The Evolutionary History of Contract Algorithms: A Decade of Perpetual Contracts, the Curtain Has Yet to Fall

Author: danny

On March 12, 2020, Arthur Hayes of BitMEX made a decision that went against tradition but saved the world—cutting off the network connection to their own servers (aka pulling the plug). The public announcement stated it was "under a DDoS attack." But what was the truth?!

The truth is: there were only $20 million in buy orders left on the order book, facing $200 million in pending liquidation sell orders. If the network had not been cut, the BTC contract price would have been driven to zero by the liquidation engine itself.

At that moment, the entire crypto perpetual contract market was just minutes away from systemic collapse.

All the seemingly "self-evident" mechanisms of perpetual contracts today—mark price, tiered liquidation, U-based, portfolio margin—were forced to be rewritten after that moment.

Introduction: A Concept That Slept for Twenty Years

In 1993, Robert J. Shiller proposed a peculiar derivative concept—no expiration date, no physical delivery required, prices anchored by external data sources, with both long and short parties paying each other at a certain rate. He intended to use it to hedge liquidity risks in the real estate market. In that era, it was a typical product of "academically elegant, practically impossible": the clearing infrastructure of traditional finance was too outdated, and the regulatory framework too rigid, with no exchange willing to touch a contract that would "never expire."

This idea slept in the ivory tower for a full twenty-three years.

On May 13, 2016, BitMEX dug it out from the archives, fueled it with Bitcoin, and lit it up.

The XBTUSD perpetual contract launched that day went unnoticed, with no one realizing it would consume 93% of the entire crypto market's derivatives volume a decade later. At that time, it resembled more of a technical experiment—a 100x leverage toy provided to a group of fearless geeks. But this toy underwent hundreds of crises, liquidations, manipulations, and iterations of weaponized and patched rules over the next decade, ultimately evolving into a global pricing machine processing nearly $200 billion in volume daily.

This article aims to answer a specific question: How did every gear of this machine come to be?

The answer is not drawn on a whiteboard by engineers. Behind every gear stands a specific disaster.

Chapter 1 Genesis: The Original Sin of Pricing Triad and Coin-Based Contracts (2016--2018)

Engineering Shiller's Concept

The fundamental challenge faced by perpetual contracts is singular: without an expiration date, there is no "forced convergence point." Traditional futures must return to spot prices on the delivery date, but if perpetual contracts are not designed with a specific anchoring mechanism, their prices will devolve into pure speculative drift.

BitMEX's solution consists of three interlocking components (Pricing Triad):

1. Index Price: Obtained by taking the weighted average of transaction prices from multiple external spot exchanges, it serves as the "physical anchor" of the entire system. Its design assumption is that even if malicious funds can pollute a single data source, it is difficult to simultaneously pollute all data sources.

2. Mark Price: This is the "liquidation anchor." It is based on the index price, adding a smoothed basis through EMA:

   Mark price = Index price + EMA (Basis)

   The liquidation engine only recognizes the mark price. Instantaneous "spikes" on the order book will be smoothed out by the EMA and will not transmit to the liquidation determination—this is the core mechanism against "spike hunting."

3. Funding Rate: This is the "gravity" that brings the contract price back to the index price:

   F = P + clamp (I − P, −0.05%, +0.05%)

   Where P is the premium index, and I is the fixed interest rate component (0.01%). When the contract is at a premium, F is positive, and longs pay shorts, raising the cost of going long; conversely when at a discount. BitMEX initially set the settlement to occur every 8 hours, with a single cap of ±0.75%.

This triad appears simple and elegant, but each parameter hides an implicit assumption. The 0.01% fixed interest rate reflects the economic judgment that "holding stablecoins has a slight interest advantage over holding crypto assets"—this is also the source of the later famous "structural anchor" effect. The 8-hour settlement cycle is a compromise between market liquidity and server computing power. The ±0.75% cap is a relatively conservative estimate of "extreme deviation."

These assumptions hold when the market is stable. But the market is never stable for long.

The Double-Edged Sword of Coin-Based Reverse Contracts

Early perpetual contracts faced a real limitation: the stablecoin ecosystem was not yet mature. The circulation of USDT only broke $2 billion in early 2018, far from sufficient to support the margin requirements of the derivatives market. Traders only had BTC in hand and could only use BTC as margin.

This gave rise to "coin-based reverse contracts"—contracts priced in USD, but margin and profits/losses settled in BTC. The profit formula is nonlinear:

PNL (BTC) = Contracts x (1 / Entry - 1 / Exit)

In a bull market, longs benefit from both contract profits (increased BTC quantity) and the appreciation of BTC itself, creating a double multiplier—this was the engine that created countless wealth myths in the early days. But profits and losses come from the same source: in a crash, contract losses and margin depreciation resonate in sync, forming a "death spiral." A 10x leveraged long position, when BTC drops 10%, not only incurs a 100% floating loss on the contract, but the fiat value of the margin also shrinks by 10%—the double blow triggers the liquidation engine much faster than theoretical models suggest.

(Note: Coin-based vs U-based: A comparison of the fate of the same position—10x leverage long BTC, price drops 10%)

This flaw was limited in 2020, but it truly scared the market for the first time in August 2018.

Lesson One: OKEx's 50,000 BTC and "Socialized Clawback"

On August 3, 2018, a massive long position with a nominal value of about 50,000 BTC (approximately $360 million at the time) appeared in OKEx's (now OKX) BTC quarterly futures contract. The holder of this position clearly had a serious misjudgment of the market—BTC prices fell sharply, ultimately reaching its liquidation line. (Reference: OKEx Abnormal Position Handling Announcement)

At that moment, OKEx's risk control system faced a dilemma:

• Market Price Liquidation meant dumping 50,000 BTC sell orders into a market with an average daily depth of only a few hundred million dollars. This would instantly break the order book, causing the liquidation price to be far worse than the bankruptcy price (the loss from the bankruptcy price difference would be borne by the exchange), and trigger a wave of liquidations of small and medium positions through a chain reaction.

• Not Liquidating meant violating rules, undermining the system's credibility.

OKEx ultimately chose the "standard tool" of the industry at the time—Socialized Clawback: distributing the systemic losses caused by this massive liquidation proportionally among all traders who made profits that week. That week, many short traders made money, only to watch their profits proportionally reduced by the exchange.

The community's reaction was one of anger.

The problem with this mechanism is that it shifts risk from "risk-takers" to "innocents." A trader who made money shorting ETHBTC might have their profits deducted due to the liquidation of a BTC long position completely unrelated to them—this violates the most basic ethics of trading: you are only responsible for your own decisions.

This incident directly prompted three reforms in the industry:

1. Introducing Position Limits. A single user's position cannot exceed a certain proportion of the market's capacity—cutting off the "too big to fail" risk at the source.

2. Establishing a sufficiently large insurance fund to absorb liquidation losses, rather than distributing them to users.

3. ------This is the truly exciting part of the story------OKEx was forced to abandon socialized clawback and turn to the automatic liquidation system (ADL) that had already been invented and validated by Huobi years earlier.

There is a frequently overlooked historical detail: ADL was not invented by BitMEX; it was invented by Huobi. As early as 2014-2015, Huobi (along with OKCoin at the time) had already dominated the cryptocurrency delivery futures market. It was during that period that Huobi designed an automatic liquidation algorithm based on "profit percentage × effective leverage" to solve the fair distribution problem of liquidation losses. When BitMEX launched the XBTUSD perpetual contract in 2016, its ADL mechanism was a direct copy of Huobi's design with some minor adjustments—this was explicitly acknowledged in BitMEX's own official blog (in the 2025 article "Adapt or Die"):

"We copied the Huobi ADL mechanism but made a few tweaks."

The essential difference between ADL and clawback lies in the precision of loss distribution. Clawback is a communal pot, where all profitable participants share the burden. ADL, on the other hand, is based on a precisely guided ranking algorithm:

Ranking score = PNL % / Effective %

Only those accounts that "use the highest leverage and earn the most floating profits" will be forcibly liquidated, using their profitable positions to absorb the bankrupt user's liquidation orders. Ordinary traders with low leverage and low profits are unaffected.

(Note: Socialized clawback vs ADL: Two philosophies of loss distribution during the same liquidation crisis)

Before 2018, both BitMEX and Huobi had already adopted ADL. Only OKEx insisted on the simpler and more brutal socialized clawback—until that 50,000 BTC position pushed the entire system to the brink of collapse, forcing it to switch to ADL afterward. From then on, clawback was completely swept into history.

This history has a rather enlightening implication: in the evolution of crypto derivatives, the most critical innovation in clearing mechanisms was completed by a Chinese exchange before BitMEX invented the perpetual contract. BitMEX enjoys historical status as the inventor of the perpetual contract, but one of the key risk control gears that allow perpetual contracts to survive to this day was truly invented by Huobi.

Insurance Fund: The First Line of Defense Against Liquidation Losses

But ADL is not and should not be the first mechanism for loss distribution. The essence of ADL is to "forcefully liquidate the positions of profitable traders" in extreme situations—this is still an unwelcome intervention for a trader who has long held a profitable position. A healthy risk control system should have a buffer to absorb losses before ADL is triggered.

This buffer is called the Insurance Fund.

The core logic of the insurance fund is exceptionally simple—it utilizes a structural "dividend" during the liquidation process. When a user's position is forcibly liquidated, the liquidation engine must handle this position at the current market price. However, the exchange's liquidation price does not equal the price at which the user's account goes to zero (the bankruptcy price). There exists a premium between the two:

Insurance fund inflow = Liquidation price - Bankruptcy price

For example: a 100x leveraged long position opened at BTC = $50,000. When BTC drops to $49,500 (about -1%), the account's maintenance margin is exhausted, but the liquidation engine takes over at $49,600. The account's bankruptcy price is $49,500, and the liquidation transaction price is $49,600—the $100 difference is not returned to the user (the user has already "liquidated to zero"), nor does it go to the exchange's profit statement, but is entirely injected into the insurance fund.

This mechanism creates a subtle structural balance: in most normal market conditions, the liquidation price of users being liquidated is higher than the bankruptcy price when market liquidity is sufficient, continuously injecting funds into the insurance fund. The fund's size accumulates like a snowball. When extreme market conditions arise and liquidation losses occur, the fund pays first, and profitable users do not need to perceive the existence of these losses. Only when the fund is completely exhausted and still insufficient to cover the liquidation losses will ADL be triggered.

This is the three-layer defense system commonly used by modern crypto derivatives exchanges.

If the first layer is thick enough, the second layer is rarely touched; if the second layer is precise enough, everyone is fine. The insurance fund size of modern mainstream CEXs (Binance, OKX, Bybit, Bitget, etc.) usually maintains between hundreds of millions to over a billion dollars—sufficient to absorb the vast majority of liquidation scenarios. According to public data, Binance's contract insurance fund has long maintained at a level of $500-800 million by early 2026; Bybit's USDT perpetual insurance fund also remains above $400 million.

The insurance fund has another layer of significance—transparency tool. Since the balance changes of the insurance fund directly reflect the "frequency of extreme liquidation events" in the market, leading exchanges (Binance, OKX, Bybit) publicly display the historical curve of the insurance fund. The change curve of the fund balance is, in a sense, a barometer of the health of that exchange's liquidation engine. A continuously rising fund balance indicates smooth liquidations and rare liquidations; a sharp drop exposes that the liquidation engine encountered a liquidity break during an extreme market condition.

Historical Node Review:

• 2015-2017: Early exchanges (BitMEX, OKCoin, Huobi) had already introduced prototypes of insurance funds, but their scales were small.

• 2018 OKEx 50,000 BTC Incident: The insurance fund was systematically discussed in the industry for the first time—if OKEx had established a sufficiently large insurance fund at that time, this $400 million liquidation loss could have been absorbed by the fund, without needing to initiate socialized clawback. After this incident, the insurance fund was recognized as essential infrastructure in the industry.

• 2019-2020: Leading exchanges began to publicly disclose insurance fund data as a declaration of risk control transparency.

• March 12, 2020 (312): The insurance fund faced the ultimate stress test. On that day, Binance and Bybit's insurance funds saw net outflows of tens of millions of dollars in a single day, but the scale was sufficient to absorb most of the liquidation losses, avoiding large-scale triggering of ADL—this was the most critical part of the "disaster that did not occur" during the 312 incident.

• 2022 FTX Collapse: A counterexample. FTX's "insurance fund" was long suspected to be a fictional number, with the real scale far from sufficient to cover its contract risk exposure, ultimately failing to provide any buffer during the collapse.

• 2024-2026: The scale of the insurance fund has become one of the dimensions of "hard power" competition among leading exchanges, with some exchanges even opening real-time on-chain verifiable fund balance addresses.

The insurance fund may seem like a small patch of financial engineering, but its position in the risk control system of perpetual contracts is extremely critical—it transforms "liquidation" from a disaster at the user level into a routine event that can be absorbed at the system level. Without the insurance fund, every liquidation is a dialogue with ADL; with the