Loss: an attempted roughly $12M unrealized loss to HLP while it held the inherited short; after the validator override Hyperliquid said HLP’s 24-hour PnL was about +700k USDC, and the Hyper Foundation later separately refunded non-flagged JELLY longs
Summary: Three coordinated Hyperliquid accounts opened a roughly $4.1M-$4.5M JELLY short against two leveraged longs, then forced liquidation of the short while pushing JELLY spot sharply higher outside Hyperliquid. Hyperliquid’s ordinary design was supposed to send an uncloseable liquidated position into the HLP liquidator vault and ultimately use ADL if account value went negative. Instead, the inherited short sat inside a broader HLP account whose pooled collateral kept ADL from triggering even as the position became systemically toxic. With HLP facing roughly $12M of unrealized losses on a thin memecoin short, Hyperliquid validators voted within minutes to delist JELLY perps, settle the market at a non-market price around 0.0095, and later make non-flagged long users whole from the Foundation. The incident matters because the exploit path was not a contract-call bug; it was a solvency-design failure where thin-market price printing, attacker-controlled liquidation timing, and pooled backstop collateral together outran the venue’s advertised liquidation safeguards.
Trigger / entry point:
Hyperliquid allowed a very large JELLY perp position relative to the token’s market cap and executable order-book depth.
The attacker controlled both sides of the core derivatives exposure: one account short, two accounts long.
Hyperliquid’s liquidation docs say positions below maintenance margin are first sent to the book, then below 2/3 of maintenance margin are backstop-liquidated through the liquidator vault, while ADL is the final solvency safeguard once account value turns negative.
In this incident, the short was deliberately pushed into liquidation and then inherited by HLP, but HLP’s pooled collateral model prevented the platform’s final safety mechanism from triggering quickly enough.
Root cause:
Hyperliquid let open-interest sizing on a thin asset grow large enough that the liquidation system, not just the mark price, became the real risk surface.
The protocol assumed the liquidator vault and then ADL would safely absorb a toxic liquidation. In practice, once the short was transferred into a collateral-rich pooled HLP account, the loss was measured against total HLP collateral rather than the liquidator sleeve that actually owned the toxic position.
That meant the platform could recognize a rapidly growing unrealized loss without tripping the final account value < 0 style solvency guard described in the docs.
The exploit therefore lived at the intersection of thin-market oracle sensitivity, attacker-controlled self-liquidation timing, and a backstop design whose capital-pooling semantics weakened the intended emergency boundary.
Exploit path:
Coordinated accounts built the position structure on Hyperliquid: one account opened a roughly $4.1M-$4.5M JELLY short while two sibling accounts opened roughly $2.15M and $1.9M-$2.5M long positions.
The short account became profitable initially and began withdrawing margin, deliberately walking itself toward liquidation rather than defending the position.
Once the short fell through liquidation thresholds, Hyperliquid could not cleanly close it on the book because JELLY liquidity was too shallow relative to the position size.
Per Hyperliquid’s documented liquidation design, the toxic short was transferred into the liquidator vault inside HLP as a backstop liquidation.
In parallel, the attackers and sympathetic momentum traders pushed JELLY spot sharply higher on external venues, with multiple analyses describing roughly 250% to 429% upside in a short window.
HLP now effectively held the inherited short and began accumulating large unrealized losses as JELLY rose.
ADL did not trigger because, as Hyperliquid later explained, the liquidator vault shared collateral with other HLP component vaults, so the inherited position was judged against total HLP account value rather than a standalone liquidation sleeve.
With HLP reportedly facing roughly $12M of unrealized loss and no automatic unwind mechanism stopping the bleed, the validator set convened and voted to delist JELLY perps.
Hyperliquid settled the market around 0.0095, canceled positions and orders, preserved HLP from the live squeeze, and later announced Foundation-funded refunds for non-flagged users who were long at settlement.
What the attacker needed to be true:
JELLY spot and perp liquidity had to be thin enough that a few coordinated accounts could dominate price formation relative to allowed Hyperliquid position size.
Hyperliquid had to allow a short large enough that ordinary book liquidation would fail and force the position into the liquidator vault.
The liquidator vault had to share enough collateral with the rest of HLP that the inherited loss would not immediately trip ADL.
The attacker had to control both sides of the perp exposure so the short’s forced liquidation and the longs’ mark-to-market gains could be coordinated around the same printed move.
Hyperliquid had to treat the market as live long enough for the squeeze to threaten HLP before governance-style intervention arrived.
Technical anatomy worth remembering:
This was not a bug in a Solidity contract entrypoint. The interesting failure was balance-sheet architecture: how a backstop short migrated into HLP, how account value was measured for ADL, and how much thin-market risk the venue let one position externalize to a community vault.
Hyperliquid’s liquidation docs explicitly describe a sequence of book liquidation, then liquidator-vault takeover below 2/3 maintenance margin, then ADL when account value becomes negative. The incident showed that these safeguards do not compose safely if the toxic position is moved into a better-capitalized pooled account before the final trigger is evaluated.
The exploit has a self-liquidation shape, but not in the classic lending sense where the attacker captures a liquidation bonus directly. Here the attacker weaponized the venue’s own backstop transfer so HLP inherited the dangerous leg at exactly the moment the spot squeeze intensified.
The price-manipulation leg still mattered. A bad backstop design alone is not enough if the reference market is deep. The attack worked because JELLY was thin enough that external spot buying could make HLP’s inherited short catastrophically expensive faster than the system could unwind it.
The cleanup path matters almost as much as the exploit path. Hyperliquid did not let the system resolve organically; validators overrode the market, delisted JELLY, and socialized user remediation through the Foundation. That preserved the venue but also demonstrated that the final control surface sat with a fast-moving validator / foundation coordination layer.
Representative accounts and positions:
Short account highlighted by Arkham: 0xde9
Long account highlighted by Arkham: 0x20e
Long account highlighted by Arkham: 0x67f
Arkham estimated total attacker deposits of about $7.17M, withdrawals of about $6.26M, and roughly $900k left on the two long accounts after the intervention.
Response / mitigation:
Hyperliquid announced that validators had voted to delist JELLY perps after suspicious market activity and said non-flagged users would be made whole by the Hyper Foundation.
In the next-day recap, Hyperliquid said users with JELLY long positions at settlement would be refunded as if they settled at 0.037555, again excluding flagged addresses.
Hyperliquid also said the key issue was HLP collateral sharing across component vaults, which prevented ADL from triggering once HLP took over the position.
Announced mitigations included capping the liquidator vault as a smaller sleeve of HLP, triggering ADL based on liquidator-vault losses rather than pooled HLP collateral, refining open-interest caps relative to market cap, and introducing validator onchain votes for asset delistings beneath critical thresholds.
Pattern tags
Thin external-spot solvency dependence: Hyperliquid let a thin memecoin market outside the venue keep enough authority over perp marks and liquidation outcomes that a coordinated squeeze could threaten protocol balance-sheet capital.
Self-authored liquidation transfer as exploit rail: the attacker did not merely trade against the book; they deliberately walked their own short into the venue’s backstop path so HLP inherited the toxic leg at the worst possible moment.
Backstop-sleeve insolvency masking: the inherited short sat inside a richer pooled HLP account, so the local liquidator sleeve could already be economically broken while the venue-wide ADL trigger still read as healthy enough.
Constitutional override settlement: once the automatic liquidation story failed, validator delisting power and Foundation refund policy became the real final risk engine.
Why the exploit worked
The dangerous object was not just JELLY went up fast. It was the joined chain thin external spot could still define enough mark truth→attacker could force protocol takeover timing of the short→the inherited short was judged against pooled HLP collateral instead of a local backstop sleeve→automatic ADL never shrank exposure before losses became systemic.
Hyperliquid effectively treated the liquidator vault can warehouse this short and the venue can keep running ordinary market semantics for this asset as the same claim. They were not. Once executable unwind depth had collapsed, the market already deserved degraded-mode treatment before HLP became the bag-holder.
The exploit also depended on a split between where risk was printed and where losses were socialized. External JELLY spot venues authored the squeeze, but HLP’s pooled collateral absorbed the mark-to-market damage, letting a shallow outside market threaten a much deeper shared balance sheet.
Most importantly, the final safety predicate watched the wrong object. The toxic short had become a liquidator-sleeve emergency before it became a whole-HLP-account insolvency event, so the platform’s advertised ADL exists safeguard arrived too late to be a real containment boundary.
Detection and audit pivots
Track largest forced-close size against real executable unwind depth on the reference asset, not just displayed order-book liquidity. If one liquidation-sized short already cannot be closed without venue takeover, the market is in degraded mode whether the UI says so or not.
Model protocol-owned liquidation as a separate solvency domain. Ask whether the inherited position can bankrupt the liquidator sleeve long before it bankrupts the richer pooled account that currently gates ADL.
Monitor for the self-liquidation choreography itself: concentrated two-sided exposure, profitable margin withdrawals from the stressed leg, and sudden dependence on protocol takeover rather than on ordinary book exits.
Inventory who really decides crisis settlement semantics. If validator delisting votes, discretionary settlement prices, or Foundation remediation are the practical final safeguards, those should be audited as live control surfaces rather than treated as off-model emergency comms.
Compare outside-market depth with community-backstop capacity. If a thin external memecoin can swing marks enough to put HLP-scale capital at risk, open-interest caps and liquidation assumptions are already detached from the real executable market.
Ask whether mark still exists, mark still deserves liquidation authority, and this inherited position still deserves pooled backstop support at full size are kept separate anywhere in code or operations. If not, thin-asset squeeze risk is being flattened into one over-trusted state.
Failure-prevention checklist
Size open interest, leverage tiers, and liquidation assumptions from executable external depth, not from memecoin market cap, recent prints, or the hope that HLP can warehouse whatever the book cannot close.
Keep the backstop sleeve balance-sheet local. If a liquidator vault inherits a toxic position, trigger ADL, forced reduction, or kill-mode from that sleeve’s own solvency state instead of letting unrelated pooled collateral cosmetically keep the emergency alarm asleep.
Treat thin external spot venues as degraded oracle inputs before liquidation failure arrives. When independent price confidence or executable depth collapses, automatically cut caps, raise margin requirements, or halt fresh size before the backstop is asked to absorb impossible inventory.
Stress the same actor controls both sides path explicitly. A perp venue should assume one operator can build the short, the squeeze long, and the margin-withdrawal path that walks the short into protocol-owned liquidation at the chosen moment.
Separate community LP / insurance capital from toxic-position warehousing unless the sleeve has explicit per-asset loss budgets, isolation limits, and faster emergency triggers than ordinary account-level solvency checks.
Precommit crisis-state rules for delisting, emergency settlement, refund eligibility, and governance / validator intervention before the market is under attack. Ad hoc override should be the narrow exception, not the first time the venue decides what its constitution really is.
Monitor liquidation-path utilization, margin-withdrawal behavior on concentrated positions, and sudden divergence between displayed mark robustness and real executable unwind depth.
Audit prompts
What exact executable external depth justifies the current JELLY-like open-interest cap, and how much slippage would a forced close of the largest short actually face right now?
If the largest liquidated position transfers into the backstop sleeve today, whose collateral is economically on the hook first, and what precise condition triggers ADL or forced size reduction?
Can a single actor or coordinated set of accounts own both sides of the dominant perp exposure, withdraw margin from one leg, and force protocol takeover timing on their own terms?
Does the venue evaluate emergency solvency at the toxic-position sleeve or only at a richer pooled account that can hide one market’s insolvency behind unrelated collateral?
When the reference market is a thin external memecoin venue, what objective rule says the mark still deserves full liquidation and reserve-authority weight instead of degraded-mode treatment?
Are validator or governance delisting powers pre-scoped enough that users can know in advance how crisis settlement price, order cancellation, and refund policy will be chosen?
What telemetry would warn operators that book liquidation exists on paper but not at this size before the backstop inherits the position?
If the backstop fails on a thin asset, what prevents the venue from socializing losses or discretionary overrides in a way that contradicts its advertised autonomous liquidation story?
Lessons that should already be standard
A backstop transfer is not containment if the transfer also moves the toxic position into a richer account that suppresses the final insolvency trigger.
ADL exists is weaker than it sounds. The real question is which balance sheet the ADL predicate watches once the protocol itself becomes the bag-holder.
Thin-market perp risk is not only an oracle problem; it is a liquidation-architecture problem. The dangerous object is the whole chain mark -> liquidation failure -> protocol warehouse -> pooled-collateral masking -> emergency override.
Community LP or insurance capital should not quietly become unlimited warehouse capacity for attacker-timed self-liquidations on assets the book cannot really absorb.
If rapid validator votes and foundation refunds are the thing that ultimately saves the venue, those actors belong in the honest security model whether or not the exchange markets itself as fully automatic.
Degraded-mode rules need to be specified before the crisis. A venue that decides settlement semantics only after a squeeze begins is discovering its constitution live under attack.
Why this incident matters
It is a strong modern exemplar of how derivatives venues can fail without a classic code exploit: thin-market price printing plus bad backstop design can be enough.
It preserves a useful backstop inheritance lesson. Moving a toxic position from one account to a better-capitalized protocol account can suppress the very emergency logic meant to contain it.
It also shows that decentralized exchange risk is partly constitutional. If the only thing that saves users is a rapid validator override plus foundation reimbursement, the real security model includes those discretionary actors whether or not the UI markets the venue as autonomous.
Useful monetization cousin: self-liquidation-monetization — not because Hyperliquid paid an explicit liquidation bonus to the attacker, but because the attacker still controlled the liquidation timing of their own toxic position and used protocol rescue logic as the attack rail.
Useful stressed-unwind cousin: liquidation-auction-liveness-failure — a different market structure than auction-based NFT lending, but the preserved lesson is similar: paper liquidation paths can fail when executable unwind depth disappears exactly when stress arrives.
The leverage sat in JELLY open-interest sizing, order-book depth assumptions, backstop-liquidation transfer semantics, HLP collateral pooling, ADL trigger design, and the validator / foundation authority to overwrite market resolution when those automated controls failed.
The key lesson is not merely memecoins are risky. It is that if a protocol’s last-resort liquidator inherits a toxic position into a broader collateral pool, the same transfer that looks like risk absorption can also hide the emergency from the final solvency alarm.
The healthier control object would have treated thin external market still good enough for full-size mark / liquidation authority and backstop capital allowed to warehouse inherited toxicity as separate permissions, then forced degraded mode before pooled HLP collateral could cosmetically keep ADL asleep.