The covert battle escalates: Hyperliquid suffers a "suicidal" attack, but the real war may have just begun

Author: The Smart Ape

Translation: AididiaoJP, Foresight News

The crypto industry always talks about "code is law," "trust math, not people," "open source + decentralization," and so on...

All true—but the past few weeks have once again shown just how fragile our current model still is.

Even @HyperliquidX, currently one of the most advanced decentralized perpetual exchanges, has just suffered a major attack.

An attacker blew up $3 million of their own funds just to make the protocol’s HLP treasury lose $5 million—nearly twice the amount they liquidated.

On the surface, this looks like a "suicidal" attack—no profit, only destruction.

But in a world where Hyperliquid has hurt many competitors (including large institutional platforms), the idea that someone could pay $3 million to make HL lose $5 million is terrifying.

If this attack vector remains open, nothing will stop larger players from scaling it up.

How the Attack Was Executed

First, the attacker withdrew $3 million in USDC from @okx, distributed it across 19 new wallets, then sent all funds to Hyperliquid.

Then, they established a massive leveraged long position in the HYPE / POPCAT perpetual market. Using the $3 million as margin with 5x leverage, they ultimately controlled a $26 million position.

So far, everything seems normal—but the game-changer was placing a $20 million buy order near $0.21 while the price was around $0.22. This created the illusion of strong support—"Look, there's a huge buyer here; price likely won't drop below." Seeing this, other traders assumed significant capital was supporting the price and also went long. As a result, more people leveraged long positions or failed to hedge properly, feeling protected by that "wall."

But this wasn't real support—it was a trap.

Once enough traders had committed to the long side, the attacker canceled that fake buy wall, leaving liquidity extremely thin with no real support below.

Price then began to fall, leveraged traders started getting liquidated, triggering further selling, which triggered more liquidations. It was a classic liquidation cascade—but artificially engineered.

By the end of this cascade, many traders were wiped out, but due to how the system operates, the protocol's treasury ultimately absorbed a $4.9 million loss.

On-chain, the attacker’s own $3 million margin position appears completely destroyed.

On paper:

• Attacker: - $3 million

• HLP Treasury: - $5 million

This appears to be a "suicidal" attack.

What Is HLP, and Why Did It Bear the Loss?

You can think of HLP as a large shared treasury, primarily holding USDC, serving as the ultimate counterparty for all traders on Hyperliquid.

Users deposit USDC into HLP. In return, they:

• Provide liquidity to the system

• Bear risk

• Earn fees/returns when traders lose or pay funding rates

In extreme simplification:

• If traders lose money, HLP profits (treasury grows).

• If traders profit, HLP pays out (treasury shrinks).

It's like a massive automated market maker combined with an insurance fund.

Therefore, if a market (e.g., POPCAT/HYPE) crashes, the global HLP takes the hit. Overall, HLP has been highly profitable and has consistently earned over time. To date, it has generated $118 million in net profit. Compared to its accumulated earnings since inception, this $5 million attack seems insignificant.

The main question is: why did HLP absorb a $5 million loss here?

In a smooth, normal market, traders are liquidated before full bankruptcy—their losses cover payouts to winners, keeping the system roughly balanced.

But during such a sharp drop:

• Price moves too fast

• Liquidity vanishes when it's needed most

• Some positions are difficult or impossible to close at fair prices

• Slippage can become enormous

• Liquidation proceeds may fail to fully cover obligations

The difference between what losing parties should have paid and what the system actually collects on-chain ends up being borne by the HLP treasury.

And this is precisely the part that’s frightening from a protocol risk perspective.

Did the Attacker Really Lose $3 Million?

I don’t believe the attacker lost $3 million. They almost certainly hedged elsewhere (centralized exchanges, options, other perpetuals, even OTC deals).

For example, they might have:

Established offsetting positions on another exchange (shorting POPCAT / related risks)

Constructed neutral trades profiting when Hyperliquid markets become imbalanced

Used OTC agreements with counterparties who benefit from Hyperliquid’s impairment

We have no public evidence of such hedges.

But from a game theory and capital efficiency standpoint, this explanation makes far more sense.

In that case, the attacker’s actual P&L ≈ 0 or even positive, while Hyperliquid’s HLP treasury alone bears a clear $5 million loss.

Testing the Theory

This could have been a test attack. For well-funded players, this was a "small-scale" operation—just large enough to observe the system’s response, HLP movements, team reaction speed, the actual depth of the treasury, and whether emergency controls like bridge locks truly work.

When you think like a professional attacker or well-capitalized competitor, $3 million isn’t necessarily a loss—it could be an R&D budget. A way to prepare for larger, more coordinated, better-hedged actions designed not just to drain funds but to damage core trust.

How Can Hyperliquid Defend Against Such Attacks?

First, they could limit the risk exposure any single entity can build—even across multiple wallets (using heuristics: funding patterns, timing, IP, behavior). They could also impose stricter margin requirements when order book imbalance becomes severe. Globally, this would make it much more expensive to establish massive directional positions capable of wiping out HLP in one move.

To enhance market security, they could implement per-market circuit breakers and volatility safeguards that slow down trading when prices move too fast under low liquidity and high open interest.

Low-liquidity assets could follow stricter rules, preventing individual participants from manipulating markets so easily. The idea is that when someone attempts a suicidal attack, the system switches to defense mode before HLP absorbs the damage.

HLP itself could evolve from mostly passive counterparty to a smarter, partially hedged book. This might include automatically hedging extreme exposures on external venues, capping risk per asset, or even splitting the treasury into a conservative core and smaller optional high-volatility segments. This would make HLP a harder target to attack.

Finally, better detection of spoofing orders and fake bid walls would help prevent the system from relying on misleading liquidity signals. By integrating this into mark price and risk engines, a single deceptive order wall would no longer distort risk assessment.