Incident Review: One Whale vs Hyperliquid's Entire Treasury – How $4 Million Vanished
TechFlow Selected TechFlow Selected
Incident Review: One Whale vs Hyperliquid's Entire Treasury – How $4 Million Vanished
Rules are key.
Navigating Web3 tides with focused insightsAuthor: Three Sigma
Translation: TechFlow
A trader vs. Hyperliquid's HLP treasury.
$4 million in losses.
No bug, no attack—just the brutal game of liquidity mechanics.
Here’s what happened:
What Happened?
A trader used high leverage to turn 10 million USDC into a $271 million long ETH position, then withdrew their collateral, forcing HLP (Hyperliquid Liquidity Provider) to take over the position.
The trader ultimately profited $1.8 million, while HLP suffered a $4 million loss.
Let’s break down how this unfolded.
Step One: Positioning
If you're executing a large trade, you face a problem: how do you exit without moving the market against yourself?
Market sell = slippage = ruined profitability.
This trader found a way to fully exit their position without bearing the cost themselves.
Step Two: The Withdrawal Move
Instead of selling ETH through the order book, the trader withdrew their collateral and reduced margin, forcing Hyperliquid to liquidate their position.
HLP—the protocol’s liquidity treasury—was forced to absorb the $286 million long ETH position, exposing it to massive risk.
Step Three: Perfect Short Hedge
The trader anticipated that HLP’s forced selling would drive down ETH prices, so they executed a dual strategy.
By hedging on another exchange (such as Binance), they shifted the long exposure onto HLP while profiting from their own short positions.
This wasn’t luck—it was a meticulously planned maneuver.
Was This Exploitation?
Hyperliquid says no. Unlike GLP, HLP isn't obligated to accept every liquidation, and other market makers also participated in the process.
HLP “only” lost $4 million—roughly one month’s profit—and the system remained intact. The treasury remains net profitable overall.
Why Did HLP Lose $4 Million?
HLP isn’t a single pool; it consists of three components:
1️⃣ HLP Liquidators – entities that acquire liquidated positions
2️⃣ HLP Strategy A – $145 million short ETH position
3️⃣ HLP Strategy B – $145 million short ETH position
On the user interface, only the net position is visible.
When the large position was liquidated:
HLP Liquidators ended up holding a $290 million long ETH position
Strategies A and B provided short-side hedging
However, imperfect price matching during execution resulted in $4 million in slippage losses.
This wasn’t socialized loss-sharing—it was slippage incurred during real-time trading operations.
Hyperliquid Isn’t New to These Incidents
In June 2023, an attacker manipulated SNX prices on centralized exchanges (CEX) to extract $37,000 in USDC from HLP.
HLP had to quickly adjust its pricing model to defend against future attacks.
Will This Happen Again?
Hyperliquid has taken the following measures:
Maximum leverage reduced to 40x (BTC) and 25x (ETH)
Higher margin requirements for large positions
More HLP risk adjustments coming in the future
The deeper question remains: when the smartest traders are always one step ahead, should protocols still rely on traditional liquidation mechanisms?
Final Takeaway: Rules Are the Game
This wasn’t a code exploit, but it was certainly a mechanism exploit.
Traders won’t break smart contracts—but they will exploit rulebooks to shift losses onto protocols.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@threesigmaxyz
