Monero Wallet Download: Understanding Why Consensus Rules Force Wallet Re-Syncs After Hard Forks

A user downloads the latest Monero wallet, syncs the blockchain, and conducts transactions for weeks. Then a network upgrade occurs. Within hours, their wallet becomes unable to validate new blocks or send funds. The wallet software itself appears unchanged, but the network has moved forward and left it behind. This is not a bug or a failure of the monero wallet download process. It is a direct consequence of how Monero’s consensus rules work: when the protocol changes through a hard fork, every wallet must re-validate the entire blockchain history against the new rules to confirm which blocks are legitimate. This requirement is fundamentally different from static coins and explains why Monero users experience periodic forced resynchronizations that other cryptocurrency wallets do not.

Understanding this mechanism is essential for anyone managing XMR holdings, because it reveals why Monero prioritizes forward-incompatibility and how privacy upgrades trade off against user friction. Bitcoin and most other cryptocurrencies can add features without invalidating old blocks, because their consensus rules rarely change in ways that affect historical validity. Monero’s privacy mechanisms—ring signatures, stealth addresses, RingCT, and the upcoming FCMP++ protocol—are deeply embedded in block structure and transaction validation. When these change, the wallet must reprocess every block from genesis to verify that it still conforms to current rules, not just to the rules that were active when the block was created.

Monero wallet download interface showing blockchain synchronization progress during a hard fork upgrade

Why Monero’s consensus rules are tighter than Bitcoin’s

Bitcoin can introduce new transaction types, opcodes, and features without requiring wallets to re-validate the entire blockchain. The reason is architectural: Bitcoin’s validation rules are generally backward-compatible. A new soft fork adds constraints or allows new spending conditions, but it does not change the meaning of old blocks. An old wallet can still recognize which transactions were valid under its ruleset, even though newer wallets enforce stricter rules.

Monero does not have this luxury, because its privacy mechanisms are integral to block validity itself. A ring signature on a Monero transaction must be validated in a way that depends on the exact ring size, the decoy selection algorithm, and the proof-of-work difficulty adjustment schedule. When Monero upgrades to a new ring signature scheme or changes the size of the anonymity set, every transaction in the chain must still be verifiable under the old scheme for blocks that predate the upgrade. However, blocks created after the upgrade must satisfy the new scheme. This means the wallet must know which rule set applies to each block in order to validate the chain.

The consequence is that Monero implements hard forks as the primary mechanism for upgrading privacy. A hard fork is a protocol change that is incompatible with older rule sets; wallets that do not upgrade cannot recognize new blocks as valid. For a privacy coin, this is less of a compromise than it initially appears. A hard fork forces all participants to make a conscious choice: upgrade to the new protocol or remain on an older, less private version. Because privacy is Monero’s defining feature, there is a strong incentive for all participants to upgrade together.

The trade-off is friction. Every hard fork requires a wallet to re-sync the entire blockchain against the new consensus rules. If a wallet was last updated in August 2025 and a hard fork occurs in October, the wallet will refuse to validate blocks created after October until it has re-processed the entire chain under the new rules. This can take hours on a mobile device or minutes on a fast machine with a local node, but the requirement is absolute. There are no shortcuts: partial sync or trusting a third party to validate old blocks does not satisfy the consensus protocol.

How monero wallet download mechanisms handle fork validation

When a user downloads Monero wallet software from the official repository or a trusted source like monero wallet download options, they receive a binary or source code that includes the current consensus rules. If they download wallet software released after a hard fork, the consensus rules in that version are already current, and a fresh sync will work without re-validation. The problem arises when wallets are updated in-place or when users run outdated binaries.

The official Monero GUI and CLI implement this by storing a hardcoded hard fork height—the block number at which a rule change takes effect. When the wallet syncs, it compares the fork heights in its code to the blocks it receives. If a block arrives before its corresponding fork height, the wallet applies old rules. After the fork height, it applies new rules. This means a wallet can theoretically understand multiple rule sets, but only if its developers compiled support for all relevant forks into the binary.

In practice, wallet developers do not maintain backward compatibility indefinitely. Cake Wallet, Feather Wallet, Monerujo, and other community wallets are updated as consensus changes occur, but users must install the updates to remain synchronized. A user who runs a monero wallet download version from six months ago will eventually hit a fork height that their wallet does not recognize, causing synchronization to fail. The older version will refuse to accept blocks that do not match its outdated consensus rules, effectively locking the user out of the network.

This is why the Monero Project publishes detailed release notes and upgrade schedules well in advance, so users and wallet developers can prepare. The project also provides checkpoints—hardcoded block hashes at known heights—that help wallets detect forks or chain reorganizations. These checkpoints do not replace consensus validation, but they accelerate the sync process and provide an early warning if something has gone wrong.

The monero supply and privacy upgrades are linked

Monero’s tail emission—a fixed issuance of 0.6 XMR per block indefinitely—is one of the protocol’s most debated features. Unlike Bitcoin, which will eventually reach a fixed supply of 21 million BTC, Monero will continue issuing new coins at a constant rate. This sustains mining incentives and network security after the initial reward reduction.

However, the tail emission interacts with privacy upgrades in a subtle way. When Monero changes its ring signature scheme or RingCT mechanism, the monero supply calculations remain the same, but the way new coins are validated against those privacy rules changes. A hard fork does not alter how many coins are issued, but it can change the cryptographic proof required to validate that issuance. This is why every fork requires re-validation of all prior blocks: the wallet must confirm that each block’s reward was legitimate under both the old and new rule sets.

The upcoming FCMP++ upgrade, which is scheduled for a future hard fork, illustrates this relationship clearly. FCMP++ is a new proof system designed to replace RingCT with a more efficient and flexible zero-knowledge proof. The Monero Research Lab has published detailed specifications explaining how FCMP++ maintains the same inflation schedule as RingCT but with different mathematical assumptions. When FCMP++ activates, wallets must re-validate every transaction that used RingCT under the new FCMP++ validation rules to confirm that no coin was double-spent or created illegally. The monero supply total never changes, but the cryptographic burden on every wallet does.

Why Bitcoin does not face the same re-sync requirement

Bitcoin’s privacy is not a consensus-level feature. Bitcoin transactions are pseudonymous—they use addresses without names—but the transactions themselves are transparent. Any observer can see the amount, sender address, receiver address, and timing. Privacy in Bitcoin depends on optional techniques like CoinJoin, PayJoin, or Taproot-based privacy scripts, but these are not enforced by consensus rules.

Because Bitcoin’s core protocol does not need to change its transaction structure to add privacy, Bitcoin can use soft forks. A soft fork is a rule change that only tightens existing rules; old wallets can still recognize valid blocks, even though new wallets enforce stricter requirements. Bitcoin’s segregated witness (SegWit) upgrade in 2017 and the Taproot upgrade in 2021 both used soft forks. Old wallets that did not understand SegWit or Taproot could still sync the blockchain and recognize which blocks were valid.

This is the opposite of Monero’s approach. Because every Monero transaction must use a ring signature and stealth addresses as core consensus requirements, changing the ring signature algorithm requires a hard fork. All wallets must upgrade simultaneously, and all wallets must re-validate the entire blockchain under the new rules. Bitcoin avoided this by keeping privacy optional; Monero prioritized mandatory privacy over soft-fork compatibility.

Phishing and wallet download safety

The requirement to re-sync after hard forks makes wallet security even more critical. A user who downloads counterfeit wallet software that falsely claims to be a post-fork update may fall victim to a phishing attack that steals their recovery seed or private keys. Because the legitimate update is mandatory, scammers have a strong pretext: “New hard fork occurred, please download the updated wallet from this link.”

Legitimate monero wallet download sources are limited. The official Monero website, GitHub repository, F-Droid, Apple App Store, and Google Play Store are the primary trusted channels. Users should verify GPG signatures on downloaded software, check that the domain is correctly spelled, and never download wallets from email links or social media advertisements. A few minutes spent verifying the authenticity of a downloaded wallet is worthwhile because a fake wallet defeat the entire value of Monero’s privacy.

Hardware wallets such as Ledger or Trezor, when used with legitimate wallet software, provide isolation: the device signs transactions but never exposes the seed. Even a compromised monero wallet download on the host computer cannot steal funds if the hardware wallet retains control of the keys. However, hardware wallets also require firmware updates to support consensus rule changes, so the same caution applies.

Re-sync friction and regulatory implications

The periodic re-sync requirement has implications beyond technical inconvenience. The European Union’s Anti-Money Laundering Regulation (AMLR), Article 79, restricts the transfer of privacy coins by regulated service providers as of July 2027. This regulation assumes that privacy coins create compliance challenges. However, one unintended effect is that regulated exchanges delisting Monero create market pressure for users to self-custody.

A user in self-custody must maintain their own wallet software and stay synchronized with the network. The hard fork re-sync requirement means that roughly every six months to a year, that user must download a new wallet version and sit through a lengthy blockchain re-validation. For a user with a large XMR balance stored in cold storage, this creates a periodic obligation to connect the wallet to the network, download updates, and interact with infrastructure in ways that a custodial exchange would have hidden.

This is not necessarily a flaw; it may be an intended feature. The friction encourages users to understand their own systems and discourages negligent key management. However, it does mean that self-custody of Monero carries a different ongoing operational burden than self-custody of Bitcoin, where a wallet can remain offline indefinitely without losing sync status.

Planning for future monero wallet downloads and forks

A user holding monero XMR should establish a regular update schedule. Setting a calendar reminder to check for new wallet releases every three months is prudent, even if no hard fork is announced. The Monero Project maintains a release schedule, and wallet developers publish updates well in advance of fork activation.

For large holdings, testing the update and re-sync process on a small balance first is wise. Download a monero wallet on a test device, load a small amount of XMR, verify that sync completes correctly, and confirm that transactions work. Only then apply the same update to the main wallet or hardware device. This avoids surprises during an actual fork when time may be limited.

Users should also maintain offline backups of their recovery seed in a format they understand. The seed does not change during a hard fork, but the ability to recover funds depends on having the seed recorded safely. If a wallet becomes corrupted or lost, a new wallet can be downloaded and the seed imported to restore access, assuming the new wallet version supports the current consensus rules at the time of recovery.

Frequently asked questions

Why does my Monero wallet need to re-sync after a hard fork while my Bitcoin wallet does not?

Bitcoin uses soft forks for upgrades, which are backward-compatible; old wallets can still recognize valid blocks. Monero uses hard forks because its privacy mechanisms—ring signatures, stealth addresses, and RingCT—are embedded in consensus rules. When these change, every wallet must re-validate the entire blockchain under the new rules. Privacy upgrades require this hard fork approach because they affect how transactions are validated at the protocol level.

How often do Monero hard forks occur, and what does it mean for my monero wallet download?

Monero hard forks typically occur roughly every six months to a year. When a fork is announced, you must download an updated monero wallet download from a trusted source—the official Monero website, GitHub, or established wallets like Cake, Feather, or Monerujo—and re-sync before the fork height. The Monero Project publishes schedules well in advance so users have time to prepare.

If I update my monero wallet after a hard fork, how long does re-synchronization take?

Re-sync time depends on device speed and internet connection. On a fast computer with a local node, re-validation can take minutes. On a mobile device or with a remote node, it may take an hour or more. The process is not optional; the wallet must re-validate every block under the new consensus rules before it can validate transactions or send funds. Plan accordingly and avoid relying on your wallet for immediate transactions during an active fork period.

Hyperliquid Collateral Bridge Delays: Why Depositing USDC During Market Spikes Takes Hours and Costs You Liquidation Protection

A trader on Hyperliquid opens a leveraged position during a volatile market move, anticipating a directional profit. Within minutes, the asset moves against the position by 3 percent. The trader has sufficient collateral in their wallet—USDC sitting on Arbitrum—but the deposit into Hyperliquid has not yet cleared. The bridge transaction, initiated ten minutes ago, is still confirming. By the time the USDC arrives on the exchange, the position has moved 5 percent further. The liquidation price, calculated when the position was opened with lower collateral, is now active. The liquidation mechanism executes, wiping out most of the position before the fresh deposit could increase the account’s margin buffer.

This scenario is not hypothetical. Cross-chain deposit delays on decentralized exchanges create a discrete window of vulnerability that combines three common problems: bridge confirmation latency, volatile market conditions, and the rigid timing of collateral recognition. Understanding why USDC deposits to Hyperliquid take hours rather than minutes during market spikes, and how that exposure maps to liquidation risk, is essential for traders who operate on the edge of their risk tolerance. The platform itself offers tools to model this risk, but the underlying mechanics of cross-chain finance mean that deposits remain a weak point in the risk management chain.

Hyperliquid platform interface showing the on-chain order book, margin modes, and collateral deposit interface during a market volatility event

Why bridge delays are not random: Arbitrum congestion and finality

Hyperliquid operates on its own blockchain (Hyperliquid L1), but traders typically hold USDC on Ethereum, Arbitrum, or other established chains. Moving USDC from Arbitrum to Hyperliquid requires a bridge transaction—a mechanism that locks USDC on the source chain and mints an equivalent amount on the destination. This process has multiple sequential steps, each with its own latency profile. The trader signs the bridge transaction on Arbitrum, which enters the mempool. If Arbitrum is experiencing typical network load, confirmation occurs within seconds. But during market spikes—when many traders are rebalancing, liquidating, or depositing simultaneously—Arbitrum’s block space becomes scarce, and base fees can increase 10-fold or more.

Once the transaction is confirmed on Arbitrum, the bridge validator set or relay mechanism must observe the confirmation, verify its validity, and initiate the minting process on Hyperliquid L1. During periods of high volatility or network congestion elsewhere, that observation and relay step can add 5 to 30 minutes. Some bridge implementations use optimistic assumptions—they assume validity and mint USDC immediately, settling conflicts later. Others use multi-signature validators that require a threshold of independent confirmations. The security trade-off is direct: faster bridges assume more risk; slower bridges delay collateral availability. Neither approach eliminates the deposit window, which is precisely when traders most need margin buffer.

The practical consequence is that a trader cannot rely on “I will deposit USDC if the trade moves against me” as a risk management strategy. By the time USDC is recognized as collateral on Hyperliquid, the position may have already breached the liquidation threshold. This is why understanding bridge mechanics matters more than trusting that a deposit will arrive “quickly enough.” A trader should assume that any deposit initiated during a market spike will not contribute to liquidation protection until at least 10 to 30 minutes have passed, depending on source chain congestion and bridge design.

How liquidation mechanics interact with delayed collateral

On Hyperliquid, liquidation thresholds are calculated in real-time based on current collateral balance, open positions, and margin mode. The platform supports cross margin (shared collateral across all positions), isolated margin (collateral segregated per position), and strict isolated margin (no cross-position liquidation). When a position is opened, the system locks a portion of collateral as maintenance margin. If the position’s unrealized loss grows such that available collateral falls below the maintenance requirement, the liquidation mechanism activates.

A trader who opens a 10x leveraged long position with $1,000 USDC collateral is committing to handle a 10 percent adverse move with zero buffer. The liquidation price is typically set around 8 percent loss, leaving a 2 percent liquidation buffer. If the market moves 9 percent against the position, liquidation begins. The platform’s liquidation system includes partial liquidations, meaning not the entire position is closed at once. Instead, the liquidation engine reduces the position size until maintenance margin is restored. This is less catastrophic than total liquidation, but it is still a loss crystallized at the worst possible time.

The critical timing issue arises when a trader anticipates a market move and opens a leveraged position, then sees the move materialize but in the wrong direction. The instinct is to deposit more collateral to increase the margin buffer. But if that deposit is still in transit across the Arbitrum bridge, the liquidation calculation does not account for it. The position is evaluated against the old, lower collateral balance. A deposit initiated at that moment will not arrive for 15 to 45 minutes. In fast-moving markets, that is too long. The market can move an additional 5 to 10 percent in that time, triggering liquidation before the fresh collateral is ever recognized.

Users can employ a hyperliquid liquidation price estimator or fee calculator to model their specific positions, but the calculator output assumes collateral is already in the account. It does not account for the time cost of deposits. A trader using such a tool should add an implicit buffer—assume that any collateral not already deposited will arrive too late to matter. This reframes the risk: the real liquidation threshold is not what the calculator shows, but what the calculator shows minus the buffer that a deposit could have provided.

Cross-chain deposit options and their latency profiles

Hyperliquid accepts USDC deposits from Arbitrum, Ethereum, Base, Optimism, and other chains. Each has different confirmation times, bridge validators, and fee structures. Arbitrum is popular because its fees are low and confirmation is typically fast—15 to 30 seconds under normal conditions. But during market spikes, Arbitrum fees surge and confirmation can exceed 2 minutes. Ethereum mainnet has slower confirmation (12 to 15 seconds per block, thus 2 to 3 minutes for finality by typical standards) and much higher per-transaction cost. Base and Optimism are faster but have less total liquidity, so deposit routes may have slippage or routing delays.

The bridge itself introduces another layer. If a trader bridges USDC from Arbitrum to Hyperliquid L1 using the canonical Arbitrum bridge, the process is: (1) lock USDC on Arbitrum, (2) wait for Arbitrum finality, (3) relay the lock to Hyperliquid L1, (4) mint USDC on Hyperliquid L1. That relay step can be batched, meaning a relay does not occur for every transaction. During low-volume periods, a relay might batch once per 5 to 10 minutes. During high-volume periods, relays occur more frequently but validators may be overloaded. A trader depositing $100 of USDC expects a 5-minute wait; the actual wait could be 2 minutes or 30 minutes depending on when the relay batch fires.

Third-party liquidity bridges (such as Across or Stargate) offer alternative paths. They prioritize speed by using their own liquidity pools on both chains and settling the transaction immediately on the destination, then settling back on the source chain after finality. This can reduce total time to 3 to 5 minutes. But these services also charge fees—typically 0.1 to 0.3 percent of the bridge amount—and the route is opaque to the user. A trader depositing $10,000 USDC via a third-party bridge might pay $10 to $30 for faster availability, a trade-off that is worth evaluating if the alternative is liquidation.

Real-world liquidation scenario: A case study in timing

Consider a concrete example. A trader holds $5,000 USDC on Arbitrum and $2,000 USDC already on Hyperliquid. Bitcoin is at $42,000. The trader believes Bitcoin will move up and opens a 5x long position with the $2,000 on-chain collateral, buying 0.238 BTC at $42,000. This position requires approximately $1,900 of the $2,000 as initial margin, leaving $100 of available collateral. The liquidation price, calculated by the platform’s mechanics, is around $40,000—a $2,000 unrealized loss from entry.

Thirty seconds after opening the position, Bitcoin drops to $41,500 due to a flash sell. The position is down $119, consuming $119 of the $100 available collateral. The position is now in danger. The trader, seeing this move, immediately initiates a $5,000 USDC deposit from Arbitrum. The bridge transaction is submitted at timestamp T=0. Arbitrum confirms it at T=45 seconds. The relay to Hyperliquid L1 is batched and fires at T=12 minutes. The USDC mints on Hyperliquid L1 at T=12:15.

But during the 12-minute wait, Bitcoin has continued down to $40,800 because a sell order from a large fund was anticipated and traders are front-running it. The position is now down $2,850, far exceeding the available collateral. The liquidation mechanism fires at T=8:30, before the deposit arrives. The position is partially liquidated, selling 0.12 BTC to restore maintenance margin. By the time the $5,000 deposit arrives at T=12:15, the position is half the size it was intended to be. The trader has paid the cost of liquidation—both the slippage on the forced closure and the psychological impact of a half-closed position.

This scenario highlights why regulatory bodies including the CFTC have raised concerns about leverage and liquidation in cryptocurrency derivatives. The mechanics are sound, but the operational risk—timing, network congestion, and the inability to deposit collateral fast enough—introduces a failure mode that is not purely about trader error.

Smart contract vulnerabilities and bridge security

A separate but related risk is smart contract vulnerability in the bridge mechanism itself. If a bridge has a bug—a vulnerability that allows double-spending, theft of collateral, or incorrect minting—deposits could be lost entirely. Hyperliquid L1 is a custom blockchain, not an EVM clone, which reduces some attack surfaces but creates others. The bridge contracts that connect Arbitrum to Hyperliquid L1 are a critical component of the system.

According to Ethereum Foundation standards for smart contract security, bridges should use multiple layers of validation, time-locked governance, and extensive auditing. Hyperliquid has undergone third-party audits, and the platform is transparent about its architecture. However, no smart contract is perfectly secure. A trader who deposits large amounts should be aware that the bridge mechanism itself carries smart contract risk. This is separate from market risk and liquidation risk, but it is a real component of total deposit risk.

Bridge security is also a concern from a regulatory perspective. The European Securities and Markets Authority has published guidance on cryptocurrency derivatives, noting that custody and settlement infrastructure must meet stringent security standards. Non-custodial solutions like Hyperliquid reduce counterparty risk compared to centralized exchanges, but they introduce bridge and smart contract risks that must be independently managed.

Contingency planning: How to reduce deposit-window vulnerability

Experienced traders on Hyperliquid use several tactics to mitigate deposit delay risk. The first is to maintain a standing balance on Hyperliquid L1 rather than bridge deposits on-demand. If a trader plans to trade perpetuals with $20,000 total capital, depositing $25,000 upfront costs a one-time bridge fee but eliminates the timing vulnerability for the next 100 trades. The cost is the opportunity cost of capital not deployed elsewhere, but for active traders, this is often worth it.

The second is to use smaller position sizes during volatile periods or when on-chain collateral is low. If a trader only has $100 of available collateral on Hyperliquid and the market is moving 5 percent in 10 minutes, opening a 5x position is gambling with liquidation. Opening a 1x position (no leverage) or waiting until additional collateral has been deposited and confirmed removes the time pressure.

The third is to use isolated margin mode rather than cross margin. In isolated margin, each position is evaluated independently, and liquidation on one position does not affect others. This prevents a catastrophic cascade where a loss on one position drains collateral shared across multiple positions. Strict isolated margin goes further, allowing only one open position at a time. For traders who are learning or who are operating with tight collateral, this mode prevents over-leveraging.

The fourth is to use the Bank for International Settlements framework for personal risk tolerance as a guide. The BIS publishes research on financial stability and crypto derivatives, noting that leverage amplifies both profits and losses. A trader should define a maximum acceptable loss per trade and position size accordingly. If the maximum acceptable loss is $500 and the trader is using 5x leverage, a $100 position size is the appropriate threshold, not a $10,000 position size. This discipline, enforced before opening positions, eliminates the temptation to deposit more collateral frantically mid-trade.

Operational risk and the full picture

The deposit delay problem is one facet of operational risk on decentralized exchanges. It is not a flaw in Hyperliquid’s design—it is an inherent property of cross-chain finance. Every decentralized exchange that accepts deposits from multiple chains faces the same latency profile. The issue is that traders often underestimate this operational risk compared to pure market risk.

A trader who carefully calculates position size, monitors funding rates, and diversifies across multiple assets is still vulnerable to liquidation if deposits take 15 minutes to arrive during a spike. This is why professional traders on derivatives platforms maintain conservative on-chain collateral buffers and use staged position sizing. An amateur trader who tries to optimize for speed—moving capital on-demand across chains—is accepting a hidden cost: the cost of liquidation during bridge delays.

Regulatory bodies, including the Financial Conduct Authority, have recommended that retail traders using leveraged derivatives avoid positions where liquidation can occur due to operational failures rather than market moves. Deposit delays are not operational failures in the traditional sense, but they are operational risks that traders should price into their risk models.

The platform offers tools such as fee calculators and liquidation price estimators to help traders understand their positions. These are valuable, but they should be supplemented with operational assumptions: assume deposits take at least 15 minutes, assume market volatility will continue during that window, and assume that any collateral not already on-chain will not help you avoid liquidation. This mindset shifts risk management from reactive (deposit more if you are losing) to proactive (maintain sufficient on-chain collateral before you start trading).

Frequently asked questions

How long does a USDC deposit to Hyperliquid typically take from Arbitrum?

Under normal conditions, a USDC bridge from Arbitrum to Hyperliquid takes 5 to 15 minutes. During market spikes or network congestion, this can extend to 30 to 45 minutes. The delay includes Arbitrum confirmation, bridge relay batching, and minting on Hyperliquid L1. During high-volatility periods, this latency is critical because positions can move into liquidation territory before collateral arrives.

Can I avoid liquidation by depositing more USDC during a losing trade?

Not reliably. If your position is already approaching liquidation price and you initiate a deposit, the deposit may not arrive before liquidation triggers. A liquidation calculator can estimate your liquidation price, but it assumes all collateral shown in your account is already available. In practice, you should maintain sufficient on-chain collateral before opening leveraged positions rather than relying on deposits as a rescue mechanism during trades.

Which margin mode on Hyperliquid protects me best from liquidation cascades?

Strict isolated margin isolates each position, meaning liquidation on one position does not affect others or drain shared collateral. This prevents the scenario where a loss on one trade wipes out collateral needed for another trade. Isolated margin offers a middle ground, segregating collateral per position but still allowing multiple positions simultaneously. Cross margin is most capital-efficient but exposes all collateral to cascade risk if one position is liquidated.