Hyperliquid

Documented and closed events. They stay on file: an operator’s past is data, not a verdict.

1. Nov 13, 2025 Hack / funds theft Moderate $5M ✓ resolved

   A trader burns 3 million dollars of their own to inflict about 4.9 million of losses on the HLP vault: a fake buy wall on POPCAT, cancelled all at once, cascading liquidations absorbed by the depositors' pool. Bridge withdrawals paused for about an hour with the emergency lock, with no official explanation

   On 13 November 2025 a trader burned about 3 million dollars of their own capital in order to inflict a loss of roughly 4.9 million on Hyperliquid's HLP vault, the shared pool where depositors put USDC. According to Cointelegraph's reconstruction, also reported by The Defiant, they withdrew 3 million USDC from OKX, split it across nineteen wallets and opened more than 26 million dollars of leveraged long positions on the POPCAT token; they then built a buy wall of about 20 million around 0.21 dollars, giving the appearance of solid price support, and cancelled it. With the support gone, dozens of over-leveraged positions were force-liquidated and the HLP vault absorbed them. The attacker's capital was wiped out: unlike classic manipulation there was no profit to collect here, and analysts read it as an attack aimed at the protocol's structure rather than at anyone's wallet. During the episode the platform paused bridge withdrawal processing for about an hour using its emergency lock function, then resumed. No official statement was published linking that pause to the POPCAT case: the fact is reported by the trade press, the explanation is not. No code exploit, no compromised keys, no funds stolen from individual users: the loss fell on the shared pool, that is on HLP depositors in proportion to their share. It is the same pattern as March 2025, with one detail that makes it more uncomfortable: here the attacker accepted losing everything in order to do it.

   ↗ source
2. Mar 26, 2025 Hack / funds theft Moderate ✓ resolved

   Manipulation of the JELLY token: a short position built to be liquidated is dumped onto the HLP vault, the depositors' shared pool, which reaches about 12 million dollars of unrealised loss. Validators vote to delist and settle positions at a price they set; the Hyper Foundation reimburses every user apart from flagged addresses. Two weeks earlier the same mechanism had cost the vault 4 million

   On 26 March 2025 Hyperliquid's HLP vault — the shared pool where users deposit USDC and which acts as the platform's automatic counterparty to liquidations — found itself carrying an unrealised loss of about 12 million dollars on a position it had not chosen. HOW IT WAS BUILT. According to reconstructions by The Block, Cointelegraph and the analytics firm Arkham, a trader used three accounts: deposited about 7 million dollars within minutes, opened two long positions (roughly 2.15 and 1.9 million) and one short of about 4.1 million on the JELLY token (JELLYJELLY), then pulled the margin out of the short. Left uncovered, that position was liquidated and — by the platform's design — was transferred to the HLP vault. The price of JELLY was then pushed up across several markets, rising roughly three-hundredfold in twenty minutes: every tick up was a loss for the vault, which was short and could not close because there was nobody on the other side. HOW IT ENDED, AND WHY THAT IS THE POINT. With the loss around 12 million, the network's validator set voted to remove JELLY perpetual futures «on evidence of suspicious market activity», settling all positions at a set price of 0.037555 dollars — that is, close to the price at which the attacker had gone short, not the market price at the time. For the vault the outcome flipped from a 12 million loss to a profit of about 700,000 USDC over 24 hours. Hyperliquid announced that «all users apart from flagged addresses will be made whole from the Hyper Foundation», automatically and based on on-chain data: JELLY longs were refunded as though their positions had closed at 0.037555. The attacker, per the same reconstructions, had already withdrawn about 6.26 million of the 7.17 million deposited before their withdrawals were frozen. NO USER WAS LEFT OUT OF POCKET, AND YET THIS IS WORTH KNOWING. There was no code exploit, no stolen keys, no bridge breach: the platform worked as written, and precisely because of that a trader was able to dump a toxic position onto the pool that holds depositors' money. What averted the loss was not an automatic mechanism but a human decision taken within minutes by a small validator set, which delisted a market and picked the settlement price. The debate that followed about how decentralised the platform really is starts here, and the company acknowledged it by changing the rules: tighter caps on the liquidator vault, a new open-interest cap formula, and an on-chain vote for delisting assets below certain thresholds. IT WAS NOT THE FIRST EPISODE OF ITS KIND, TWO WEEKS EARLIER. On 12 March 2025 a trader had deposited 15.23 million USDC and opened a long ETH position of 160,234 ETH (about 306.85 million dollars), then withdrew part of the margin so as to be liquidated: the HLP vault absorbed about 4 million dollars of loss (roughly 1% of the 451 million deposited) and the trader walked away with 1.86 million in profit. Hyperliquid stated that «there had been no exploit or hack» and that its liquidation engine «simply could not handle the size of the position», then cut maximum leverage to 40x on bitcoin and 25x on ethereum. Two episodes in fifteen days, both on the same weak point: a forced liquidation handed to the shared pool. AMOUNT LEFT UNQUANTIFIED, AND THAT IS A CHOICE. The maximum exposed loss was about 12 million dollars, but it never became final: after the delisting and the forced settlement the vault closed the 24 hours in profit. Writing 12 million would state a loss that did not happen; writing zero would erase the risk the depositors' pool actually ran. The field is therefore left empty, and the range is told here.

   ↗ source

verified on Sep 30, 2026