How we report incidents

• Every item is our own short text: who, what, when, amount, chain, status, and a link to the evidence or the primary source.
• Facts come from primary sources: the protocol's post-mortem or official account, on-chain transactions, official exchange or Hyperliquid announcements, governance posts.
• We do not copy headlines, teasers or images of other publishers. News outlets may appear only as a "coverage" link, without text.
• Every number in a curated text must match an approved fact; drafts with other numbers are rejected by the system.
• Detector items say "pattern", "possible" or "inferred" when they are. They never claim an exploit or a manipulation happened.
• We do not attribute fault beyond what the primary sources say. Corrections: report incorrect data.

listings

Hyperliquid listings, delistings, max-leverage and isolated-only changes, from comparing the market list every 30 s; open-interest caps every 10 min.

manipulation pattern

Modelled on the JELLY incident (March 2025): a market with $1M–$100M open interest, open interest up 50 % and price moved 30 % within 60 min, and concentrated exposure (HLP ≥ 10 % of open interest or ≥ $500K unrealised loss, or one tracked wallet ≥ 25 %).

possible ADL

≥ 3 tracked wallets cut profitable positions on one side by ≥ $5M within 10 min while ≥ $5M of the other side was liquidated. Inferred from position polls; profit-taking looks the same.

oracle deviation

Hyperliquid mark ≥ 2 % from its oracle, or the oracle ≥ 3 % from the median perp price of the enabled exchanges, on 2 consecutive checks.

vault drawdown

HLP cumulative PnL down ≥ 2 % of its account value (and ≥ $3M) within its 24 h window; deposits and withdrawals do not count.

liquidation surge

≥ $200M of reported liquidations across all coins and venues within 15 min.

depeg

Stablecoin/USD answers of 16 Chainlink feeds read on-chain (Ethereum, Arbitrum, Base), at least 0.5 % from $1 on two checks; stale rounds and a down L2 sequencer are ignored.

protocol outflow

Net outflow ≥ $20M and ≥ 10 % within 60 min from 14 bridge and lending contracts whose addresses we took from each protocol's own documentation. Large withdrawals look the same as an exploit.

Listed wallets are addresses that an official source names. We take them from three sources only, never from community lists, explorer tags or other data providers:

OFAC SDN list

Every digital currency address on the U.S. Treasury's sanctions list, read again every day. An address the list no longer contains is delisted automatically and disappears from our pages. The date we show is the first SDN list in which we saw the address, not necessarily the day it was designated. We store the address, its entry number and the sanctions program, never a name.

FBI / IC3

Addresses listed in an FBI public service announcement, each reviewed against the announcement and quoted in its own words (for example "operated by or closely connected to North Korean TraderTraitor actors").

Official post-mortems

Addresses that the affected project's own post-mortem names as the attacker's, entered by an editor for one incident and public only after the incident is reviewed and published.

• Every listing reads "Listed as <category> by <source>, <date>" with a link to the source. The listing is the source's statement, not our judgement, and we never name a person.
• A wallet that receives funds from a listed wallet is never labelled: it "received funds from a listed wallet", nothing more. Exchanges and bridges keep only the labels from their own published lists.
• Tracked: every ERC-20 token on Ethereum, Arbitrum and Base, native ETH on Ethereum and Bitcoin outputs. Tron and the other listed networks are shown but not tracked.
• Tokens outside our verified list are shown as "unverified" and never priced; their symbol is the token's own claim. Values use the same prices as the rest of the site, at the time of the move.
• Tracking starts when an address is listed with us; earlier history is not filled in.
• Corrections and removals: report a wrong listing. An editor checks the source and removes the listing when it does not hold.

An editor pastes primary-source links. The system fetches them (respecting robots.txt), finds dates, amounts, chains and transactions, and shows each with the sentence it came from.

The editor approves the facts; the text is built from those facts only. An optional AI rewrite works on the approved facts alone and is never published without review.

Only from public-domain regulators (U.S. SEC, U.S. CFTC), shown as our own one-line summary with the source and a link. Commercial news sites and exchange announcement APIs are excluded by their terms (data sources).