Hyperliquid’s battle: three-way competition, winner takes all

Late at night on March 26, the treasury of the decentralized trading platform Hyperliquid faced a liquidation risk of up to $240 million due to price manipulation of memecoin $JELLYJELLY.

Previously, the 50x leveraged whale on Hyperliquid had used similar methods to actively blow up its long positions, putting Hyperliquid's treasury at risk of loss.

The attack last night not only exposed the vulnerability of DeFi/DEX platforms in high-leverage transactions, but also became more complicated due to the "active assistance" of centralized trading platforms (CEX) --- This is more like a mantis catching a cicada, while the oriole is behind:

The attacker wants to profit through price manipulation, and CEX wants to attract users and traffic by listing popular tokens, indirectly hitting the financial security and reputation of its competitor DEX.

If you don't know Hyperliquid and this attack, we have also collected summary posts and analyses from all parties, trying to review the full picture of the incident, popularize the principles of the attack, and explore the motives of all parties.

The whole story: from short orders to vault crisis

First, you need to know what Hyperliquid is.

Hyperliquid is a decentralized trading platform based on its own Layer 1 blockchain, providing perpetual contract trading, aiming to combine the advantages of centralized and decentralized trading platforms.

Its vault HLP is a community-owned protocol vault responsible for market making and clearing, allowing users to deposit to share profits and losses. According to Vaults | Hyperliquid Docs, HLP deposits have a 4-day lock-up period to support platform liquidity.

So, what is the whole step of this attack on the HLP vault?

· Opening a short order: According to Aunt AI's monitoring, the attacker opened a $4.08 million $JELLYJELLY short position on Hyperliquid through an address (such as 0xde9...f5c91), with an opening price of $0.0095 and a margin of 3.5 million USDC.

· Lowering the price to trigger liquidation: Another address (such as Hc8gN...WRcwq) cooperates with spot selling $JELLYJELLY to lower the spot price, making the short position show floating profit. The attacker then withdraws 2.76 million USDC margin, triggering liquidation, and the vault takes over the position.

· Raising the price to expand losses: After liquidation, the attacker bought $JELLYJELLY in two waves at 21:01 and 21:45 to raise the price. According to CoinGecko data, the price rose by 230% in a short period of time, causing the short position floating loss of the vault to increase.

· CEX actively intervenes: As long as JELLYJELLY continues to rise, the short position loss will be further aggravated; at this time, Binance and OKX launched $JELLYJELLY perpetual contracts, attracting a large amount of trading volume, and the price rose further, aggravating the loss of the vault.

· The treasury is at risk of a run: As of March 27, 2025, the treasury has a floating loss of $10.63 million, and the TVL has dropped by about $20 million. The latest TVL is $231 million (Hyperliquid dashboard). If the price of $JELLYJELLY rises to $0.17, the treasury may be liquidated, with a loss of $240 million.

· Hyperliquid delists JELLYJELLY without incurring any losses: Afterwards, Hyperliquid's treasury liquidated 392 million JELLY tokens (about $3.72 million) at $0.0095, making a profit of $703,000 without incurring any losses. At the same time, after Hyperliquid found evidence of suspicious market activities, the validators gathered to hold a meeting and voted to delist the JELLY perpetual contract, and all users will be fully compensated by the Hyper Foundation.

Price manipulation and the "assistance" effect of CEX

If it's a bit confusing, you might as well learn about the coordination between short orders and spot orders, as well as the principle of CEX assistance.

Short positions (shorting) are when investors borrow assets to sell, hoping to buy them back at a low price after the price drops to make a profit.

For example: Assuming the price of $JELLYJELLY is $0.10, the attacker borrows 1 million and sells them, receiving $100,000. If the price drops to $0.05, they buy it back for $50,000 and make a profit of $50,000. But if the price rises to $0.15, they need to buy it back for $150,000, losing $50,000.

Hyperliquid's liquidation mechanism

At Hyperliquid, when a trader's margin is not enough to cover potential losses, the position will be liquidated. According to Liquidations | Hyperliquid Docs, liquidation uses the mark price (combined with the external CEX price and the Hyperliquid order book status) to ensure more robust liquidation. After liquidation, the HLP vault takes over the position and bears the subsequent risks.

Let's take a look at the short selling and spot buying in the previous chapter:

· The attacker's logic: price pressure -- trigger liquidation -- create losses

The attacker opened a $JELLYJELLY short position at $0.0095, and sold the spot to lower the price, making the short position profitable.

The reason why it is so easy to achieve is that the attacker's target is Memecoin $Jellyjelly, which has a depth gap of N times, and price manipulation becomes much easier.

The attacker withdraws most of the margin (such as 2.76 million USDC), making the short position untenable, triggering the liquidation mechanism, and the Hyperliquid vault has to take over this short position.

The key is that the attacker buys $JELLYJELLY at this time, which will raise the price to $0.16. The vault needs to buy back $JELLYJELLY at a higher price to close the short position, which increases the loss.

The principle of CEX assists

CEX launched the $JELLYJELLY perpetual contract, which has an obvious "assist" effect.

CEX has a huge user base and trading volume. After launching the $JELLYJELLY perpetual contract, it attracted a large number of speculators to enter the market. This move significantly pushed up the price of $JELLYJELLY, further exacerbating the short position losses of the treasury.

You can also see from the reply post of the first sister below that CEX's intention to take the initiative to intervene is also very obvious.

Subsequent impact

Although Hyperliquid quickly took action to remove the $JELLYJELLY perpetual contract and did not cause actual losses to the treasury, this incident exposed the vulnerability of DeFi platforms in the face of high-leverage transactions and price manipulation.

More importantly, this incident triggered widespread community doubts about Hyperliquid's liquidation mechanism and decision-making transparency. Users are concerned about whether the platform can continue to maintain the security of funds in similar incidents in the future, and also question whether the platform is truly decentralized.

A post mentioned that the TOP10 deposit addresses provide 15.9% of the funds. If the whale withdraws funds, it will accelerate the vicious cycle and form a "bank run".

Although the loss of funds has not occurred, the loss of reputation may have begun to appear.

Is Hyperliquid a DEX? If so, why can it delist tokens so easily? Is the governance power concentrated in the hands of a few people?

These community doubts reflect the concerns of DeFi users about the transparency of platform governance and community participation, and also pose a new challenge to Hyperliquid: how to balance the contradiction between decentralization and efficiency while maintaining the security of funds.

As a DeFi platform, Hyperliquid relies on community treasury and liquidation mechanisms, but it is vulnerable to the huge trading volume and market influence of CEX. CEX can quickly attract funds and affect prices by listing popular tokens, while DeFi platforms may fall into crisis due to insufficient liquidity and price manipulation.

The mantis stalks the cicada, and the oriole is behind

This is a complex game, and each participant has different motivations and tries to take the initiative in this price manipulation game.

Attackers: Profit-seeking price manipulators

The attackers’ goal is to profit through price manipulation. Aunt Ai’s post shows that the manipulated address holds 124 million $JELLYJELLY (worth $4.86 million), which may be a strategy of selling at a high price after a pull-up. They may imitate the previous 50x leveraged whale operation and take advantage of the price volatility of low-liquidity memecoin.

Hyperliquid: Protecting users and platforms

Hyperliquid strives to protect user funds and platform stability. A community post mentioned that the platform may adjust the leverage ratio of BTC and ETH (to reduce similar risks. In the future, it is necessary to increase margin requirements or improve the liquidation mechanism to protect HLP's community funds.

CEX: "Precision Strike" in Competition

CEX's rapid response and launch behavior is not only a business decision, but also likely to hide competitive considerations.

By quickly launching the $JELLYJELLY perpetual contract, CEX attracted a large number of speculators to the market, pushing up the token price, and indirectly exacerbating the risk of loss in Hyperliquid's vault.

This precise market intervention, on the surface, is a pursuit of profit, but in fact it may be a "precision strike" - by amplifying Hyperliquid's liquidation crisis, it weakens its market competitiveness as a DeFi platform.

From the above motivations, it can be seen that the attackers are not completely dominant. CEX's market strategy has taken advantage of the attackers' behavior to a certain extent, further amplifying their market influence. The identities of hunters and prey are constantly alternating in this multi-layer game, and ultimately a complex network of interests is formed.

For Hyperliquid For the cryptocurrency community, this is not only a crisis of fund security, but also a test of trust.

After all, this is not the first time. Previously, the 50x leveraged big brother also used the Hyperliquid mechanism to "actively liquidate 160,000 ETH long positions" and withdraw $1.857 million in profits...

We cannot predict whether this kind of attack will happen again in the future, but what you can clearly see in this incident is:

There is still a gap between the ideal and reality of decentralization, and more efficient transactions also hide more bloody games.