From DEX to CEX in a couple of hours. How Hyperliquid got busted

Hyperliquid positions itself as a decentralized derivatives exchange, but many seriously questioned its decentralization in light of recent events. GetBlock AML Research has looked into the situation and is ready to explain what went wrong. Briefly, the events can be described as follows: someone wanted to put Hyperliquid around the finger, but in the end, they tricked him.

Hyperliquid: the future of liquidity in cryptocurrencies and finance

We talk about the new protocol, how the technology works, and why crypto investors need it

Read more

What happened

An unknown person used three different addresses to open opposing positions on the low-liquidity token JELLYJELLY. Two addresses at $2,1 million and $1,9 million opened longs, while another address at $4 million opened a short position. The manipulator used leverage, which allowed him to reduce collateral on long positions when the price of JELLYJELLY rose more than 400%. This left him with both funds and open orders that already had millions of dollars in unrealized profits.

At the same time, the exchange started the process of liquidating a $4 million short position due to the increase in the price of JELLYJELLY. However, this did not happen immediately, because the exchange runs a special Hyperliquidity Provider Vault (HLP) algorithm to liquidate positions with large volume.

When the manipulator was no longer able to withdraw collateral from long positions, he started taking profits. Hyperliquid noticed this and stopped trading and delisted the JELLYJELLY token. Moreover, it changed the final value of the coin, which was controlled by the “independent” oracle. Before the trading halt, the market price of JELLYJELLY was around $0,5, but the exchange rolled it back to $0,0095. It was at this price that the manipulator opened a short position. Thus, the platform zeroed out all trading activity of the manipulator and left him with a loss of $1 million from long positions.

What is the problem

After the incident, the crypto community immediately had a lot of questions. First of all, such as:

• What oracle is used by Hyperliquid, and why does the exchange have the ability to influence it?
• How is the decentralized platform able to unilaterally cancel trading results?
• Doesn’t this mean that Hyperliquid is actually a centralized exchange?
• Why did the manipulator manage to open volume positions that could exceed the liquidity of the JELLYJELLY token?
• What about other traders whose trading activity was also canceled?

ZachXBT, a well-known researcher in the community, also raised an interesting question. He asked why the exchange did not counteract the laundering of funds stolen from the Radiat protocol, if it had such an opportunity? Hyperliquid has not yet answered these questions and is unlikely to do so.