In-depth Investigation: Analyzing Trade.xyz Data – Who is Trading US Stocks on-chain?

Source: Arrakis Finance

Compiled by Odaily Planet Daily (@OdailyChina); Translated by Azuma (@azuma_eth)

Earlier this month, we published an article titled "Who is Trading on HIP-3", which used a statistical inference attribution method. Based on trading behavior over the past three months, each address was categorized: addresses primarily placing maker orders were classified as Market Makers, those frequently taking orders (takers) were classified as Arbitrageurs, and addresses with low fill rates and builder-tagged orders were considered Retail.

While this approach revealed some interesting patterns in market structure, the classification is inherently probabilistic, and approximately 70% of addresses could not be effectively categorized.

In today's article, we will replace statistical inference with a mechanical classification attribution method. On HyperliquidX, every order contains a deterministic set of tags, signed and published by the exchange (e.g., time-in-force, builder code, fill flag, hold time). Based on this order metadata, we divide all addresses into four main categories: Retail, Market Maker, Arbitrage Bot, or Airdrop Farmer.

The second step is to identify the specific identities behind these categories. We extract identity and trading behavior data from the APIs of Arkham and HyperTracker. The top 450 addresses account for 78% of total trading volume.. Within this set, we identified several related entities, including addresses associated with Polymarket, Jump, Selini Capital, Wintermute, Abraxas Capital, and other institutions.

Through this two-step classification method, we observed some very key conclusions, which are analyzed in detail below.

Address Distribution

Our observation period spanned from March 10, 2026, to March 31, 2026, totaling 21 days. During this period, we observed four Trade.xyz markets: CL (Crude Oil), SILVER (Silver), TSLA (Tesla), and XYZ100 (Index), recording a total of 79,622 unique participating wallets and $51.95 billion in total trading volume.

Of the 79,622 addresses that traded during the 21-day period, broken down by volume, market makers represented less than 0.5% of all addresses but contributed 63% of the volume.

When classified by wallet count rather than volume, the Airdrop Farmer category alone included 35,091 addresses, nearly half of the total identified addresses.

Airdrop farmers are one of the largest categories by address count but contribute the smallest share of volume.. Significantly, the 35,091 addresses constituted 44.07% of the total but generated only $400 million in volume during the observation period, representing just 0.77% of the platform's total $51.95 billion volume. In other words, nearly half of the active addresses on Trade.xyz contributed less than 1% of the total market volume.

Breaking down their participation by specific market reveals another striking pattern.

Address distribution by market shows that the CL (Crude Oil) market, offering the best execution efficiency, absorbed 99.3% of airdrop farmers.

Among the 35,091 airdrop farmer addresses, 34,859 (99.3%) traded CL during the observation period, with the remaining 232 wallets distributed across SILVER, TSLA, and XYZ100. This pattern aligns with typical airdrop farming behavior — each wallet accumulates volume through continuous, small, bi-directional trades without taking price risk. This strategy relies on very low execution costs and benefits from minimal slippage. CL being the deepest market among the four on Trade.xyz makes it a natural venue for this kind of activity.

Another interesting observation concerns the entities behind these addresses.. On-chain tracking, detailed later, links 34,553 of these farmer addresses to a single Polymarket operator, which alone accounted for 43.4% of all participating addresses on Trade.xyz during the observation period.

At the opposite end of this classification are market makers.. 363 wallets (0.46% of active addresses) executed $32.75 billion in volume, representing 63% of Trade.xyz's total volume during the period. The remaining three categories fall between these two extremes — 522 SAT/HFT bots contributed $3.5 billion (6.7%), 38,307 addresses classified as Retail contributed $8.7 billion (16.7%), and 5,339 unclassified addresses contributed $6.61 billion (12.7%).

This 12.7% of unclassified volume cannot be definitively assigned to a specific strategy based solely on metadata. A reasonable assumption is that a significant portion comes from retail users placing limit orders via the Hyperliquid frontend, or users submitting market and limit orders through the Trade.xyz frontend. Since orders from these two channels neither carry an explicit builder code nor a dedicated TIF tag, these fills are invisible in metadata-based classification.

The time-in-force (TIF) distribution weighted by order count shows that 98.5% of market maker orders are ALO, while arbitrage bots exclusively use IOC orders; the unclassified category has 71.5% GTC, a typical characteristic of manually placed limit orders by frontend users.

The TIF structure further supports this assumption. Among the aggregated orders in the unclassified category, 71.5% carried a GTC (Good Till Cancel) time-in-force tag, which is typically used for persistent limit orders placed by frontend users.

Introducing the Real Power Player: Themino

In the past few weeks, a controversy has been brewing around Trade.xyz — whether its apparent user count reflects genuine human participation or is artificially inflated by airdrop farming activity in anticipation of a potential TGE. While we cannot comprehensively comment on the interaction status across the entire trading platform, our analysis of per-trade data for the four Trade.xyz markets in March revealed a noteworthy clue.

Of the 34,602 addresses classified as airdrop farmers, 34,553 (99.9%) can be traced back to a single Polymarket user named Themino.

The Themino cluster: a single Polymarket user identity spawned 70 independent linear chains, covering 34,553 airdrop farmer addresses.

Here’s how Themino operates. Hyperliquid's Layer1 provides an `internalTransfer` primitive that allows transferring USDC between addresses, with a flat fee of $1 regardless of the amount. The operator of Themino uses this mechanism to "pass" an initial amount of funds sequentially through tens of thousands of new addresses. Each address executes the same five-step process in about 26 seconds:

• Receives funds from the previous address via `internalTransfer` (paying $1 transfer fee on receipt);
• Transfers $14 to an `xyz` sub-account;
• Executes two IOC orders on the CL market (one buy, one sell), generating two fills and thus recording some trading volume;
• Transfers approximately $13.99 back to the main account (the cent-level difference results from execution slippage and trading fees);
• Initiates an `internalTransfer` of funds to the next address (paying another $1 fee);
• Repeats the process...

Throughout Themino's operation, 34,510 internal-transfer events occurred, resulting in $34,510 in cumulative protocol fees paid by Themino, a behavioral pattern consistent with its trading history on Polymarket.

Furthermore, Themino also bet "No" on Polymarket regarding the event "Will the US strike Iran before February 28, 2026?", ultimately losing approximately $80,000 — the airstrike indeed occurred on February 28.

Different Groups Behind The Builders Tag

Hyperliquid appends an identifier to orders routed through third-party frontends to facilitate collecting custom frontend fees. This identifier is the Builder Code, and it's the most direct way to determine which interface (if any) an address used to trade. Among addresses trading these four markets, the entities behind these Builder tags can be grouped into three categories.

Algorithmic Builders. These products are primarily used by retail traders to maximize volume on DEXs to accumulate points for potential airdrops. Before late 2025, interacting with Perp DEXs typically meant executing wash trading or non-directional taker-taker orders via algorithms, which was costly for participants and net-negative for the exchange. Retail market-making bots like tread.fi, Planemo Trading, and Origami Tech replaced wash trading with "valuable market-making behavior." Orders submitted through these products are post-only, meaning wallets provide liquidity to the order book rather than consuming it.

As David Jeong (CEO of tread.fi) stated: "Before retail market-making solutions, farming on Perp DEXs meant wash trading – inflating volume by paying execution fees, incurring slippage, and risking bans. We solved this by building a new interaction paradigm where bots only place maker orders on both sides. Users interact at lower cost, often profiting by capturing the spread, and the byproduct is providing real, best-price liquidity to the market – exactly what HIP-3 equity perpetuals need during nights and weekends when traditional market makers don't quote. It's a better way to interact, and it's why HIP-3 markets now have good execution quality."

The contribution of these market-making bots is particularly evident during periods when traditional market makers are not quoting. CME WTI crude oil futures close on Friday afternoon and reopen Sunday evening; equity perpetuals face similar overnight and weekend gaps. During these times, retail market-making bots fill the top-of-book liquidity for markets like CL and TSLA.

It's important to note that, although we classify addresses routed through these algorithmic products as farmers for this analysis, their trading behavior and market impact are structurally different from sybil behavior.

Wallet-integrated Builders are perpetual contract trading interfaces embedded within user wallets. Since early 2026, this type of integration has become one of the largest sources of retail order flow on HIP-3. This category includes Phantom, MetaMask, Rabby, Rainbow, and OneKey. The median trading volume per single wallet falls between $1,000 and $3,000, consistent with convenience-focused retail users who prioritize ease of access over nuances in builder fees.

Apps Builders are standalone perpetual trading frontends and integrated products — tools designed for traders seeking a more comprehensive workflow beyond wallet plugins, offering better order placement, charting, position management, and execution tools. This category has fewer addresses than wallet-integrated channels but higher volume per address, characteristic of a power user segment that values functional depth over out-of-the-box convenience. Relevant products include Insilico Terminal, Liquid, Hyperdash, Based, Dreamcash, Infinex, Pear Protocol, Defi App, and pvp.trade.

VKTR (Head of Growth at Insilico Terminal) summarized this: "At Insilico, we see HIP-3 markets as the next step in bringing real-world asset exposure natively onto crypto rails. Traders don't just want another frontend; they need fast execution, clear market access, and the ability to move seamlessly between crypto and macro assets without leaving their existing workflow. Trade.xyz is one of the clearest manifestations of this need. The order flow routed through Insilico shows that there is indeed a real, sophisticated user base for on-chain perpetual markets when the venue has sufficient depth, the product is practical enough, and the trading experience is designed for professional participants."

Market Maker Address Analysis

Market making across the Trade.xyz markets is highly concentrated.. The top 5 market makers account for 50% of the market-making volume, the top 13 for 80%, and the top 21 for 90%. In other words, a vast majority of the market-making order book is dominated by a handful of trading desks.

Cumulative share of market-making volume ranked by address shows the top 5 desks contributed 50%, the top 13 reached 80%, and the top 21 reached 90%.

The second largest market-making address is one of the most interesting in the entire sample. 0xc926ddba…98d3 executed $4.39 billion in volume with a 0.52% fill rate, a classic market-making behavior signature. Arkham tags this address as 'Powell' on Polymarket. This means. one of the largest market makers on Trade.xyz is actually a Polymarket user providing two-sided quotes across multiple HIP-3 markets.

Other notable market-making desks include:

• Jump Crypto operated two addresses, with a combined volume of $3.15 billion. Funds originated from 0xf584…d621 (identified by Arkham as a Jump fund address), holding over $160 million in a diversified portfolio including LINK, LIT, EIGEN, BNB, ETH, USDC, and USDT.
• Selini Capital operated three addresses: two executing pure market-making quotes (0x44a3e1…35dd, 0x76987c…4480) and one executing pure aggressive taker orders (0x427be6…d1d9), all running via API. The total trading scale was $1.03 billion. Hyperliquid's order flow tagging mechanism allows distinguishing Selini's market-making wallets from its high-frequency trading wallets, showing the same desk operating both sides of the order book.
• Wintermute operated a single market-making address, with a volume of $229.6 million (0xecb63caa…2b00), smaller in scale than Jump and Selini. Its funding source is OKX.

Among the top market makers on Trade.xyz by volume, Powell, Jump Crypto, Selini Capital, and Wintermute constitute a part of