TLDR
Hyperliquids HLP loss was triggered by a coordinated manipulation of the POPCAT market that created a buy wall, lured in liquidity, then pulled bids to force liquidations, leaving HLP with bad debt (CoinDesk).
- An attacker split $3M USDC across 19 wallets, built $2030M of POPCAT longs, then removed a ~$20M buy wall, crashing price and triggering liquidations (Cointelegraph).
- The attackers collateral was wiped, but HLP absorbed the remaining positions and lost about $4.9$5.0M (The Defiant).
- Hyperliquid temporarily paused its bridge via an emergency lock while manually closing exposure, then resumed activity after checks (The Block).
Deep Dive
1. Orchestrated Buy Wall Then Pull
The sequence began with $3M USDC withdrawn from OKX, split into 19 wallets and deployed to open over $26M in POPCAT longs, then a ~$20M bid wall near $0.21 was placed and removed.
- The large buy wall created the illusion of demand, drawing in copycat longs and pushing price up before support vanished (Cointelegraph).
- When the wall disappeared, price support evaporated and thin depth amplified the drop, setting up a liquidation cascade (CoinDesk).
Thin-liquidity memecoins with leverage are highly susceptible to spoof-like tactics that can quickly flip from strong bid to a fast down move.
2. Liquidation Cascade Hits HLP
As longs were liquidated, HLP, which backstops bad debt from the liquidation engine, inherited positions and crystallized roughly $4.9M in losses, while the attackers $3M was sacrificed.
- Reports converge on HLP losing about $4.9$5.0M after absorbing positions and closing them at worse prices (The Defiant).
- Commentary framed it as peak degen warfare, exploiting thin depth and automated LP absorption rather than a protocol exploit (CoinDesk).
HLP is not an insurance fund. LPs socialize liquidation deficits on tail events, so returns can be clipped by manipulation in illiquid markets.
3. Operational Safeguards and Context
Hyperliquid invoked an emergency lock on its Arbitrum bridge and manually closed the position, then resumed activity after checks; media noted similarity to a March incident.
- The platform paused deposits and withdrawals via emergency lock, then reopened after investigation, indicating a risk control response rather than a chain exploit (The Block).
- Outlets highlighted this as at least the third manipulation-style hit in 2025, underscoring structural risk in high-leverage markets on low-liquidity tokens (NewsBTC).
Controls can contain fallout, but repeated incidents on thin pairs suggest tighter market listing criteria, leverage caps, or vault limits could reduce recurrence risk.
Conclusion
The HLP losses were not from a protocol hack but from manufactured demand followed by a rapid withdrawal of support that triggered liquidations. The mechanism exploited thin-depth, high-leverage dynamics on a memecoin, leaving HLP to socialize bad debt. Until listing and leverage policies adapt for illiquid assets, similar attacks could recur, and HLP returns will remain exposed to these tail events.
