TLDR
Hyperliquids HLP vault losses were triggered by a coordinated manipulation of the POPCAT market that forced mass liquidations the vault had to absorb, resulting in about $4.9$5.0 million in bad debt (alleged manipulation report).
- An attacker used $3 million split across 19 wallets to build over $26 million in leveraged longs and a fake $20 million buy wall, then pulled it to crash price (incident details).
- The attackers positions were liquidated and their $3 million wiped, while HLP absorbed roughly $4.9 million in losses (loss recap).
- Hyperliquid briefly paused Arbitrum bridge deposits/withdrawals as it manually closed exposure, echoing similar episodes earlier this year (bridge pause coverage).
Deep Dive
1. Attack Setup
A trader withdrew about $3 million in USDC from OKX, split the funds across 19 fresh wallets, and opened over $26 million in leveraged longs tied to Hyperliquids POPCAT-denominated perp (HYPE) (sequence outline).
This capital fragmentation and rapid position building set the stage to engineer order book signals that appeared like genuine demand before the reversal, increasing the odds of liquidation cascades when support vanished (incident summary).
Fragmented wallets plus high leverage can create misleading depth signals. Thin-liquidity assets are especially vulnerable to engineered order flow shocks.
2. Spoofed Liquidity
The attacker constructed a synthetic buy wall near $0.21 (around $20 million), briefly pulling in reactive bids. They then removed the wall, causing POPCAT to slide sharply and trigger cascading liquidations across leveraged positions (mechanics described).
Reports note the attackers own collateral was fully wiped, suggesting the intent was to stress the venues liquidation architecture rather than profit, a case of burning capital to force protocol losses (context piece).
Order book spoofing combined with thin depth can flip from apparent strength to forced unwind. If automated vaults backstop liquidations, they can be drawn into socialized losses.
3. Fallout And Response
Hyperliquids community-owned HLP vault absorbed the deficit, posting an approximately $4.9 million loss for the episode (loss recap).
To manage risk and close positions, the Arbitrum bridges emergency lock paused deposits/withdrawals for a short window, with admins clarifying the chain itself stayed up and funds were safe (bridge pause coverage).
Media also highlighted similar manipulation-style events earlier in 2025, indicating a recurring structural challenge when high leverage meets lower-liquidity memecoins (broader pattern note).
Vaults that insure liquidation engines can face episodic losses when thin markets are targeted. Mitigations typically involve depth thresholds, tighter risk limits on small caps, and faster circuit breakers.
Conclusion
Cause and effect were straightforward. The attacker spoofed demand to inflate POPCAT, pulled support to force a crash, and liquidations ensued. With collateral exhausted, Hyperliquids HLP absorbed the remaining bad debt. The brief bridge pause helped the team manage exposure, but the episode underscores how leveraged perps on thin-liquidity assets can stress automated vault designs in moments of engineered volatility.
CoinsKid.Com