How one of crypto’s leading trading firms unified monitoring, uncovered opportunities, and scaled its DeFi research operations with Hypernative.
As one of the largest crypto liquidity and OTC providers, Wintermute has built its reputation on deep connectivity across the crypto ecosystem, enabled by its advanced trading technology and comprehensive market understanding. But when the firm expanded into yield farming across dozens of DeFi protocols, their research team faced a new challenge: how to monitor complex, dynamic risk exposure across multiple chains without drowning in manual work.
The answer came through a technical deep-dive with Hypernative's Co-founder and CTO - Dan Caspi - that convinced Igor Igamberdiev, Wintermute's Head of Research, that real-time monitoring could finally scale alongside their growing farming portfolio.
Wintermute has been building custom monitoring solutions since 2019. For their core trading operations, atomic interactions with DEXs and quick arbitrage plays, these internal tools worked fine. Risk was contained in smart contracts, and exposures were short-lived.
But yield farming changed everything.
Last year we started to do farming with funds kept in various protocols and the risk is actually dynamic. We start with due diligence, we look at how everything works, but two or three months after we deployed funds, something could change. A new strategy could be added, something else could be done. We just don't want to spend our time redoing due diligence every two to three months.
Igor Igamberdiev, Head of Research @ Wintermute
The team needed a monitoring system that could:
Their homegrown solutions, built protocol-by-protocol over years exclusively for trading, simply couldn't keep pace. "It's kind of obvious that this approach is not really scalable," Igor noted.
In early 2025, Wintermute enlisted Hypernative for their expanding farming operations. Today, Wintermute's research team uses Hypernative for two distinct purposes: systematic monitoring of their farming portfolio and rapid tracking of onchain opportunities.
Their farming monitoring follows a three-layer approach that decomposes positions by dependencies:
The team has configured multiple watchlists, monitoring both specific addresses and core protocols functionality. Watchlists enable easy configuration for getting Alerts and Automated Response triggers on hundreds of out-of-the-box Hypernative agents that monitor technical, financial, governance and, most importantly, security risks, employing machine learning, behavioral analytics, fuzzing, simulation and other techniques. For Wintermute, these watchlists provide baseline exploit detection and monitor for generalized security risks across all core dependencies of a position.
With any position, we go in a layered way where we decompose it by dependencies. For example, with the Lombard vaults, there are a ton of projects we are exposed to directly. So we would track them via watchlists.
Bohdan Pavlov, Research @ Wintermute
The second layer uses custom agents to track critical protocol-specific events that could impact position security or profitability. Wintermute has deployed dozens of custom agents monitoring everything from admin role changes and minter role modifications to governance proposal executions, vault allocation changes, reward distributions, and caps raises.
The speed of deployment is crucial:
Any custom agent we want to utilize for event tracking can be set up within minutes without any hassle, which brings quite a lot of convenience.
Bohdan Pavlov, Research @ Wintermute
The most sophisticated layer leverages Hypernative's SDK to monitor read-only contract variables and complex financial metrics.
With Hypernative’s SDK, we can access on-chain data without any extra hassle related to setup and distribution of alerts based on processed data. This includes both real-time and historical data—critical for detecting patterns and conducting research.
Bohdan Pavlov, Research @ Wintermute
On the yield side, the team tracks real-time APY based on share price changes for ERC-4626 vaults, monitors supply APY and borrow rate spikes, follows reward distribution tracking including off-chain sources like Merkl, and calculates position profitability in real-time.
For risk management, they monitor oracle price deviations across Pyth, Chainlink, Redstone, and fundamental oracles, track health factors and leverage ratios, calculate collateral and liability values in USD, and check liquidity availability for exits. This comprehensive SDK-based monitoring provides the financial intelligence needed to optimize positions while maintaining tight risk controls.
To understand how these layers work together, consider how Wintermute monitors a leveraged position like eUSDe/USDC on Euler. The oracle risk monitoring covers multiple layers: tracking Euler's oracle implementation for both assets, monitoring the fundamental oracle for eUSDe's share price as an ERC-4626 vault, checking Pyth oracle deviations for the underlying USDe from its $1 peg, and verifying Redstone oracle staleness. Any deviation in these oracle feeds could trigger liquidation events, making real-time monitoring a critical component to operational strategy.
At the protocol-level, the team monitors whether deposits and withdrawals remain enabled on the vault, tracks significant supply changes in USDe that could signal market stress, and alerts on any admin role changes until the admin is eventually set to address(0) for immutability. These protocol-specific events can dramatically impact position safety even when market conditions remain stable.
Finally, the financial performance layer tracks supply APY for eUSDe, borrow rates for USDC, the position's health factor and leverage ratio, real collateral and liability values denominated in USD, and off-chain reward distributions including points accrual. This comprehensive monitoring setup allows the team to exit positions when yield becomes unfavorable and remain aware of events that happen related to assets they are exposed to.
The real test of any monitoring system is response time. For Wintermute, the answer is dramatic: "It could be less than five minutes... it can be even less than one," Igor says.
Hypernative is helping us to find the right moment. We have everything prepared on our side. We just see an alert, do a quick check that things are as we expected, and hit the transaction button.
Bohdan Pavlov, Research @ Wintermute
One position in particular demonstrates the value of immediate detection and alerts. The team was monitoring a Uniswap V3 LP position using custom agents to track whether it was in range. When alerts indicated trouble, the team were able to rebalance rapidly and able to withdraw all funds just 20 minutes before a potential 60% loss.
However, it's not just about avoiding losses.
The monitoring system has helped Wintermute:
Identify arbitrage exploits: The Wintermute team are tracking supply changes for tokens they are exposed to using Hypernative. Noticing some strange behavior for one project within a short time frame, the team launched an investigation, eventually discovering an arbitrage of the rewards distribution. As long-term holders, Wintermute quickly messaged the team and a fix was deployed.
Optimize capital deployment & rotation: For protocols with competitive, first-come-first-serve deposits, Hypernative delivers alerts when entry becomes possible, enabling the Wintermute team to deploy capital. The team is also able to track when utilization rates drop on protocols like Euler and Morpho, alerting when "funds become available to withdraw."
Streamline operations: Wintermute has used Hypernative to automate the tracking of reward claims across various projects, reducing operational costs and maximizing profit.
The Wintermute team’s approach aims to maintain human oversight. "We always want to have a human in the loop," Igor explains. "Some positions could be quite complex, and a position could give us a 3-5% loss just from slippage. We can execute this much better internally."
For a team of six researchers, with only two actively managing operations, efficiency is paramount. The right monitoring infrastructure means they can do more with less.
The team configures alerts across seven distinct communication channels, routing messages based on severity and category. Information about positions goes to one channel, critical security alerts go to another.
But perhaps most valuable is the research capability that comprehensive monitoring unlocks. "If we notice the borrowing rate jumping, we could check what caused it and end up finding something interesting - a new opportunity," Bohdan says. Access to historical data through the SDK enables pattern recognition and market intelligence that goes beyond just risk management.
Feature sets can always be quite similar, but I wanted to work with someone who understands how the crypto industry works.
Igor Igamberdiev, Head of Research @ Wintermute
That technical partnership between Wintermute and Hypernative shows up in small ways: "The team was really active and helpful in the chat during challenging periods," Igor notes. When we need something, "I message Hypernative’s CTO directly and problems get addressed quickly.”
The responsiveness matters for a team that moves fast and experiments constantly. "99% of our tracking cases are in Hypernative," Bohdan confirms.
Wintermute's monitoring setup continues to evolve. The team is developing an internal tool to enhance tracking and data visualization, with plans to integrate Hypernative data streams for historical analysis.
"The main advantage of streamflowing would be access to historical data, which would allow us to have more tailored alerts for supply/borrow APY and overall more data for research goals," the team notes in their technical documentation.
For now, the Wintermute team remains focused on their core use case: scaling farming operations without scaling headcount or manual overhead. The monitoring foundation Hypernative provides means they can evaluate new protocols faster, deploy capital more confidently, and respond to both risks and opportunities in real-time.
With Hypernative, we can quickly check some of our opportunity hypotheses onchain. And because we don't need to care about manually managing risk on our side, we can deploy more capital or deploy it in a more diversified way. Hypernative helps us to move faster and to increase our market coverage.
Igor Igamberdiev, Head of Research @ Wintermute
About Wintermute
Wintermute is a global algorithmic trading firm, leading OTC desk, and liquidity provider in digital assets. With over $15 billion in average daily trading volume, it provides liquidity across 60+ centralized and decentralized exchanges and is a key partner to token projects seeking deep, scalable liquidity. Wintermute's proprietary trading infrastructure allows it to operate across the entire digital asset ecosystem, making it the preferred counterparty for a broad range of players, including some of the world's largest traditional financial institutions. This reach now extends further into traditional finance, with active trading on exchanges such as CME and Eurex. Building is central to Wintermute's DNA, with the company incubating new protocols, some of which have grown into independent businesses.
About Hypernative
Hypernative is a real-time monitoring, risk detection, and automated response solution trusted by over 250 clients, including industry leaders like Galaxy Digital, Circle, OKX, and Coinbase. Our platform accurately identifies over 300 risk types with a 99.8% detection rate and an exceptionally low false positive rate of just 0.001%, providing precious minutes to respond before damage occurs. Hypernative actively secures over $100 billion in digital assets across 70+ blockchains, having already saved over$2 billion in funds from hacks, exploits, and fraud.
Reach out for a demo of Hypernative’s solutions, tune into Hypernative’s blog and our social channels to keep up with the latest on cybersecurity in Web3.
Secure everything you build, run and own in Web3 with Hypernative.
