The Hyperliquid ecosystem has been shaken by two major incidents within 48 hours, raising fresh doubts about the security of its rapidly growing DeFi landscape.
On September 27, Hyperdrive confirmed that two user wallet positions in its Treasury Market were compromised in an attack that drained around $700,000. The announcement came just one day after HyperVault, another Hyperliquid-based protocol, disappeared in what appears to be a $3.6 million rug pull.
Hyperdrive revealed that attackers abused its operator permission system, where some users had allowed the platform’s Router to act with broad contract-calling powers. By exploiting this setup, the perpetrators gained the ability to trigger arbitrary calls to the Market contract and empty targeted positions. As a precaution, Hyperdrive has now paused all money markets while investigations continue. The team has emphasized that the thBILL product and the $HYPED token remain unaffected, attempting to reassure investors amid the fallout.
The sense of déjà vu for Hyperliquid users is hard to ignore. On September 26, blockchain security firm PeckShield flagged suspicious transfers from HyperVault, which quickly escalated into one of the largest rug pulls on the network to date. Roughly $3.6 million in user deposits were bridged to Ethereum, swapped for ETH, and then sent to Tornado Cash – a common tactic used to obscure stolen funds. Soon after, HyperVault’s website went offline and its social accounts were deleted, leaving the community to conclude that the project had vanished with investor funds.
These developments follow a troubling pattern. Earlier this year, Hyperliquid-linked projects were also hit by the JELLYJELLY manipulation in March and the XPL exploit in August. While Hyperliquid itself has not been directly compromised, the series of incidents has tarnished sentiment and shaken confidence in protocols built on top of it. Some observers now suggest that the ecosystem may be facing a broader campaign of targeted attacks, given the rapid succession of high-profile losses.
Community reaction has been swift. On social platforms, affected users and whales alike are demanding clarity on whether any recovery is possible. Others are calling for stricter safeguards and auditing standards to prevent similar failures, arguing that unchecked innovation is putting billions in user deposits at risk.
With HyperVault effectively gone and Hyperdrive still scrambling to contain the damage, investors are left wondering whether these shocks are isolated events – or an early warning sign of deeper vulnerabilities that could define Hyperliquid’s future.
