Hyperdrive exploit on 2025-09-27
Exploit on Hyperliquid, 27 Sep 2025. Last verified 4 Nov 2026.
notable
Reported loss
Not stated
no amount published
Recovered
-
nothing reported
Status
Unknown
updated 26 Oct 2026
Date
Hyperliquid
Summary
On 2025-09-27 an attacker abused the general call action of the Hyperdrive Router, an approved operator, to act directly on the lending protocol's market contracts, borrowing against user accounts and withdrawing collateral from its Primary and Treasury USDT markets. The team paused all markets, bricked the Router and remediated affected user balances; no loss figure is stated in its disclosure.
- Protocol
- Hyperdrive
- Type
- Exploit
- Reported loss
- not stated
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | September 27, 2025 | paragraph.com ↗ |
| Cause | Router CALL action combined with the Address Registry let the attacker act as an authorized operator | paragraph.com ↗ |
| Impact | borrowing against user accounts and withdrawing thBILL collateral | paragraph.com ↗ |
| Response | markets paused, Router bricked, user balances remediated | paragraph.com ↗ |
| Remediation | balance and position remediation for impacted users | paragraph.com ↗ |
Primary sources
- Hyperdrive: Incident Disclosure, September 27, 2025 ↗ post-mortem · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram