Is Hyperliquid safe? The incidents, the risks and what we check
The short answer: nobody can promise Hyperliquid is safe, and we will not either. What the record shows, up to 6 November 2026: no confirmed hack of Hyperliquid’s exchange or its bridge, but real money lost in other ways. HLP, the exchange’s protocol vault, owned by its depositors, lost about $11 million across 4 manipulation and liquidation events. Traders lost money to stolen keys and to squeezed markets, and users of 2 apps built on top lost money to those apps. Twice the exchange stepped in by hand: once to close a market, once to pause deposits and withdrawals. And 5 validators run by the Hyper Foundation hold 47.4% of the stake that secures the chain.
Hyperliquid is a decentralized exchange for perpetual futures that runs on its own blockchain, with every order and position public. We run our vault, RockSteady, on it, so we have a stake in the answer. That is why this page gives the record and its sources instead of a verdict.
Key points
- 12 incidents since December 2024, listed below with dates, amounts and sources.
- HLP’s depositors took the manipulation losses: about $11 million across 4 events. HLP still shows about $138.7 million in profit over its life, on 6 November 2026.
- The worst market day, 10 October 2025, closed winning trades early through auto-deleveraging, a last-resort rule that keeps the exchange solvent.
- USDC on Hyperliquid is now issued by Circle itself. The older Arbitrum bridge holds “less than 10%” of it, by Hyperliquid’s docs.
- On 6 November 2026, 27 validators were active. The 5 Hyper Foundation validators held 47.4% of active stake; the top 10 held 76.2%.
Has Hyperliquid ever been hacked?
Not its core exchange or its bridge, as far as any public report shows. Every big loss so far came from 1 of 3 other places:
- Traders gaming thin markets. A trader builds a position too big for the market, often in a small coin, then lets it be liquidated. HLP takes it over and loses money closing it, or other traders are forced out at bad prices.
- Stolen keys. The exchange works as designed, but someone else signs with the trader’s key.
- Apps built on top. HyperEVM, the part of Hyperliquid’s chain where other teams deploy apps, runs code Hyperliquid did not write. A bug in one of them is not a bug in Hyperliquid, but it can still cost a Hyperliquid user money.
When people asked in December 2024 whether hackers had broken in, Hyperliquid answered on its Discord that there had been no exploit “of Hyperliquid” and that “all user funds are accounted for” (The Block). Some outlets later called JELLY an exploit; no code was broken, but a trader took about $6 million out of a gamed market.
Every incident since December 2024
From December 2024 to November 2026, we found 12 incidents where users lost money or the exchange stepped in. HLP lost about $11 million across 4 of them.
| Date | What happened | Who lost money | What Hyperliquid did |
|---|---|---|---|
| 23 December 2024 | Addresses said to be linked to North Korean hackers were seen trading. About $250 million in net withdrawals in a day (The Block) | No exploit was found. The HYPE token fell | Said there was no exploit and all funds were accounted for |
| 12 March 2025 | A trader opened a huge ETH long, pulled out most of the margin and let the rest be liquidated (The Defiant) | HLP, about $4 million | Said there was no exploit, lowered the maximum leverage on BTC and ETH and raised margin requirements for large positions (DL News) |
| 26 March 2025 | JELLY: HLP inherited a large short in a small coin that was then pushed up. Unrealized losses reached about $12 million (The Block) | Traders with open JELLY positions had them closed | Validators voted to delist JELLY and closed every position. Hyperliquid said all users “apart from flagged addresses” would be made whole by the Hyper Foundation. HLP ended the day about $700,000 up |
| 29 July 2025 | Orders were delayed from 14:10 to 14:47 UTC after a spike in traffic to Hyperliquid’s API servers (The Block) | Traders whose orders went through late | Refunded about $2 million in USDC (Cointelegraph) |
| 26 to 27 August 2025 | XPL pre-launch market: large buyers pushed the price about 2.5 times higher in minutes (The Defiant) | Traders betting against XPL were liquidated; reports range from $17 million upward (Forklog) | Capped pre-launch prices against an 8 hour average and said there was no bad debt |
| 26 September 2025 | Hypervault, a yield app that put deposits to work on HyperEVM, went dark after about $3.6 million moved out, most of it into Tornado Cash: a suspected rug pull (The Block) | Hypervault users, about $3.6 million | Nothing; Hyperliquid itself was not affected |
| 27 September 2025 | Hyperdrive, a lending app on HyperEVM, was drained through a bug in its own contracts (The Block) | Hyperdrive users, about $782,000 | Nothing; Hyperliquid itself was not affected |
| 10 October 2025 | A market-wide crash with record liquidations. Hyperliquid’s cross-margin auto-deleveraging ran for the first time in over 2 years (WuBlockchain) and closed about $2.1 billion of positions (research paper) | Traders in profit whose positions were closed early; the same paper estimates auto-deleveraging took $45 million to $52 million more from them than needed. HLP gained an estimated $40 million (CoinGecko) | No bad debt; the rules ran as written |
| 10 October 2025 | A trader’s private key was stolen (The Block) | That trader, about $21 million | Nothing; it was not a flaw in Hyperliquid |
| 12 November 2025 | POPCAT: a trader built a large long across many wallets, then let it collapse (The Block) | HLP, about $4.9 million | Paused deposits and withdrawals the same day; an on-chain analyst linked the pause to POPCAT and said Hyperliquid closed the position by hand |
| 9 April 2026 | FARTCOIN: 4 linked wallets built a $15 million long, then let it be liquidated in a thin market (Forklog, citing PeckShield) | HLP, about $1.5 million | No public statement found |
| 1 November 2026 | XPL fell about 20% and set off a chain of long liquidations (PANews) | HLP, about $556,000, read from Hyperliquid’s own data for HLP’s liquidator vault | No public statement found |
Amounts are as reported at the time and some sources disagree; the links go to the report we used. HLP’s figure for 1 November 2026 comes from Hyperliquid’s public data for HLP’s liquidator vault, and matches the PANews report.
Who carries the loss?
Who carries a loss on Hyperliquid depends on where your money sits: HLP, a user vault or a plain account.
- HLP depositors carry the manipulation losses. HLP takes over positions that cannot be closed on the order book; Hyperliquid’s docs call this backstop liquidation (Hyperliquid docs). When a trader games a thin market, the loss lands there. HLP’s 4 losses above add up to about $11 million. Its lifetime profit is about $138.7 million on about $150.9 million held, read on 6 November 2026.
- Traders in profit carry the crash risk. If an account goes below zero, Hyperliquid closes the opposite positions of traders in profit, starting with the most profitable and most leveraged, “at the previous mark price” (Hyperliquid docs). You keep your profit up to that price, but lose the rest of the move. A user vault with open positions can be hit like any trader.
- An account with no open positions, outside any vault, carries neither. The docs state “a user who has no open positions will not socialize any losses of the platform.”
- The exchange can step in. Validators closed the JELLY market by vote, and in November 2025 Hyperliquid paused deposits and withdrawals for a short time. Both were decisions people made, not code running on its own.
How decentralized is Hyperliquid?
On 6 November 2026, 5 Hyper Foundation validators held 47.4% of Hyperliquid’s active stake, enough to stop a block but not to make one. Hyperliquid’s chain runs on HyperBFT, a version of HotStuff consensus, where validators produce blocks “in proportion to the native token staked” to them (Hyperliquid docs). We read the full validator list from Hyperliquid’s public API on 6 November 2026:
| 6 November 2026 | |
|---|---|
| Validators registered | 35 |
| Active | 27 |
| Jailed | 6 |
| Share of active stake, 5 Hyper Foundation validators | 47.4% |
| Share of active stake, top 10 validators | 76.2% |
Hyperliquid’s docs define a quorum as “any set of validators that has more than ⅔ of the total stake”, and consensus needs a quorum to agree (Hyperliquid docs). On that rule, the Foundation alone cannot push a block through, but its 47.4% is enough to stop one. That is a reason to watch the Foundation’s share over time, not a sign that anything is wrong today.
Is the bridge still the big risk?
The Arbitrum bridge is a smaller risk than it was: Hyperliquid’s docs say it now holds less than 10% of USDC on HyperCore, since Circle mints USDC natively. Many older guides describe Hyperliquid’s USDC as money held in a bridge contract on Arbitrum. Hyperliquid’s docs now say “USDC is natively minted on the Hyperliquid L1”, by Circle, the company that issues USDC, and that “the legacy Arbitrum bridge holds less than 10% of the USDC supply on HyperCore” (Hyperliquid docs). Circle launched native USDC on Hyperliquid in September 2025, starting with HyperEVM (The Block).
The old bridge was audited by Zellic (Hyperliquid docs), and Hyperliquid runs a bug bounty for its nodes and API servers. Native USDC moves the trust to Circle, which is a different risk, not no risk.
Where people actually lose money
For most people the bigger losses are quieter than the incidents above: a losing strategy, a stolen key or a failed app.
- The strategy loses. Of the 3,063 vaults open on Hyperliquid on 30 October 2026, only 19.5% showed a profit over their whole life. Our guide to Hyperliquid vaults has the full count.
- The key is stolen or phished. The $21 million theft above needed no flaw in Hyperliquid. Fake sites and fake ads copy app.hyperliquid.xyz to collect recovery phrases.
- The app on top fails. Hypervault’s and Hyperdrive’s users lost money on HyperEVM while Hyperliquid itself ran normally.
What we check on our own vault
We run RockSteady as a public legacy vault on Hyperliquid. Here is what we watch, and what we cannot.
- Every hour, a script records each deposit into and withdrawal from the vault, read from Hyperliquid’s public data.
- Every day, we check the leader’s own share of the vault, now about 7%, against Hyperliquid’s 5% minimum.
- Every week, we count Hyperliquid’s full public vault list, HLP included. Our census of 9,478 vaults came from that count.
- On 6 November 2026, we read all 835 of RockSteady’s order fills since 3 February 2026. None was a liquidation and none was closed by auto-deleveraging.
What we cannot check: Hyperliquid’s own code, how its validators behave, or what Circle does with USDC. RockSteady depends on all 3, like every vault on Hyperliquid. You can check the vault yourself on our check page, and its returns and deepest fall are on our live record.
A checklist before you deposit on Hyperliquid
- Type the address yourself. Bookmark app.hyperliquid.xyz and never sign in from an ad or a direct message.
- Never share your recovery phrase. No real exchange, vault or support team needs it. A hardware wallet keeps the key off your computer.
- Know which risk you hold. HLP carries the manipulation losses above. A user vault carries its leader’s strategy, plus auto-deleveraging on its open positions.
- Look at what the vault trades. 3 of the 4 HLP losses above came from small, thinly traded coins. Prices in thin markets can be pushed hard, and a vault trading them can be caught by the same moves.
- Test the exit. Withdraw a small amount after the lockup (1 day for user vaults, 4 days for HLP) before you add more. Our post on legacy vaults explains the withdrawal rules.
FAQ
Is Hyperliquid safe? No exchange is safe in every sense, and the record shows where Hyperliquid’s risks sit: 12 incidents since December 2024, about $11 million lost by HLP, no confirmed hack of the exchange or its bridge, and validators where the Hyper Foundation holds 47.4% of active stake.
Is Hyperliquid legit? It is a real exchange with a public record: every trade, vault, deposit and validator can be read from its public data. Being legit is not the same as being safe; every incident on this page happened on a legit exchange.
Has Hyperliquid been hacked? No hack of its core exchange or bridge had been confirmed by 6 November 2026. Traders have lost money to stolen keys. Users of 2 apps built on HyperEVM lost money to those apps: about $3.6 million in the suspected Hypervault rug pull and about $782,000 to a bug in Hyperdrive.
Can Hyperliquid freeze my funds? It has paused deposits and withdrawals before, on 12 November 2025, and its validators closed every JELLY position by vote in March 2025. Money on the exchange runs under its rules and its validators.
Is HLP safe? HLP carries the exchange’s backstop risk, so it took every manipulation loss on this page: about $11 million across 4 events. Over its life it shows about $138.7 million in profit, on 6 November 2026. It has a 4 day lockup.
Does an HLP loss hit my user vault? No. HLP’s losses are paid by HLP depositors. A user vault has its own money and positions; the platform risk it shares is auto-deleveraging on its open positions.
What happens if Hyperliquid goes down? Orders can be delayed and positions can move against you while you cannot act. After the 37 minute delay on 29 July 2025, Hyperliquid refunded about $2 million to affected traders, but it is not obliged to do so.
Is Hyperliquid safer than a centralized exchange? The risks are different. Your USDC is not held by a company that can lend it out, and every trade is public. In return, you look after your own key, and the exchange’s rules, validators and apps on HyperEVM become your risks instead.
Sources
- Hyperliquid docs: Liquidations, Auto-deleveraging, Overview, Staking, USDC, Audits, Bug bounty program, Protocol vaults (opened 6 November 2026)
- Incidents: the reports linked in the table, read on 6 November 2026. Where sources give different amounts, we used the figure most reports agree on.
- HLP: Hyperliquid’s public API (
vaultDetailsfor vault 0xdfc24b077bc1425ad1dea75bcb6f8158e10df303), 6 November 2026. HLP’s lifetime profit and account value come from its history there; the loss on 1 November 2026 comes from HLP’s liquidator vault (0x5e177e5e39c0f4e421f5865a6d8beed8d921cb70). - Validators: Hyperliquid’s public API (
validatorSummaries), 6 November 2026. Shares are of the stake held by active validators. - RockSteady: Hyperliquid’s public API (
vaultDetailsand the vault’s trade history), 6 November 2026. Vault and leader addresses are on our check page. - Vault counts: our own count of Hyperliquid’s public vault list (stats-data.hyperliquid.xyz/Mainnet/vaults), 30 October 2026.
How this was made: written by NuWealth with AI assistance from the sources above, and checked by the NuWealth team. Past results are not a promise of future results; see our Risk Disclaimer.