By Frank, PANews

Hyperliquid's HYPE token hit a new high on August 27th, just one day after a carefully orchestrated "flash short squeeze" ravaged the XPL pre-market futures market on Hyperliquid. In less than an hour, the price chart was violently pulled into a near-vertical drop, instantly depleting the accounts of countless short traders while the manipulators walked away with a massive profit exceeding $46 million.

This incident quickly sparked a furor in the crypto community, with outcry, anger, and conspiracy theories mingling. People couldn't help but wonder: Was this a random occurrence of extreme market volatility, or a precisely targeted massacre exploiting a protocol vulnerability? And why, at the center of this storm, has Hyperliquid repeatedly become the perfect hunting ground for the nefarious activities of whales?

A long-planned "hunt"

This seemingly sudden market crash was actually a carefully planned hunt.

According to Aiyi's on-chain data tracking, this coordinated attack was carried out by at least four core wallet addresses. The roles and fund deployment of two primary attack addresses are particularly clear: one is an address beginning with 0xb9c0, and the other is an address on DeBank under the username "silentraven." The remaining two addresses played supporting roles. These wallets displayed similar operational behavior. Between the 23rd and 25th, three addresses transferred large amounts of funds to initiate long positions on XPL. Among them, address 0xb9c0, the primary attack address, preemptively deployed $11 million in USDC to open long positions on XPL on Hyperliquid at an average price of around $0.56.

The address of DeBank username "silentraven" also established a long position of 21.1 million XPL using $9.5 million in USDT at an average price of $0.56 over the past three days.

These addresses invested a combined total of over $20 million, acquiring substantial long positions in batches and at different times within nearly the same price range. Several of these addresses clearly only invested in long positions in XPL after their creation.

At around 5:30 am on August 26, when most traders in Asia were still asleep, the hunting moment quietly arrived.

The 0xb9c0 address transferred an additional $5 million to the Hyperliquid platform. This indiscriminately pumped up the token's price. In the already extremely thin pre-market for XPL, this capital injection was like a spark in a powder keg, instantly detonating the entire order book. Within minutes, the price of XPL skyrocketed from around $0.60 to $1.80, a surge of over 200%.

This short-term surge has several obvious consequences. First, most traders won't have time to increase their margin to raise the liquidation price. Second, even hedging orders with a minimum leverage of 1x will be liquidated. Third, as many short positions are liquidated one by one, forced liquidation buy orders will further drive prices higher, creating the most terrifying "short squeeze" phenomenon in the financial market.

Finally, when the price reached its peak, the manipulators began to close their positions at prices between $1.1 and $1.2. According to Aunt Ai’s statistics, this sniping operation brought the manipulators a total profit of over $46 million.

The $60 million wail and the platform's "indifference"

A feast of capital is inevitably accompanied by the wailing of another group of people. When the manipulators return with a full haul, all that is left for other market participants are bloody losses and endless questions.

Crypto KOL @Cbb0fe said that he allocated 10% of his funds to hedge on Hyperliquid, resulting in a loss of $2.5 million. He will never touch the isolated market again.

Other media outlets reported that the largest loss at a single address was approximately $7 million. However, they did not provide specific address information, raising questions.

However, judging from the profits of the manipulators, the maximum profit at that time was indeed more than 46 million US dollars, and it is not yet known whether there were other undiscovered partners in this process.

Judging from the changes in contract positions, before the attack began, the contract holdings of XPL on Hyperliquid reached a maximum of US$153 million, and then quickly plummeted to 22.44 million, with a reduction of more than US$130 million. It is estimated that the overall losses of short position users may reach US$60 million.

This loss even surpassed the $11 million in losses Hyperliquid in March caused by the JELLY token scam. Perhaps because the company itself wasn't directly affected, the victims had to swallow their losses in silence.

In community discussions, a familiar name was repeatedly mentioned: Tron founder Justin Sun. One user pointed out that an address involved in this attack had transferred ETH to an address associated with Justin Sun several years ago, but this action does not directly prove that the address has an actual connection with Justin Sun.

Following the incident, many users turned to Hyperliquid, hoping the platform would provide an explanation or provide remedial measures. However, Hyperliquid did not drastically close profitable orders or directly shut down related accounts, as it did in March when handling the JELLY token manipulation incident. Instead, they responded in their official Discord group, stating that while the XPL market experienced significant volatility, Hyperliquid's blockchain operated as designed during this period without any technical issues. Liquidation and automatic deleveraging (ADL) mechanisms were implemented in accordance with public protocols, and because the platform utilizes a fully segregated margin system, this incident only affected XPL positions, and the protocol did not generate any bad debts.

For many netizens, the lack of adjustments is understandable. After all, Hyperliquid warned of high volatility and risks when XPL launched, and all such manipulation was carried out within market rules.

But for those users who have been deeply affected, such a response seems somewhat cold.

Cause of the tragedy: a fatal conspiracy between platform, target and timing

Looking back at the entire incident, this isn't the first time Hyperliquid has engaged in similar market manipulation. This process is clearly the result of premeditated and meticulous planning by the manipulators. Furthermore, it's also closely linked to the design of Hyperliquid's platform.

First, this type of short squeeze is not uncommon in financial markets and often occurs in markets with poor liquidity and isolated prices. This particular operation on Hyperliquid capitalizes on several key features. First, the platform's extreme on-chain transparency allows manipulators to calculate the funds needed to manipulate the market and the desired effect using publicly available data such as positions, liquidation prices, and funding rates. Second, Hyperliquid's isolated oracle system. Because XPL utilizes an independent pricing system on Hyperliquiquid, independent of external oracles, manipulators can freely manipulate prices within this siloed environment without having to worry about price balancing on other exchanges.

Furthermore, the selection of the target for manipulation also involves numerous tricks. The XPL token (and WLFI, another similar but less dramatic example) involved in this manipulation are both unlisted tokens. This means they are "paper contracts" without the risk of spot delivery or market manipulation, making them easier to manipulate.

Finally, there's the matter of timing. Before the attack, XPL's trading volume was only a few hundred thousand tokens per five minutes, translating to approximately $50,000 USD. This coincided with the period of declining trading enthusiasm following the launch of the cryptocurrency. This thin liquidity provided an opportunity for the attacker to exploit, enabling market manipulation with minimal capital.

The XPL incident exposed deep-seated structural risks, reminding us to reflect on both the platform and user levels.

From the platform's perspective, the first issue is vulnerability. Since 2025, Hyperliquid has experienced three market manipulation incidents. Each incident almost always reveals vulnerabilities within Hyperliquid as a decentralized derivatives exchange. These vulnerabilities have repeatedly resulted in the loss of funds for ordinary users and a weakening of the Hyperliquiquit platform's credibility. In this case, the issue stemmed from both the siege created by an isolated oracle mechanism and price suppression caused by a lack of proactive platform liquidity intervention when unusual positions emerged.

Secondly, is it more important to confront the perpetrators equally or to maintain a decentralized facade? In the JELLY incident, Hyperliquid unhesitatingly initiated an on-chain vote, ultimately recovering losses and expelling the perpetrators. The rationale at the time was that they were forced to take actions that undermined decentralization in order to protect the platform's user vaults. However, facing losses far exceeding those of the previous incident, is this because the platform's vaults were intact, or is it a choice to ignore the situation to prevent the banner of decentralization from falling again? This may raise a major question in the minds of users.

Finally, for users, the XPL manipulation incident has once again heightened our vigilance against illiquid and isolated markets. Pre-market contracts with extremely low liquidity and lacking a spot market anchor are often the hunting grounds of whales. Furthermore, the time-honored trading principles of reducing leverage and setting stop-loss orders are never empty words.