Hyperliquid XPL Attack Explained

Timeline of the Hyperliquid Attack

The XPL wipeout didn’t happen overnight. Signs of coordination showed up days before the actual squeeze. Between August 23–25, 2025, four whales quietly built long positions worth about $20 million, with an average entry around $0.56.

On-chain trackers later flagged Techno_Revenant as one of the main players. At one point he controlled about 28.3M XPL longs (~$31.1M) across more than a dozen wallets, representing over 35% of total open interest. He also kept another $26.5M USDC on Hyperliquid as dry powder.

The trigger came on August 26 at 05:30 UTC. A main wallet — tagged 0xb9c… — injected another $5 million in USDC into longs. Liquidity thinned out, the order book cleared, and the price lurched upward.

Minutes later, XPL exploded from $0.60 to $1.80, a near-200% spike. Short sellers had no time to react. Their positions started liquidating in waves, each one adding more fuel to the fire.

By the end of August 27, open interest had cratered from roughly $153 million to just $22 million. More than 80% of OI was go ne, erased in less than a day.

On August 28, Hyperliquid moved to tighten controls. New guardrails included a 10× price cap on thinly traded tokens and additional external data inputs. The measures came too late for those caught in the squeeze — but they marked the first real policy response after the attack.

Yet by August 29, whale activity hadn’t stopped. On-chain trackers flagged another wave of manipulation attempts: four new wallets, seeded with $10M USDC, all piling into fresh XPL longs. The pattern mirrored the earlier squeeze and highlighted how quickly large players can adapt even after rule changes.

Event Breakdown

• Aug 23–25: Accumulation – $20M longs at ~$0.56.
• Aug 26, 05:30 UTC: Trigger – 0xb9c adds $5M, clearing order book.
• Aug 26 (minutes later): Price jumps to $1.80, shorts liquidated.
• Aug 26–27: Open interest collapses $153M → $22M.
• Aug 28: Safeguards announced — 10× caps, external data.

Scale of Liquidations and Market Impact

The numbers tell the story. Four whales working in sync walked away with about $47.5 million in profit. On the other side of the trade, ordinary users and funds shouldered roughly $60 million in losses.

The wipeout was brutal. Open interest collapsed from around $153 million down to just $22 million, erasing more than $130 million in exposure — roughly 81% gone.

Short sellers bore the brunt of it. About $16.6 million in short positions were liquidated in the squeeze. One account alone lost nearly $4.5 million in a single hit, despite using hedged leverage.

Trading activity spiked as chaos unfolded. In a single day, XPL futures volume shot to roughly $161 million, more than triple the norm. What looked like a windfall for a handful of whales ended up as a market-wide bloodletting.

Hyperliquid’s rise has been meteoric — with $397B in 30-day perp volume and nearly $1.3B in annualized revenue. Yet the XPL attack showed that even at this scale, a thin spot feed can bring the entire market to its knees.

Impact Breakdown

• Whale profits: ~$47.5M (across 4 wallets)
• Trader losses: ~$60M+ combined
• Open interest: $153M → $22M (~$130M wiped, ~81%)
• Largest single loss: ~$4.5M
• Shorts liquidated: ~$16.6M
• 24h futures volume: ~$161M (+311%)

Mechanics of Manipulation: How the Attack Worked

The squeeze hinged on two weak spots: an isolated price feed and full transparency in the order book. Hyperliquid’s XPL futures pulled their reference from a thinly traded spot market. Liquidity there was so shallow that the attacker only needed about $184,000 in WETH to send XPL’s spot price up nearly eightfold.

That artificial pump bled straight into Hyperliquid’s oracle. Suddenly the futures market showed XPL at wildly inflated levels. Shorts didn’t stand a chance. Margin thresholds were breached almost instantly, and liquidations began to cascade.

What made it sharper was the visibility. With every position and liquidation point exposed on-chain, whales could literally map out where to push the price. They nudged it just far enough to trip liquidation lines and then collected on the forced selling — a classic case of “harvesting” positions.

For readers new to the platform, it helps to understand what Hyperliquid is at its core — a decentralized perpetuals exchange that blends CEX-like speed with DeFi’s openness. We covered its architecture, token economy, and design philosophy in detail in our piece on what is Hyperliquid.

Technically, nothing was broken. No contract bug, no exploit in the code. It was simply using the rules of the system in a way most traders never imagine. On centralized exchanges, this kind of move would’ve been nearly impossible. Binance and Bybit blend prices from multiple venues, so while XPL was flashing $1.80 on Hyperliquid, it never left $0.55 elsewhere. That disconnect was the entire play.

Community and Institutional Reactions

Hyperliquid’s official line was simple: nothing broke. The team stressed that “all systems worked as designed” — no smart contract bug, no bad debt. They framed the event as volatility contained within an isolated market. Traders didn’t buy it.

Hedge fund desks argued the whales chose Hyperliquid precisely because of its gaps.

Monolith called out the lack of safeguards:

While Opt.fun’s Ryan Galvankar put it bluntly: “It was only a matter of time before there was a pre-market perp price manipulation.”

The comparison to centralized venues came quickly. On an exchange with circuit breakers and tighter feeds, a $200,000 pump wouldn’t have even registered. Binance and Bybit showed XPL flat around $0.55 while Hyperliquid printed $1.80. That disconnect left many wondering why Hyperliquid hadn’t anticipated such a scenario.

Retail sentiment was equally harsh. One trader, known as CBB, reportedly lost around $2.5 million and swore off isolated perp markets entirely.

On the investigative side, ZachXBT criticized governance, pointing out that Hyperliquid only seems to intervene — freezing or delisting markets — when its own exposure is on the line.

The consensus across both retail and institutional voices: the attack wasn’t a fluke, it was an inevitable outcome of design choices.

At the same time, Hyperliquid is being tested on another front: competition within DeFi itself. Aster’s explosive debut has sparked a direct rivalry, and we broke down how the two platforms stack up in Aster vs Hyperliquid.

Lessons for Traders, Platforms, and Regulators

The XPL squeeze left a clear message: leverage in illiquid tokens is a loaded gun. Even cautious traders running 1×-hedged shorts saw their positions erased. If you’re trading niche assets, spreading exposure across venues, limiting position size, and tracking open interest should be the bare minimum.

Zhu Su noted that the event wasn’t really an exploit at all. Instead, it was hedgers shorting an asset that ripped higher, and some didn’t fully grasp how isolated margin differs from cross margin — leaving them flash-liquidated even with plenty of funds in their account.

Community analyst DCF GOD made the same point more bluntly: without three times your short in collateral, you were blown out. He argued that it wasn’t about traders lacking funds, but that isolated markets forced liquidations within minutes. His takeaway: sometimes those old-fashioned tradfi circuit breakers really can be a good thing.

For platforms, the fix can’t stop at one patch. Hyperliquid’s 10× price cap and use of external feeds were important first steps, but the event showed how fragile pre-market tokens really are. Circuit breakers, stricter position limits, and broader price aggregation might be necessary if DeFi perps want to compete with CEXs on safety.

Zooming out, there’s a bigger industry problem. Permissionless derivatives let innovation flourish, but they also magnify systemic risk when liquidity is thin. Illiquid perpetual markets are, by design, inherently dangerous. The XPL wipeout may end up as Exhibit A in regulatory debates over how these products should be monitored, disclosed, or even capped.

The paradox is obvious: DeFi promises openness and innovation, but without balancing mechanisms, that openness can leave traders exposed to predatory plays. The challenge now is finding equilibrium between the two.

FAQ

Was the Hyperliquid attack an exploit?

No. This wasn’t a smart contract bug or a hidden backdoor. The whales used the exchange exactly as it was built. Prices were pushed, liquidations were triggered, and profits were extracted — all within the protocol’s own rules. In other words, manipulation, not a hack.

How did the whales profit?

They built up large longs, then forced the squeeze. One whale — wallet 0xb9c… — loaded roughly $16 million into positions, driving XPL from about $0.60 to $1.80 in minutes. The move liquidated a wave of shorts, creating forced buy pressure. Most of the long was closed near the top, locking in $14–16 million in profit, while part of the position is still open and in the green.