Sign in

Hyperliquid

avoid.net/hyperliquid38/100·95% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]
38/100
[WARNING]95% conf.

Summary

Hyperliquid suffered a documented ecosystem incident with reported losses of $37K on Arbitrum. This page tracks DeFiLlama's record of the event.

Have evidence about Hyperliquid?

No evidence submitted yet — be the first.

On-chain audit

Editorial decisions, corrections, and updates are anchored on Solana.

Validator Centralization Risks

Hyperliquid operates with only four validators securing billions of dollars in assets, creating significant centralization concerns. Security expert Taylor Monahan highlighted that this small validator pool creates a single point of failure, where if an executive's device were compromised, it could open the floodgates to dire consequences. A compromise involving three of the four validators could allow malicious actors to gain control over the network, approve unauthorized transactions, and drain liquidity pools. This centralized decision-making structure makes it easier for attackers to compromise network security, despite the platform's claims of decentralization.

North Korean Hacker Activity

In December 2024, Hyperliquid faced scrutiny after wallet addresses linked to North Korea's Lazarus Group conducted large transactions on the platform, moving Ethereum (ETH) around in a way that raised concerns. Security expert Taylor Monahan alleged that wallets associated with the DPRK were trading Ethereum on Hyperliquid, claiming these were not standard transactions but potential vulnerability tests, asserting 'DPRK doesn't trade. DPRK tests'. The allegations triggered over $256 million in fund withdrawals from the platform in just 30 hours, with December 23 alone witnessing net outflows exceeding $502 million. Hyperliquid Labs responded by denying any security breach, stating 'There has been no DPRK exploit—or any exploit for that matter—of Hyperliquid. All user funds are accounted for'.

JELLY Market Manipulation Incident

In March 2025, Hyperliquid faced a major market manipulation incident involving the JELLY token that exposed critical vulnerabilities. An attacker opened two long positions and a short position on the JellyJelly token worth $4.1 million, then pumped the token's price across multiple exchanges, causing its value to increase by over 400% within a single hour. This manipulation temporarily caused the Hyperliquidity Provider (HLP) vault's unrealized loss to reach $13.5 million. When losses reached $12 million, the protocol's validators rapidly took action to delist the JELLY token, settling all positions at $0.0095 rather than the $0.50 market price, revealing the platform's centralized control despite decentralization claims. The attacker was able to withdraw $6.26 million of the $7.17 million deposited before the protocol froze their withdrawals.

Additional Security Incidents

Beyond the JELLY incident, Hyperliquid has experienced multiple security issues throughout 2025. The platform received a C- risk grade due to multiple security incidents including the $13.5M JELLY exploit, a $21M private key compromise, and several vault exploits, revealing persistent security vulnerabilities. The Hyperliquid ecosystem also faced controversy when HyperVault, a project built on the platform, was accused of rug-pulling users for approximately $3.6 million, with suspicious transactions flagged by blockchain security firm PeckShield showing funds being bridged to Ethereum, converted to ETH, and funneled into Tornado Cash. These incidents highlight ongoing vulnerabilities in the broader ecosystem.

Business Model and Funding

Hyperliquid operates without traditional venture capital funding, which distinguishes it from most crypto projects. The platform's cofounder reiterated that no investor unlocks exist because it never raised external capital, with the 1.75 million tokens distributed exclusively to team members as part of vesting schedules. In 2024, Hyperliquid launched its native token HYPE via an airdrop to nearly 100,000 users, with over 20% distributed to core contributors under vesting until 2027-2028, and within three months HYPE achieved a market cap exceeding $9 billion. Recently, the platform has filed with the SEC to raise $1 billion through a SPAC merger, with proceeds intended for HYPE token purchases and ecosystem expansion.

Platform Performance and Features

Despite security concerns, Hyperliquid has achieved significant market traction and technical performance. The platform has over 300,000 users and processes more than $4 billion in daily trading volume. Hyperliquid achieves sub-second finality and can handle up to 200,000 transactions per second. It has become the third-largest decentralized exchange in crypto, processing trillions of dollars in volume during its lifespan, trailing only PancakeSwap and Uniswap. The platform commands an estimated 70-80% of the decentralized perpetual futures trading market and consistently processes around $8 billion in daily trading volume with 30-day fee revenue reaching nearly $100 million.

Hyperliquid — $37K (2023-06-15)

DeFiLlama recorded a security incident affecting Hyperliquid on June 15, 2023, with reported losses of $37K on Arbitrum. Classification: Ecosystem. Technique: CEX Price Manipulation Attack.

Sources

Timeline

2022-01-01

Hyperliquid founded and built as decentralized exchange

Is Hyperliquid Safe? - Whaleportal

2023-06-15

Hyperliquid — $37K (2023-06-15)

defillama.com

2024-11-01

HYPE token airdrop worth $1.6 billion distributed to nearly 100,000 users

What Is Hyperliquid? The Decentralized Exchange - Yahoo Finance

2024-12-23

North Korean hacker allegations trigger over $256 million in withdrawals

Hyperliquid Under Fire - Brave New Coin

2025-03-26

JELLY token manipulation incident causes $13.5 million loss to HLP vault

HyperLiquid Delists JELLY - CoinDesk

2025-09-26

HyperVault project accused of $3.6 million rug pull

Hyperliquid-Based Project Faces Controversy - Yahoo Finance

Research Gaps

4 open · agent-resolvable

Heuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.

  • [high]
    no addresses

    No on-chain addresses cited. Pull tx receipts or contracts from the source URLs and surface explorer links.

  • [med]
    no regulatory

    No regulatory or sanctions cross-check. Run OFAC SDN, SEC EDGAR, and CFTC enforcement-action lookups for this entity.

  • [med]
    single source

    Only one source has reported on this entity. Search Telegram (ZachXBT), other connectors, and news for corroborating coverage.

  • [med]
    unarchived sources

    Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.

model: claude-sonnet-4-20250514, defillama-connector

generated: 4/12/2026, 5:53:21 AM

avoid.net — verified advice for a post-truth world