The short answer
No: an approved Hyperliquid agent key cannot withdraw from your account, and it cannot send your USDC or your tokens anywhere, because the venue refuses it those actions for what it is and not for the amount. It can place and cancel orders, and it was able to do one other thing with your money: deposit the account into a Hyperliquid vault.
Everything below is one measure on mainnet, on 28 September 2026, with a real approved agent key on a test account. The agent wallet page of this site carries the same record.
How it was measured
A test account holding about 60 USDC approved a fresh agent key for one hour, as Locker Vault does in production. The agent key then signed every action that moves money, each one for 1,000 USDC, far more than the account held, so nothing could move and only the reason for each refusal mattered.
The account then signed the same requests. Where the agent got a different answer than the account, it had been stopped for being an agent. Where both got the same answer, the action was tried again for a small amount, toward a destination that stays the account's.
What Hyperliquid answered
| Action signed by the agent key | Hyperliquid's answer |
|---|---|
| Place an order, then cancel it | accepted |
Withdraw (withdraw3) | refused |
Send USDC or a token (usdSend, spotSend, sendAsset) | refused |
Move between spot and perps (usdClassTransfer) | refused |
Approve a second agent (approveAgent) | refused |
Approve a builder fee (approveBuilderFee) | refused |
Deposit the account into a vault (vaultTransfer) | accepted |
Every refusal read the same way: Must deposit before performing actions, naming the agent's own address. Hyperliquid had applied the action to the agent's address, which holds nothing, instead of to the account that approved it. The same requests signed by the account itself met balance errors, which is a different answer.
No second agent appeared in the account's list after the refused approveAgent. The builder fee approval was refused too, which matches the documentation: that action must be signed by the user's main wallet, not by an agent wallet.
The one movement of funds it signed
vaultTransfer is not applied to the signer: it is an L1 action, and Hyperliquid attached it to the account that had approved the key. Asked for 1,000 USDC the agent got the same insufficient funds answer as the account, so the test was repeated for 5 USDC toward HLP, Hyperliquid's own vault, a destination that stays the account's. It went through: the account's spot balance fell from 60.78 to 55.78 USDC, and its vault equity read 5.0.
A stolen agent key cannot take your money out, but it can move it into a vault run by someone else, whose operator can then lose it trading against themselves. So the sentence an agent key can only trade is false. We corrected our own pages that said it, and this is why the one bound that really holds is an account holding only what you are ready to lose.
What the guardian adds
lpa never signs that action. Its guardian signs a closed list of trading actions: placing, changing and cancelling orders, setting a market's leverage and margin, and setting the referral code. vaultTransfer is not on the list, so no command from you, from a script or from an AI assistant produces one.
Deposits, withdrawals and moving margin between dexes are signed by your wallet: in Locker Vault, on the offline phone, as a QR ceremony, or as a request you approve in your extension or mobile wallet. The guardian also checks every opening against this computer's limits and against the mandate your wallet signed, and it answers only requests carrying the token it wrote when it started.
That is a bound on lpa, not on the key. A thief holding the sealed key file and your password does not need lpa, and no file on your computer stops them.
The bound that actually holds
Three things hold whatever happens on the computer: the venue refuses that key every withdrawal and every send, the approval ends on its own, and an account used for the agent alone holds only what you put into it. The last one is the only bound that does not depend on software.
To end it: lpa mandate revoke stops every opening at once and needs no wallet; lpa agent revoke retires the key at the venue, with your wallet; lpa panic stops every pilot and copy and takes the key out of memory. None of the three closes a position.