$5M Crypto Attack Wipes Out Hyperliquid HLP Vault

The attack on Hyperliquid began with meticulous preparation when an unidentified trader withdrew 3 million USDC from the OKX crypto exchange. According to blockchain analytics firm Lookonchain, the attacker then distributed these funds across 19 fresh wallets, creating multiple entry points for the upcoming manipulation scheme. This fragmentation of capital across numerous addresses was designed to obscure the trader’s true intentions and make the coordinated nature of the attack less apparent to market observers and protocol safeguards.

With the capital strategically positioned, the attacker funneled the assets into Hyperliquid to open over $26 million in leveraged long positions tied to HYPE, the platform’s POPCAT-denominated perpetual contract. This massive positioning represented the foundation of the manipulation strategy, creating substantial exposure that would later be used to trigger cascading liquidations across the protocol. The scale of these positions, built using the distributed USDC capital, demonstrated the attacker’s willingness to deploy significant resources to execute their scheme.

The manipulation strategy escalated when the trader constructed an artificial $20 million buy wall near the $0.21 price point for POPCAT. This massive concentration of buy orders created a powerful illusion of market strength and support, signaling to other traders that significant institutional or whale interest was backing the asset at that price level. The presence of such a substantial buy wall naturally pushed the market upward as participants reacted to this manufactured signal of confidence.

The artificial nature of this market support became devastatingly clear when the attacker abruptly canceled all buy orders, causing the $20 million wall to collapse instantly. This sudden removal of liquidity created a vacuum where price support vanished entirely, leaving the market vulnerable to rapid downward pressure. The timing of this collapse was calculated to maximize the impact on other leveraged positions within the Hyperliquid ecosystem, particularly those in the protocol’s Hyperliquidity Provider vault.

With the artificial support removed, the POPCAT market experienced immediate and severe price dislocation, triggering cascading liquidations that wiped out nearly $5 million from Hyperliquid’s HLP vault. The coordinated nature of the attack ensured that the liquidations would occur in a chain reaction, as the initial price drop forced the liquidation of other leveraged positions, which in turn created additional selling pressure and further price declines.

The community reaction to the $3 million capital burn was notably cynical, with one member describing the event as “performance art” and noting that only in crypto do “villains torch millions purely for the sake of the plot.” This characterization highlights the peculiar nature of decentralized finance, where actors can deliberately destroy significant value as part of market manipulation strategies that would be economically irrational in traditional financial markets.

The attack documented by Lookonchain serves as a stark reminder of the vulnerabilities that persist in decentralized finance protocols. Despite the technological advancements in blockchain analytics and protocol design, well-funded bad actors can still exploit market mechanics and liquidity structures to engineer profitable manipulation schemes. The Hyperliquid incident demonstrates that even sophisticated DeFi platforms remain susceptible to coordinated attacks that leverage artificial market signals and capital deployment across multiple wallets to bypass detection mechanisms.