Hyperliquid, a platform that prides itself on being a decentralized exchange (DEX), recently encountered a major security crisis. This incident not only shocked the cryptocurrency community but also thrust the core question of whether DEXs are truly "decentralized" into the forefront of discussion. It is reported that this attack led to the loss of a massive amount of funds, causing severe damage to Hyperliquid's user trust and market reputation. Heated discussions surged on Twitter like a tide, with sharply opposing viewpoints: some questioned Hyperliquid's response measures, accusing its so-called "decentralization" of being mere empty talk, exposing traces of centralized control; others defended it, arguing that the platform's emergency response was necessary to protect user assets and system integrity, a required action amid the crisis. This divergence reflects the community's deep concern about the gap between the ideal and reality of DEXs.
The Process of Hyperliquid's First Attack
The attacker initially bought a large amount of Ethereum (ETH). This action, due to their past successful trades, triggered FOMO in the market, driving other investors to follow suit or close their positions, further pushing up the price of ETH. During this process, they used trading profits to continuously increase their position while withdrawing floating profits to reduce margin requirements, forming an efficient leverage cycle. For example, by using the held ETH as collateral to borrow the stablecoin USDT, and then using the borrowed USDT to buy more ETH, thereby further driving up the market price of ETH. As the price of ETH rose, they could borrow more USDT and repeat this cycle. The key to this strategy was that the floating profits withdrawn exceeded the initial margin deposited, thus constituting the core of their earnings model. According to statistics, the attacker invested a total of $15 million in margin and ultimately withdrew $17 million, achieving a net profit of $2 million. However, after withdrawing sufficient profits, their massive ETH position was liquidated due to market fluctuations leading to insufficient margin, and this position was taken over and liquidated by Hyperliquid's market-making fund. According to position data, this attack caused the HLP to lose nearly $4 million.
This attack on the Hyperliquid platform exposed significant flaws in its risk management system. The attacker exploited the high leverage mechanism allowed by the platform, using relatively small margins to open large-scale trading positions, thereby significantly amplifying potential market risks and the platform's own risk exposure. Specifically, high leverage trading allows attackers to control massive asset sizes with limited capital, a strategy that can yield excess returns when the market fluctuates favorably but also highly concentrates risks. Once the market moves against the attacker's position, the high leverage characteristic rapidly amplifies losses, potentially leading to the accumulation of huge bad debts, thus posing a serious threat to the safety of the platform and its users' funds. To address this vulnerability and enhance the platform's risk resilience, Hyperliquid quickly implemented a series of improvement measures. The most central of these is the introduction of a tiered margin system, which dynamically adjusts the required margin ratio based on the size or risk level of the trading position, aiming to effectively curb traders' excessive use of leverage. For larger or higher-risk positions, the platform requires higher margin ratios to ensure sufficient capital buffers to withstand potential losses from market fluctuations. Additionally, Hyperliquid imposed strict limits on the maximum leverage multiple, further reducing the possibility of traders engaging in high-risk operations through high leverage.
Hyperliquid Attacked Again
On March 26, 2025, Hyperliquid encountered a meticulously planned and highly premeditated attack. The attacker targeted a Memecoin asset with severely insufficient liquidity and extreme price volatility—$Jellyjelly (hereinafter referred to as $JELLY). Due to the asset's extremely shallow market depth, large trades could easily trigger significant price fluctuations, providing a natural convenience for market manipulation. By designing a complex trading strategy and combining it with a profound understanding of the platform's liquidation mechanism, the attacker successfully exploited vulnerabilities in the market microstructure to achieve profits.
The attack began with the address 0xde9...f5c91 opening a $4.08 million short position on $JELLY on the Hyperliquid platform at an opening price of $0.0095, providing 3.5 million USDC as margin. The establishment of the short position meant that the attacker expected the price of $JELLY to fall, and if the market moved as anticipated, they could profit from the price difference. However, the attacker's core intention was not mere speculation but to manipulate the market price through coordinated operations and trigger the platform's liquidation mechanism. After establishing the short position, the attacker used another address, Hc8gN...WRcwq, to sell a large amount of $JELLY in the spot market. Due to $JELLY's insufficient liquidity, the large sell order rapidly depressed the market price, causing the attacker's short position to show floating profits. As book profits increased, the attacker then withdrew 2.76 million USDC from the short position's margin. This operation significantly reduced the margin ratio of the position, causing it to be taken over by the liquidation fund.
However, in a market with extremely poor liquidity like $JELLY, liquidating a large position at market price would generate huge impact costs. Due to insufficient market depth, the liquidation action itself could further depress the price, leading to an actual liquidation price far below expectations, thus causing significant losses for the platform. To avoid this risk, HLP did not immediately execute a market liquidation but chose to temporarily take over the position, hoping to handle it when market conditions improved.
The attacker fully exploited this decision delay by HLP, quickly switching to the opposite operation, namely buying a large amount of $JELLY in the spot market. This action pushed the price of $JELLY back up rapidly, causing the short position taken over by HLP to incur floating losses. As the price rose, HLP's losses further increased, while the attacker locked in profits through spot market purchases, simultaneously transferring greater loss risks to the platform.
If the price of $JELLY did not fall, or even maintained stability or an upward trend, HLP's retail investors might tend to withdraw their funds. This is because, under such market conditions, investors might believe that continuing to hold positions would not bring higher capital gains, or out of concern for potential market risks, they might choose to reduce risk exposure. As the scale of withdrawals expands, HLP's capital pool—namely the fund reserves used to support trading activities and position management—would gradually shrink. This reduction in the capital pool directly leads to a decline in the liquidation price (i.e., the asset price threshold that triggers forced liquidation). A lower liquidation price means existing positions are more likely to hit the liquidation line, increasing the difficulty for the platform to maintain position stability. This phenomenon can be regarded as a profit-seeking game: investors who withdraw early can lock in gains and avoid risks, while those who withdraw late may face greater loss risks, as their positions are more likely to be forcibly liquidated after the liquidation price drops. Furthermore, the withdrawal behavior of a large number of investors may trigger a run effect, forming a positive feedback loop. Declining investor confidence in the platform leads to accelerated capital outflows, and the depletion of the capital pool, in turn, exacerbates liquidation risks, ultimately potentially plunging HLP into a liquidity crisis.
Hyperliquid's Response Strategy
After suffering the attacks, Hyperliquid's response strategy displayed a certain degree of bias and controversy, and its decision-making process and execution methods warrant in-depth analysis from an academic perspective. Hyperliquid officials took extreme measures, directly delisting the $JELLYJELLY asset and manipulating the oracle to liquidate the attacker's short position at a price significantly below the normal market price. This move not only avoided losses but brought the platform a profit of up to $703,000. Although the official statement claimed that this series of actions was based on a committee vote, this explanation failed to quell widespread doubts from the community and market participants, instead further intensifying the controversy. From an academic risk management perspective, Hyperliquid's strategy presents multiple issues: its direct intervention in market mechanisms deviates from the transparency and autonomy principles advocated by decentralized finance (DeFi), potentially damaging the platform's credibility and producing negative spillover effects on the trading ecosystem of other assets. Additionally, manipulating the oracle to liquidate short positions at favorable prices, while achieving short-term economic benefits, is suspected of market manipulation, violating the basic ethics of fair trading, and causing profound negative impacts on the platform's long-term reputation and user trust. Hyperliquid attempted to legitimize its actions by citing a collective decision through a committee vote, but this explanation failed to fully clarify the rationality and compliance of the decision, instead exposing potential flaws in the platform's governance mechanism. In the DeFi ecosystem, the transparency and fairness of governance decisions are the core of maintaining community trust, and this incident failed to demonstrate the openness and accountability of the decision-making process, potentially further weakening the platform's community support and market competitiveness. In summary, Hyperliquid's strategy choice in responding to this attack not only failed to effectively mitigate risks but also, through controversial means, gained short-term benefits at the expense of its long-term development prospects and ecological trust.
Conclusion
The two attack incidents experienced by the Hyperliquid platform not only exposed significant flaws in its risk management system and governance mechanism but also profoundly revealed the severe challenges faced by current decentralized exchanges (DEXs) in pursuing true "decentralization." In the first attack, the attacker exploited the high leverage mechanism, manipulating the price of Ethereum through a cyclic leverage strategy, extracting $2 million in profits from the platform, while Hyperliquid's market-making fund lost nearly $4 million as a result, highlighting the platform's vulnerabilities in high-leverage trading and low-liquidity asset management. The second attack was more complex, with the attacker targeting the extremely illiquid Memecoin $JELLY, successfully transferring losses to the platform through a combination of short positions and spot market operations, while profiting from the delayed liquidation mechanism, further exposing the platform's deficiencies in market microstructure and risk response. Hyperliquid's response measures—such as directly delisting the asset and manipulating the oracle to liquidate positions at low prices—resulted in its centralized intervention characteristics sparking strong community doubts about the platform's transparency and autonomy, running counter to the core principles of DeFi. These incidents not only demonstrate the fragility of DEXs in preventing market manipulation, handling low-liquidity assets, and maintaining user trust but also sound an alarm for the entire DeFi ecosystem: technical innovation and the improvement of governance mechanisms must be equally emphasized. Hyperliquid's experience is a warning, and the problems it exposes prompt the industry to re-examine risk management frameworks and governance structures to achieve the ideal of true decentralization, providing valuable lessons for the long-term stability and sustainable development of DEXs.
