$5 Million Lost as Hyperliquid's HLP Vault Hit by Market Manipulation

Table of Contents

TLDR

Hyperliquid experienced a $5 million loss after an attack targeted its Hyperliquidity Provider vault.
An unknown trader withdrew $3 million from OKX and used it to manipulate the POPCAT market.
The trader created a false market demand by constructing a $20 million buy wall.
The market collapsed when the buy wall disappeared, leading to widespread liquidations.
Hyperliquid’s vault absorbed the losses, recording a $4.9 million deficit.

Hyperliquid, a decentralized derivatives platform, faced a $5 million loss following a coordinated attack on its Hyperliquidity Provider (HLP) vault. The loss occurred after an unknown trader manipulated the POPCAT market, leading to a cascade of liquidations. The attacker withdrew $3 million from OKX and used it to trigger the event, disrupting the platform’s liquidity structure.

A $3 Million Sacrifice for Market Manipulation

The incident began when the attacker withdrew $3 million in USDC from OKX and distributed it across 19 wallets. The funds were then used to open more than $26 million in leveraged long positions on Hyperliquid’s POPCAT-denominated perpetual contract. This move led to a $20 million buy wall being constructed near the $0.21 level on the platform, creating false market demand.

As the attacker withdrew the buy wall, the illusion of demand vanished, and the market quickly reversed. The sudden price drop triggered the liquidation of numerous overleveraged positions. The event led to a $4.9 million deficit in Hyperliquid’s HLP vault, marking one of the largest single-event losses in the platform’s history. Surprisingly, the attacker’s $3 million stake was entirely wiped out in the process.

Someone just manipulated $POPCAT to attack #Hyperliquid, burning through $3M of their own funds — and causing $4.9M in losses for the Hyperliquidity Provider (HLP).

The attacker withdrew 3M $USDC from #OKX yesterday, split it across 19 wallets, and deposited it into #Hyperliquid… pic.twitter.com/lnwsRSspFv

— Lookonchain (@lookonchain) November 13, 2025

Hyperliquid Responds to the Attack

In response to the attack, Hyperliquid temporarily paused withdrawals, citing its “vote emergency lock” feature. This mechanism was designed to prevent further manipulation of the platform’s liquidity. Withdrawals resumed approximately one hour later, though the platform did not directly link the pause to the POPCAT-related event.

While the incident exposed vulnerabilities in Hyperliquid’s system, it did not appear to result in long-term damage to the platform. However, the event drew mixed reactions from the community, some describing it as a stress test for the platform’s liquidity. One observer called it “performance art with real money,” while others saw it as a harsh reminder of the risks inherent in perpetual markets.

Despite the attack, Hyperliquid continued with its plans to expand. The platform filed with the SEC to raise up to $1 billion to strengthen its position in the decentralized derivatives market. The SEC filing is part of Hyperliquid’s larger push to secure additional HYPE tokens and expand its crypto holdings.