Security & Custody
whale.ag is non-custodial: you trade from your own Hyperliquid account, sign your own orders, and remain the only person who can move your funds. There is no whale.ag balance sitting between you and your money — the wallet you connect is your Hyperliquid account, so there is nothing for us to freeze, lose, or be hacked out of.
Your account is yours
whale.ag is a terminal on top of Hyperliquid, not a bank. Your deposits sit in your own Hyperliquid account, every order that moves money is signed by you, and withdrawals always go back to you. Because you trade as yourself, you keep your own exchange standing too — your own rate limits and referral status, never routed through a shared whale.ag account. Logging in is a signature, not a transfer: connecting signs a message to prove you own the wallet, and it never moves funds or grants any spend or withdrawal power (see Connect Your Wallet).
The one thing to hold onto is that non-custodial means we can’t move your funds — it doesn’t remove market risk. Leverage can still liquidate a position and a copied trader can still lose, so size accordingly.
What you control, and what we can’t do
The trust model is simple enough to state as a table. Everything that moves money to or from you needs your wallet; nothing whale.ag holds can be turned against you.
| You control | whale.ag never |
|---|---|
| Your Hyperliquid account and its private key | Holds your funds or your keys |
| Signing every order and every withdrawal | Can withdraw or transfer your funds |
| Funding and emptying your copy-trading agents | Can move an agent’s funds to itself |
| Ending an agent and pulling all capital back | Can block you from recovering your money |
The optional trade key
Approving every order through a wallet popup is painful in a fast market, so whale.ag offers a one-approval trade key (Hyperliquid calls this an agent, or API, wallet). You approve it once, and after that your orders, cancels, leverage changes, and take-profit and stop-loss edits sign instantly in the browser. It is convenient by design and limited by design.
A trade key can only place trades. It has no withdrawal power and can never move, send, or withdraw your funds — only open and close positions on the account you already control. It is also short-lived, expiring after about seven days and then simply refusing to sign until you re-approve it, and you can revoke it at any time by removing it from your Hyperliquid account, which kills it immediately. It is entirely opt-in: if you would rather approve each order, don’t enable it and nothing else changes. Because a withdrawal always demands your real wallet signature, even a compromised trade key cannot drain your account. See No-Popup Trading for the full walkthrough.
Copy-trading agents and their keys
A copy-trading agent needs to place trades on its own, around the clock, without you signing each one, so it operates from a dedicated wallet with its own key. You fund that wallet and you can empty it at any time — depositing, pausing, resuming, topping up, taking profit, and closing it out are all your calls. The agent’s only job is to mirror a trader’s positions on its own wallet; getting your money back out runs through the withdrawal path below, which always returns funds to you.
The key that operates an agent is protected with hardware-backed key management. The raw key is never written out in the clear and is never exposed — not to the browser, not to staff, not to anyone. See Copy Trading and Managing Agents for how deploying and running one works.
Getting your money out — always
Recovery is a first-class feature, not an afterthought. End & Withdraw winds an agent all the way down in a single guided flow — stopping it, closing positions, draining the wallet, and withdrawing back to you — from one signature. That wind-down is hardened to pick up exactly where it left off if it is interrupted, so a dropped connection or a page reload can’t strand your funds mid-withdrawal, and a background safety reconciliation watches for interrupted withdrawals and resumes them so pending money is never left behind.
Withdrawing from your own wallet uses Hyperliquid’s native path straight back to your address — one signature, a flat network fee, and no whale.ag hand in the middle. See Withdrawals for the details.