Hyperliquid is back in the spotlight. DEX could have seen its liquidity fund, containing users' funds, completely emptied.

Bybit recently demonstrated. However, in the case of Hyperliquid, the HLP is a weak point, as it is constantly exposed to attempts at market manipulation.

Two weeks after being manipulated by an experienced trader, Hyperliquid is back in the spotlight. DEX could have seen its liquidity fund, containing users’ funds, completely emptied. However, the lack of decentralisation can sometimes prevent the worst.

The attack suffered by Hyperliquid

Hyperliquid’s success, which can be verified by its daily trading volumes, is all the more remarkable considering that DEX is still a very young protocol. This makes it still relatively untested and thus an ideal prey for manipulation attempts by some malicious traders. Only a fortnight ago, the platform suffered a loss of $4 million as a result of a large-scale leveraged manipulation of $300 million on Ethereum. With an ingenious strategy, a trader managed to cash in his profits through leverage, leaving Hyperliquid to handle the liquidation. It was a manoeuvre that required a cool head and a deep understanding of liquidation processes, as well as the workings of DEX itself. The latter is based on the Hyperliquid Liquidity Pool (HLP), an internal, mutualised liquidity fund into which users can deposit funds and receive rewards from fees collected by the protocol. This fund provides liquidity to DEX traders when needed, ensuring the stability of trading operations and also acting as a ‘safety buffer’ in case of liquidavision. However, this mechanism represents both a strength and a weakness for the protocol.

How the JELLY token was manipulated

Having funds available to protect users is generally a good thing, as Bybit recently demonstrated. However, in the case of Hyperliquid, the HLP is a weak point, as it is constantly exposed to attempts at market manipulation. On the face of it, no one would have any interest in challenging the HLP, as this would imply being liquidated. However, with well-planned strategies, it is possible to generate high profits while leaving the cash fund to handle the losses. Here’s what happened: a single attacker deposited over $7 million into three separate Hyperliquid accounts within minutes to manipulate the low market capitalisation memecoin JELLY (around $10 million before the attack). In summary, through address 0xde95, the trader opened a massive short position on JELLY (400 million tokens, or 40% of the total supply), while simultaneously opening long positions on other addresses. The trader then manually reduced the margin, self-liquidating and leaving the liquidity fund (HLP) to cover the losses. As a result, the protocol ended up with a latent loss of USD 12 million, as the price of JELLY had reached USD 0.05 at its peak. Meanwhile, through the newly created address 0x20e8, the same trader made multimillion-dollar profits from JELLY’s price increase and long positions, cashing in between $8 and $10 million.

The objective of the manoeuvre was clear:

Hyperliquid’s reaction and the debate on decentralisation

Faced with the situation, Hyperliquid was forced to delist the JELLY token. If the price had risen further, the losses for HLP could have become critical. A relevant detail is that while HLP was more at risk, Binance and OKX both decided to list JELLY on their platforms. Gracy Chen, CEO of Bitget, even compared Hyperliquid to ‘FTX 2.0’, fuelling a Web3-style wave of panic. To limit HLP’s losses, Hyperliquid manually changed the price of its oracle on JELLY, lowering it from $0.05 to $0.0095. In doing so, DEX not only cancelled out HLP’s latent loss, but also posted a profit of $700,000. This decision triggered fierce criticism, with many questioning the true decentralisation of Hyperliquid. Indeed, the protocol was launched with an initial set of only four validators, later increased to sixteen, all selected directly by Hyperliquid.

Hyperliquid responded by stating that, given its young age, the protocol aims at progressive decentralisation, both for governance and for the code, which is currently still partially closed to the public.

This episode raises broader questions about decentralised finance: