from the Arkham and HyperTracker APIs. The top 450 addresses contributed 78% of the total trading volume. Within this set, we identified several relevant entities, including addresses associated with Polymarket, Jump, Selini Capital, Wintermute, Abraxas Capital, and other institutions.

Through this two-step classification method, we observed several key findings, which are detailed below.

Address Distribution

Our observation period was from March 10, 2026, to March 31, 2026, totaling 21 days. During this period, we monitored four Trade.xyz markets: CL (Crude Oil), SILVER (Silver), TSLA (Tesla), and XYZ100 (Index), recording a total of 79,622 unique participating wallets and $51.95 billion in total trading volume.

Of the 79,622 addresses that traded within these 21 days, when broken down by volume, although market makers accounted for less than 0.5% of total addresses, they contributed 63% of the trading volume.

When classified by wallet count rather than volume, the Airdrop Farmer category alone contained 35,091 addresses, nearly half of all identified addresses.

Airdrop farmers are one of the largest categories by address count but the smallest by volume share. 35,091 addresses constituted 44.07% of the total, yet generated only $400 million in volume during the observation period, representing 0.77% of the platform's total $51.95 billion volume. In other words, nearly half of the active addresses on Trade.xyz contributed less than 1% of the total market volume.

Splitting by the specific market in which they participated reveals another significant pattern.

Address distribution by market shows that the CL (Crude Oil) market, benefiting from the best execution efficiency, absorbed 99.3% of airdrop farmers.

Out of the 35,091 airdrop farmer addresses, 34,859 (99.3%) traded CL during the observation period, with the remaining 232 wallets spread across SILVER, TSLA, and XYZ100. This pattern aligns with typical airdrop farming behavior – each wallet accumulates trading volume through continuous, two-way small transactions without taking on price risk. This strategy relies on extremely low execution costs and benefits from minimal slippage. CL has the deepest liquidity among these four Trade.xyz markets, making it a natural venue for such activity.

Another interesting observation is the entity behind these addresses. On-chain tracing, detailed later in the article, links 34,553 of these farmer addresses to a single Polymarket operator, which alone accounted for 43.4% of all participating addresses on Trade.xyz during the observation period.

At the other extreme of this classification are market makers. 363 wallets (0.46% of active addresses) executed $32.75 billion in volume during the observation period, representing 63% of Trade.xyz's total volume. The remaining three categories fall between these two extremes – 522 SAT/HFT bots contributed $3.5 billion (6.7%), 38,307 addresses classified as retail contributed $8.7 billion (16.7%), and another 5,339 unclassified addresses contributed $6.61 billion in volume (12.7%).

This 12.7% share of unclassified volume cannot be definitively attributed to a clear strategy based solely on metadata. A reasonable assumption is that a significant portion comes from retail users placing limit orders via the Hyperliquid frontend, or users submitting market and limit orders through the Trade.xyz frontend. Since orders from these two channels carry neither a distinct builder code nor specific TIF tags, these fills are invisible in our metadata-based classification.

The time-in-force (TIF) distribution weighted by order count for each category shows that 98.5% of orders from market makers are ALO orders, while arbitrage bots exclusively use IOC orders. In the unclassified category, 71.5% of orders are GTC, a typical characteristic of limit orders manually placed by frontend users.

The TIF structure further supports this hypothesis. Among the aggregated orders in the unclassified category, 71.5% carried a GTC (Good Till Cancel) time-in-force tag, typically used for persistent limit orders placed by frontend users.

Meet the Real High Roller: Themino

Over the past few weeks, a debate has been intensifying around Trade.xyz – whether its apparent user count reflects genuine human participation or is artificially inflated by airdrop farming activities in anticipation of the platform's imminent TGE. While we cannot comment comprehensively on the interaction status across the entire trading platform, analyzing tick-by-tick trade data for the four Trade.xyz markets in March revealed a noteworthy lead.

Of the 34,602 addresses classified as airdrop farmers, 34,553 (99.9%) can be traced back to a single Polymarket user named Themino.

The Themino cluster: A single Polymarket user identity spawned 70 independent linear chains, encompassing 34,553 airdrop farmer addresses.

Here's how Themino operates. Hyperliquid's Layer 1 provides an internalTransfer primitive that allows transferring USDC between addresses, with a fixed fee of $1 regardless of the amount. The operator behind Themino uses this mechanism to "pass" an initial capital through tens of thousands of new addresses one by one. Each address executes the same five-step process in approximately 26 seconds:

• Receives funds from the previous address via internalTransfer (paying the $1 transfer fee in the process);
• Transfers $14 to a sub-account named xyz;
• Executes two IOC orders on the CL market (one buy, one sell), generating two fills and therefore recording some trading volume;
• Transfers approximately $13.99 back to the main account (the few cents difference is due to execution slippage and trading fees);
• Then transfers funds to the next address again via internalTransfer (paying another $1 fee);
• Repeats the process...

Throughout Themino's operation, a total of 34,510 internal-transfer events occurred. As a result, Themino paid $34,510 in protocol fees, a pattern consistent with its transaction history on Polymarket.

Additionally, Themino once bet "No" on the Polymarket event "Will the US strike Iran before February 28, 2026?", eventually losing approximately $80,000 – and the airstrike did occur on February 28.

Different Groups Behind the Builders Tag

Hyperliquid attaches an identifier to orders routed via third-party frontends to facilitate custom frontend fee collection. This identifier, the Builder Code, is the most direct way to determine which interface an address used for trading, if any. Among the addresses trading in these four markets, the entities behind these Builders tags can be grouped into three categories.

Algorithmic Builders. These products are primarily used by retail investors to maximize trading volume on DEXs for potential airdrop points. Before late 2025, interacting with Perp DEXs typically meant executing wash trading or non-directional taker-taker orders via algorithms, which was costly for participants and a net negative for exchanges. Retail market-making bots like tread.fi, Planemo Trading, and Origami Tech replaced wash trading with "value-providing market making." Orders placed through these products are post-only, meaning wallets provide liquidity to the order book rather than consuming it.

As David Jeong (CEO of tread.fi) stated: "Before retail market-making solutions emerged, farming on Perp DEXs meant wash trading – inflating volume by paying execution fees, incurring slippage costs, and even risking bans. We solved this by building a new interaction model where bots only place maker orders on both the bid and ask sides. Users interact at a lower cost, often profit from capturing the spread, and the byproduct is providing genuine best-price liquidity to the market – exactly what HIP-3 equity-style perpetuals need during nights and weekends when traditional market makers don't quote. It's a better way to interact and why HIP-3 markets now have good execution quality."

The contribution of these market-making bots is particularly noticeable during periods when traditional market makers are not quoting. CME WTI crude oil futures close on Friday afternoon and reopen Sunday evening. Equity-style perpetuals face similar overnight and weekend gaps. During these time windows, retail market-making bots fill the top-of-book liquidity in markets like CL and TSLA.

It is important to note that although we classify addresses routed through these algorithmic products as farmers in this analysis, their trading behavior and market impact are structurally different from Sybil behavior.

Wallet-integrated Builders are perpetual trading interfaces embedded within user wallets. Since early 2026, these integrations have become one of the largest sources of retail order flow on HIP-3. This category includes Phantom, MetaMask, Rabby, Rainbow, and OneKey. The median trading volume per wallet is between $1,000 and $3,000, aligning with the characteristics of convenience-focused retail users who prioritize ease of access over subtle differences in builder fees.

Apps Builders are standalone perpetual trading frontends and integrated products – tools designed for traders, offering a more complete workflow for users who need more than a wallet plugin experience, including better order placement, charting, position management, and execution tools. The number of addresses in this category is smaller than wallet-integrated channels, but the volume per address is higher, fitting the profile of heavy users who value functional depth over out-of-the-box convenience. Related products include Insilico Terminal, Liquid, Hyperdash, Based, Dreamcash, Infinex, Pear Protocol, Defi App, and pvp.trade.

VKTR (Head of Growth at Insilico Terminal) summarized: "At Insilico, we see HIP-3 markets as the next step in making real-world asset exposure native on crypto rails. Traders don't just want another frontend; they need fast execution, clear market access, and the ability to move seamlessly between crypto and macro assets without leaving their existing workflow. Trade.xyz is one of the clearest examples of this demand. The order flow routed through Insilico shows that when a trading venue has enough depth, the product is practical enough, and the trading experience is designed for professional participants, there is indeed a real, high-end user base for on-chain perpetual markets."

Market Maker Address Analysis

The market-making landscape across Trade.xyz markets is highly concentrated. The top 5 market makers contributed 50% of the market-making volume, the top 13 accounted for 80%, and the top 21 accounted for 90%. In other words, the vast majority of the market-making order book is dominated by a small number of trading desks.

The cumulative share of market-making volume ranked by address shows that the top 5 trading desks contributed 50% of all market-making flow, the top 13 reached 80%, and the top 21 reached 90%.

The second-largest market-making address is one of the most interesting in the entire sample. Address 0xc926ddba…98d3 executed $4.39 billion in volume with a fill rate of 0.52%, a typical characteristic of market-making behavior. Arkham labels this address as "Powell" on Polymarket. This means that one of the largest market makers on Trade.xyz is actually a Polymarket user who provides two-sided quotes across multiple HIP-3 markets.

Other notable market-making desks include.

• Jump Crypto operated two addresses, with a combined trading volume of $3.15 billion, funded from address 0xf584…d621 (identified by Arkham as a Jump funding address), which holds a diversified portfolio of over $160 million including LINK, LIT, EIGEN, BNB, ETH, USDC, and USDT.
• Selini Capital operated three addresses, two executing pure market-making quotes (0x44a3e1…35dd, 0x76987c…4480) and one executing pure aggressive taking (0x427be6…d1d9), all running via API, with a total trading size of $1.03 billion. Hyperliquid's order flow tagging mechanism allows distinguishing Selini's market-making wallets from its HFT wallets, with the same trading desk operating on both sides of the order book.
• Wintermute operated one market-making address, with a volume of $229.6 million (0xecb63caa…2b00), smaller in scale than Jump and Selini, with funding sourced from OKX.