POPCAT Attack Burns $3M, Triggers $4.9M Loss for Hyperliquid
- A Trader used 19 wallets to manipulate POPCAT, wiping $3M and costing Hyperliquid $4.9M.
- Similar attacks in the past on Hyperliquid involved JELLYJELLY and TST.
- The incident exposed high-leverage risks and liquidity flaws in decentralized markets.
A trader used 19 wallets to manipulate POPCAT’s price on November 12, 2025, draining $3 million in personal funds and inflicting $4.9 million in losses on Hyperliquid’s liquidity vault. The event forced the decentralized exchange to pause deposits and withdrawals as it managed the resulting liquidation.
Trader Uses 19 Wallets to Inflate POPCAT
According to Lookonchain, the trader withdrew $3 million in USDC from OKX and distributed it across 19 wallets. These wallets were used to open long positions worth $125.14 million on Hyperliquid, giving a total exposure of about $26.28 million. The trader placed nearly $20 million in buy orders near $0.21, creating an illusion of strong demand.
Moments later, the orders were canceled, removing the artificial support and leading to a sharp price drop. POPCAT’s value collapsed, causing widespread liquidations across the market.
Hyperliquid’s Hyperliquidity Provider (HLP), which absorbs bad debt from liquidations, took over the failing positions. The HLP ultimately recorded a $4.9 million loss, while the trader’s $3 million collateral was completely wiped out.
Hyperliquid later paused deposits and withdrawals, describing the action as “maintenance.” An administrator known as “iliensinc” confirmed on Discord that the Arbitrum bridge had been temporarily paused, though other operations continued normally soon after.
Attack Linked to Previous Manipulation Cases
Blockchain researcher MLMabc said the event followed a pattern similar to earlier manipulation cases on Hyperliquid. “About 13 hours ago, someone withdrew $3 million from OKX, split it across 19 wallets, and opened large POPCAT longs,” they wrote on X. “When the buy wall was removed, the entire $30 million long position was liquidated within seconds.”
This was not the first incident of its kind. In March, Hyperliquid faced a similar event involving the Solana-based JELLYJELLY token, which left the HLP vault with about $12 million in unrealized losses.
Another attack on TST in August, involving linked wallets, highlighted repeated risks for decentralized exchanges when traders use high leverage on low-volume assets.
The recent POPCAT case again exposed how leveraged trades on small tokens can overload automated safety systems. Blockchain data showed several connected accounts trading in turns to appear like normal activity, but it was a coordinated move to test Hyperliquid’s risk setup.
Related: Berachain Executes Hard Fork, Recovers $12.8M Balancer Hack
Vulnerabilities in DeFi Perpetual Markets
The HLP vault on Hyperliquid acts as a user-funded pool that helps keep the exchange stable when forced liquidations happen. However, when leveraged positions become too large, the vault can absorb heavy losses, as seen in this case.
The platform manually closed the open positions after the liquidation wave to prevent further damage. Following the event, the attacker’s wallets bridged remaining USDC out of Hyperliquid’s ecosystem.
POPCAT dropped 6.8% within 24 hours, while Hyperliquid’s native token, HYPE, fell nearly 2%. The exchange’s quick pause limited broader losses, but it also showed the difficulty of managing risk in decentralized derivatives markets.
Analysts say the incident showed the gap between Hyperliquid’s goals and its current safeguards. Despite its rapid growth, the platform continues to face stress when large, coordinated trades hit low-liquidity markets.
Hyperliquid is one of the fastest growing decentralized exchanges by trading volume, but the POPCAT event renewed scrutiny on whether onchain derivatives systems can maintain stability under extreme conditions.
Meanwhile, the POPCAT incident exposed weaknesses in Hyperliquid’s risk systems, showing how leveraged trading on low-liquidity tokens can strain decentralized platforms. The coordinated attack using 19 wallets showed how manipulation can bypass automated safeguards. Hyperliquid’s next actions will determine confidence in decentralized perpetual exchanges moving forward.
