Everything in the previous lesson, from margin to liquidation to PnL, hangs on one number the venue produces every few seconds: the mark price. This lesson is about where that number comes from, how it can go wrong, and what the best-documented failures of 2025 and 2026 teach.
Where perp prices come from
A crypto perp has three sources of truth. The venue's own order book gives last trade, best bid and best ask. An external index gives what the asset is worth elsewhere: Hyperliquid's validators publish an oracle price roughly every three seconds, a weighted median of large centralized-exchange prices that ignores Hyperliquid's own book entirely. Lighter builds its index from Chainlink, Stork and Pyth. Other venues read Pyth or Chainlink feeds directly on-chain. For stocks, commodities and FX the feed is a composite of exchange data pushed by a relayer, or, on Hyperliquid's HIP-3 framework, whatever the deployer of that market publishes: the protocol's docs make the deployer responsible for setting oracle prices.
How the mark is built
The mark price is designed so that no single source can move it on its own. Hyperliquid's mark is the median of three inputs: the oracle price plus a 150-second EMA of the gap between Hyperliquid's mid and the oracle; the median of its own best bid, best ask and last trade; and the median of perp mid prices on Binance, OKX, Bybit, Gate and MEXC. Lighter's is the median of its impact price, the index plus an 8-minute EMA of the premium clamped to ±0.5% of the index, and a median of CEX mark prices. On trade.xyz, relayer updates to the oracle and mark are additionally clamped to ±50 basis points per tick. The EMA and the median do the same job: a wick on one input, or a quick spoof on the book, barely registers.
What a median cannot protect you from is two of the three inputs agreeing on a wrong number. When the index itself is the problem, the book usually follows within seconds, because arbitrage bots trust the index too.
Case 1: one print, 960 liquidations (trade.xyz, 28 July 2026)
At the 08:00 Seoul open on 28 July 2026, a single SK Hynix share traded on the NXT pre-market at ₩1,272,000, about 30% below the previous close and at the daily limit. Buy orders arrived two minutes later and the stock recovered. But trade.xyz's oracle was switching from internal to external pricing at exactly that moment, and it submitted about $868 as the external price. The mark's EMA smoothing absorbed around 11 points of the move; the mark still fell 18.7% almost instantly. Roughly 960 long accounts, holding an estimated $57–80 million of notional, were liquidated, and profitable shorts were auto-deleveraged. Galaxy Research's verdict was that the oracle worked and the risk system did not. trade.xyz said the oracle behaved as specified and covered eligible losses as a one-time discretionary decision.
Case 2: the price feed was the exploit (Ostium, 15 July 2026)
Ostium is an RWA perp venue on Arbitrum whose prices arrive through off-chain reports signed by authorised keys. On 15 July 2026 an attacker with access to that infrastructure submitted fraudulent BTC/USD reports, traded against them and withdrew 23.75 million USDC of artificial profit from the public OLP vault. Trader collateral was untouched; trading was paused within the hour and resumed on 23 July after a migration to new infrastructure. Ostium's post-mortem found no smart-contract flaw and announced a recovery plan for LP depositors. The lesson is uncomfortable: a perfect contract cannot check whether the price it is handed is true.
Case 3: a hard-coded index (Aster, 25 September 2025)
At the launch of the XPL token, Aster's index was hard-coded at $1 with the mark capped near $1.22. When the cap was lifted the price spiked to $4 against about $1.30 elsewhere, and shorts were liquidated. Aster compensated within hours. New listings are where feeds break most often, because there is no deep market yet to take a median against.
Who pays when the price is wrong
Nobody is obliged to. trade.xyz, Aster and Paradex (after its January 2026 zero print) all reimbursed users, each describing the payment as discretionary. Lighter paid vault depositors in points after October 2025. Hyperliquid did not deploy or operate the SK Hynix market and did not pay. When a market is run by a HIP-3 deployer, the protocol's remedy is slashing the deployer's stake, and slashed stake is burned rather than paid to affected users. Treat any refund as a gift, never as a safety net.
How to protect yourself
- Know which price triggers what. Liquidation and stop orders fire on the mark; funding uses the index. Check the venue's docs for both.
- Size for a bad print, not a bad day. At 3× leverage almost every position in the SK Hynix event would have survived an 18.7% mark move. At 10×, none did.
- Prefer markets with deep external references. A BTC perp has dozens of exchanges feeding its index; a Korean pre-market stock had one thin book. HIP-3 and RWA markets inherit the weaknesses of whatever market feeds them.
- Be careful around session boundaries and listings. The SK Hynix print landed at the internal-to-external handoff; XPL broke at launch; Paradex's zero print happened during maintenance.
- Use isolated margin on anything with a single oracle operator, so one bad feed cannot take the whole account.
- Read the compensation history. Our incident timeline lists who paid, how much and how fast.
Prices on a DEX are not facts; they are the output of a process you can read about before you trade. The next lesson looks at the markets where that process is hardest: stocks that close at night and companies with no public price at all.
- Assuming the mark price is the last trade on the venue, and therefore that a thin book cannot liquidate you.
- Trusting a stock or RWA perp's price feed as much as a BTC index, although it may rest on one thin external book.
- Holding a high-leverage position through a market open, a token launch or a maintenance window, the moments when feeds break.
- Counting on compensation after a bad print; every refund so far has been discretionary.
- Believing a smart-contract audit covers the price feed; Ostium's exploit was in the off-chain price infrastructure.
Written and reviewed by the dexwatch editorial team. Last updated 2026-10-27. Educational content, not financial advice. Spotted an error? Tell us.