Comer's KYC Probe Hits Crypto.com, Hyperliquid and PredictIt: 3 Platforms, 1 Question

Can a DEX stay permissionless if Washington decides it can't? That's the question House Oversight Chair James Comer dropped on the table September 29, 2026, when his committee opened a probe into Crypto.com, Hyperliquid and PredictIt over identity checks and suspicious trades.

Three platforms. Three architectures. One very uncomfortable common thread.

What the Filing Actually Says

The Oversight Committee's document request went out to all three on the same day. The framing is identity verification and how each platform handles trades that trip suspicion flags. That's it. No criminal referral. No enforcement action. A records request, which is how these things always start.

The target list tells you more than the language does. Crypto.com is a centralized exchange with a real compliance department, roughly 100 million registered users by its own count, and a KYC stack that already answers to multiple regulators. PredictIt is a CFTC-regulated prediction market and has been for over a decade. Hyperliquid is neither. It runs a perpetual futures order book fully on-chain, with no account layer, and daily volume that has swung between $1 billion and well north of $5 billion depending on the week.

So the committee picked one easy target, one legacy target, and one target that doesn't fit any existing category.

Here's the relevant code. Or rather, here's the code that isn't there. A centralized exchange stores a row in a database: user ID, document hash, jurisdiction, risk score. Hyperliquid stores a public key and a position. That's the entire identity surface. No name on file. No passport scan. You can't produce documents you never collected.

Why This Probe Is Really About Jurisdiction

Congress can't regulate what it can't name. That's the whole game.

For two years the SEC and the CFTC have been circling each other over which agency gets to define a DEX, and neither has landed a definition that survives contact with an actual order book. Comer's committee sits above both agencies. A document request is the cheapest possible way to force the industry to describe itself in writing, on the record, under penalty of a false statements charge.

Think about what a Hyperliquid response has to look like. Either the team says it has no users and no practical way to identify them, which invites the argument that it can't be compliant with anything. Or it says it does have a way, which guts the permissionless pitch the product was built on.

There's no third door. That's the point.

And the PredictIt inclusion is the tell. PredictIt has been regulated since 2014. Its position cap sits at $850 per contract. It isn't a frontier market. If the committee wanted the frontier, Crypto.com and Hyperliquid would have been enough. Adding PredictIt signals the scope is the entire category of event and prediction markets, not just the offshore ones.

What Traders and Builders Are Watching

Volume is the first tell. Perp markets are mercenary. If Hyperliquid's open interest drops more than 15% in the two weeks after the request becomes public, that's desks hedging regulatory risk, not price risk.

The second tell is wallet screening. Watch for a third-party attestation provider to announce a DEX integration inside the next quarter. That's the compromise everyone eventually lands on. Nobody stores identity. A vendor issues a signed credential. The contract checks the signature. It's clever engineering. It's also a privacy downgrade dressed up as neutrality.

The third tell, and the one I'd bet on, is a subpoena. Document requests get ignored all the time. Subpoenas don't.

According to people who've sat through Oversight depositions, the committee rarely opens with its actual target. It opens with whoever has the cleanest paper trail and works outward from there. Crypto.com has the cleanest trail. PredictIt has the safest legal footing. Hyperliquid has the most to lose.

So who wins? Compliance vendors, mostly. Then law firms. Same as every cycle before this one.

Who loses? The users who chose a DEX specifically because nobody was asking for their passport. That choice gets narrower every quarter.

What's Next

Watch for responses by mid-October 2026. Committees typically give targets two to three weeks to produce documents before they escalate, and escalation here means subpoenas plus a public hearing.

If a hearing lands, the date matters more than the testimony. Hearings before an election are theater. Hearings after are legislation. This one falls on the post-election side, so there's a real chance a draft bill follows within six months.

That bill, if it exists, will almost certainly define a covered digital asset business by function rather than corporate form. Which is a lawyer's way of saying if it looks like an exchange, it gets treated like one.

For builders, the practical takeaway is simple. Wire your gating hooks now, even if you don't call them KYC. An allowlist module, a credential check, a geofence at the RPC layer. Deploy it to testnet, run it against a mock credential issuer, and see what breaks before someone makes you do it on mainnet at 2am.

The other thing to watch: whether the CFTC or the SEC files anything alongside this. Parallel tracks mean the committee found something in the documents. A quiet committee means it didn't.

Read the source. The docs are lying, and this time the paper trail is the story.