Coldfront
Trade on Hyperliquid with your cold wallet unplugged
Your cold wallet signs once to authorize an API key. Coldfront keeps that API key encrypted on your computer and gives it to the official Hyperliquid app when you unlock. You trade as usual. Withdrawals still need your cold wallet.
Demo
How it works
Authorize an API key with your cold wallet
On Hyperliquid's API page, connect your cold wallet and authorize a new API wallet. Its private key is the API key. The device signs this once, and the API key lasts up to 180 days.
Paste the API key into Coldfront
Coldfront encrypts it with your passphrase, and with Touch ID if you want. Then disconnect the cold wallet from Hyperliquid and put it away.
Trade as usual
Unlock Coldfront and open Hyperliquid. The official app shows your cold wallet's account and signs orders with the API key. No wallet is connected.
What the API key can do
Hyperliquid decides what an API key can sign. Moving funds always needs your cold wallet, so a leaked API key could not withdraw. You can revoke it on Hyperliquid's API page at any time.
Can
- Place and change orders
- Cancel orders
- Close positions
- Show balances
Cannot
- Withdraw
- Send funds
- Move funds between accounts
- Approve other wallets
Auto-lock
- After a set timeFrom 5 minutes to 4 hours, or when the browser closes.
- When you step awayThe computer goes idle or the screen locks.
- When you close HyperliquidThe last Hyperliquid tab closes.
- On lockEvery Hyperliquid tab reloads and the app forgets the API key.
Security
PBKDF2 with 600,000 rounds and AES-GCM, the same method MetaMask uses. The passphrase is at least 12 characters.
Optional. A passkey on your device unlocks the vault. Its secret never leaves the device.
The API key is removed from page storage as soon as the Hyperliquid app has read it.
Every Hyperliquid tab reloads on lock and is checked, so no tab keeps the API key.
The extension talks only to Hyperliquid. No analytics, no accounts, nothing sent to us.
Six security review rounds and 154 automated tests, including tests in the live Hyperliquid app.
Price
Free. Coldfront is made by a small independent team, and the extension collects no data. It works with Hyperliquid accounts that joined with referral code COLDFRONT. The code takes 4% off your trading fees, and Hyperliquid pays us a share of the fees. That share is what keeps Coldfront running.
Hyperliquid accepts a code only before an account's first trade. If your cold wallet's account has already traded, add a second account on the device and use it for trading: new account guide.
Referral code
app.hyperliquid.xyz/join/COLDFRONT
FAQ
Do I still need my cold wallet?
For three things: authorizing the API key (it lasts up to 180 days), withdrawals, and moving funds between accounts. Everything else you do in the Hyperliquid app with Coldfront unlocked.
Which cold wallets work?
Any cold wallet that can authorize an API wallet on app.hyperliquid.xyz, such as Ledger, Trezor, Keystone or OneKey, usually through MetaMask or Rabby. Coldfront itself never talks to the device.
What can the API key do?
Place, change and cancel orders, and let the app show your positions and balances. It cannot withdraw, send, transfer between accounts or approve other wallets. Hyperliquid enforces this, not Coldfront.
Why does it need referral code COLDFRONT?
It is how Coldfront is paid, and it costs you nothing. The code takes 4% off your trading fees, and Hyperliquid pays us a share of the fees. We are a small independent team with no ads and no data to sell, so that share is what keeps Coldfront running.
I already have a Hyperliquid account. Can I use it?
Only if it joined with code COLDFRONT. Hyperliquid accepts a code only before an account's first trade. Most cold wallets can add a second account, and you can use that one for trading. The new account guide takes about five minutes.
Where is the API key stored?
On your computer, encrypted with your passphrase (PBKDF2 with 600,000 rounds, AES-GCM). It reaches the Hyperliquid tab only while Coldfront is unlocked, and it is removed from page storage as soon as the app has read it.
What happens when it locks?
Every Hyperliquid tab reloads, so the app forgets the API key. Coldfront locks after the time you choose, when the computer is idle or the screen locks, or when the last Hyperliquid tab closes.
Does Coldfront collect data?
No. The extension talks only to Hyperliquid. There are no analytics, no accounts and no servers of ours.
Is it made by Hyperliquid?
No. Coldfront is made by an independent team and works with the official Hyperliquid app. It is not affiliated with Hyperliquid.