Hyperliquid Exploited: Trader Attempts to Drain Funds with Leveraged Trades on Illiquid Coin

In a dramatic turn of events, the decentralized trading platform Hyperliquid has been hit by a major exploit that involved some really dodgy leveraged trading on an illiquid coin named JELLYJELLY.

This exploit, we are sad to announce, resulted in draining huge funds from Hyperliquid, totaling about $8 million. For a quick visual run-through of what went down, check the screenshots below, which we snagged from X (formerly Twitter). They show the timeline of events that transpired, along with many of the details we are privy to at this moment.

The Setup: A High-Stakes Leveraged Play

The exploit started when the trader put in a huge amount of cash—$7.167 million—into three separate accounts on Hyperliquid. He did it so fast that it looked like he was depositing in a normal banking scenario, yet all this went down in a five-minute window. With this wealth, he attempted to use JELLYJELLY, a low-base coin with not much liquidity, to leverage an even bigger trade. JELLY really should have been a goner. Instead, it leveraged the trader in the opposite way, serving up a huge loss.

The trader made two sizable leveraged bets on JELLYJELLY rising. The first was in a long position at a bit over $2.15 million taken by the account 0x20e8fD36dcdEF8DfbB983B0bc06c658105b9a808. The second in the same asset was with about $1.9 million by the account 0x67fe6F372c2Bd7ce0AA660144568F80A7cD85CA2. The price of JELLYJELLY initially moved in the traders’ direction and brought to account 0x20e8fD36dcdEF8DfbB983B0bc06c658105b9a808 a unrealized gain of $900K; however, the account 0x67fe6F372c2Bd7ce0AA660144568F80A7cD85CA2 was showing a position underwater with a $167K loss.

In an intentional act to reduce his risk, the trader took a $4.1 million short position on JELLYJELLY with a third account, 0xde9593Fe5cDC5Cb0917f5d5618A111F1174f5c91. This move was meant to hedge against possible losses from his long positions, mitigating them in case the price of the token went down instead of up. Trying to balance long risk with short moves: not the optimal way to invest.

The Exploit Unravels

The trader’s strategy depended greatly on controlling leverage and liquidity in the JELLYJELLY market. When the price of JELLYJELLY shot up, the big short position on the third account rapidly entered liquidation. However, because of the size of the position, the liquidation process did not execute normally. Instead, the position moved to Hyperliquid’s Hyperliquidity Provider Vault (HLP), which was made to manage and liquidate large positions that could not be settled by using regular methods.

When the price of JELLYJELLY increased by more than 400%, the trader started pulling out collateral from two long positions—0x20e8fD36dcdEF8DfbB983B0bc06c658105b9a808 and 0x67fe6F372c2Bd7ce0AA660144568F80A7cD85CA2. He also ‘realized’ the long positions as positive profits. Overall, he managed to extract $6.26 million in withdrawals from the two accounts while leaving around $900K in unrealized profits across the remaining two accounts.

At 12:43 UTC, the exploiter withdrew his last amount. But shortly after, around 12:50 UTC, when Hyperliquid restricted the accounts to reduce-only orders, the withdrawals were blocked. This meant no more could be taken out. The trader was thus unable to access anything left in his accounts that hadn’t been realized.

The Final Moves: Selling and Market Shutdown

The exploiter couldn’t make any more withdrawals, so he began selling off his JELLYJELLY positions in an attempt to regain some liquidity. On the first account, 0x20e8fD36dcdEF8DfbB983B0bc06c658105b9a808, the trader sold his JELLYJELLY holdings to the open market. In reaction, Hyperliquid then took action to completely turn off the JELLYJELLY market. The market was then stopped at the price of $0.0095 per JELLYJELLY token, which is exactly the price at which the third account that had shorted JELLYJELLY entered its position.

Hyperliquid’s action effectively neutralized the floating profits across the first two accounts, wiping out the positive gains that had previously been realized. With the market closed and the PnL from the exploiter’s leveraged positions wiped out, the exploiter had no further means of extracting funds.

The Aftermath: A Potential $1 Million Loss

Ultimately, the trader’s scheme did not work out as planned. He deposited $7.17 million into three accounts, yet could not pull out more than $6.26 million. At last count, the accounts held roughly $900K that the platform won’t let him touch until the exploit has been patched. If Hyperliquid somehow allows this guy to access the last bit of cash, he will have seen his loss whittled down to about $4,000. Not bad for a nearly-$7.2-million heist, eh?

But if the platform doesn’t allow him to take out the money, then the person who pulled off the exploit is looking at a total loss of about $1 million. Considering how involved the exploit was and how locked down Hyperliquid is, it’s unclear whether the exploit will be able to recover his funds or whether this will serve as a reality check for anyone else thinking about trying to pull off the same stunt on the platform.

Conclusion: A Wake-Up Call for DeFi Platforms

This incident spotlights the dangers of leveraged trading on decentralized platforms, particularly when it comes to illiquid assets like JELLYJELLY. To be sure, the exploiter acted with some aggressive moves. But his behavior also shines a light on the way Hyperliquid—and probably other DEXes—manage large leveraged positions and liquidity events. As we push to make these new trading protocols ever more user-friendly, we also have to refine their mechanisms to prevent similar exploits and protect users from such attacks.

For both traders and platforms, the Hyperliquid exploit serves as a grim reminder of the necessity for strong risk management practices and of the dynamics in leveraged trading environments that need to be understood much better.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.

Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!