In a stunning display of market manipulation, one trader executed a sophisticated attack against Hyperliquid’s decentralized exchange that nearly drained its entire $230 million vault just by a single $JELLY short order, revealing critical vulnerabilities in DeFi infrastructure and forcing emergency interventions that have sparked industry-wide debate.
1. The Introduction
Hyperliquid has emerged as one of the most promising decentralized perpetual exchanges in the cryptocurrency ecosystem. Unlike traditional centralized exchanges, Hyperliquid operates on a permissionless protocol that allows users to trade perpetual futures contracts without requiring custody of their assets.
Built on its own Layer-1 blockchain, Hyperliquid has gained popularity for its low fees, deep liquidity pools, and commitment to decentralization principles. The platform’s Hyperliquid Liquidity Pool (HLP) serves as the counterparty to all trades, creating a system where liquidity providers share in trading fees while collectively assuming market risk.
This structure has allowed Hyperliquid to amass a substantial liquidity vault of approximately $230 million, making it a significant player in the decentralized derivatives space.
2. The Context
Jelly-My-Jelly ($JELLYJELLY) is a meme coin launched on January 30, 2025, by Iqram Magdon-Ismail, co-founder of Venmo. Initially, it operated on the Solana blockchain but later deployed on other networks. This cross-chain nature made it particularly interesting for certain trading strategies, as price discrepancies between different blockchain implementations could create arbitrage opportunities.
This token grants early access to the JellyJelly app, which allows users to record and share video chat clips with AI-generated captions and summaries. The token is listed on various major exchanges, including Bitget, Gate.io, Hyperliquid,… providing opportunities for trading.
Prior to the manipulation event, JELLY maintained a market capitalization of approximately $13 million, positioning it as a small but established cryptocurrency. Its daily trading volume typically ranged between $2-5 million across all exchanges, with limited liquidity depth in order books. This relative illiquidity created a vulnerability that would later be exploited.
Notably, on Hyperliquid’s platform, JELLY had been listed without the position limits – a critical oversight in the platform’s risk management framework. The token was trading at around $0.013 per unit with relatively low volatility in the weeks leading up to the incident, giving no indication of the dramatic price action that would soon follow.
3. The JELLY Short Order
The attack began with what appeared to be routine trading activity but was, in fact, a meticulously planned market manipulation strategy.
On March 26, an unidentified trader opened a 6 million JELLY short position with leverage through Hyperliquid’s perpetual futures contracts. At the same time, they began pumping JELLY’s spot price by aggressively buying on-chain through multiple blockchains and decentralized exchanges.
JELLY’s price skyrocketed, showing no signs of slowing down. Trading volume surged to unprecedented levels, with more JELLY changing hands in that hour than in the entire previous week combined. This extreme price movement repeatedly transformed JELLY from a modestly valued cryptocurrency with a market capitalization of around $10 million to one exceeding $50 million.
The sudden surge in price led to a short squeeze, liquidating their own short position on Hyperliquid, forcing the platform’s liquidity pool to inherit an extremely toxic position. The strategy exploited a fundamental vulnerability in Hyperliquid’s liquidation mechanism, which automatically transferred liquidated positions to the Hyperliquid’s Liquidity Pool (HLP) without adequate safeguards for manipulated assets.
4. Hyperliquid’s Dilemma
Following the Hyperliquid’s standard protocol, when a trader’s position is liquidated, the loss doesn’t disappear but will be automatically inherited by the HLP. Under normal circumstances, this mechanism helps maintain market stability while protecting the platform’s liquidity providers. However, in this case, it created an existential threat to the entire ecosystem.
With JELLY’s price continuing its meteoric rise, the HLP found itself holding an enormous toxic short position. The paper losses mounted rapidly, reaching approximately $12 million as the token’s price approached $0.15. More alarmingly, internal analyses revealed that if JELLY’s price reached $0.15374, the entire $230 million Hyperliquid vault would be at risk of insolvency. This could have led to one of the largest DeFi collapses in history.
As Hyperliquid struggled, a newly activated wallet (0x20e8) seized the opportunity, opening a massive long position and securing $8.2 million in profits. The timing was impeccable as soon after, Binance and OKX listed JELLY perpetual futures, fueling market volatility and surging trading activity even more. The orchestrator of the scheme swiftly funneled $7.17 million through three Hyperliquid accounts, ultimately withdrawing $6.26 million while leaving an inaccessible $900,000 balance.
This situation exposed a critical design flaw in Hyperliquid’s risk management system: the absence of circuit breakers or position limits for low-liquidity assets. Without these safeguards, the platform was effectively holding an uncapped liability on a token whose price could be easily manipulated by relatively modest capital deployment.
5. Hyperliquid’s Response
Facing an existential threat, Hyperliquid took decisive action. Its validator group held an emergency meeting and voted to delist JELLY perps, intervening with a rollback to close 392 million of JELLY short positions at $0.0095. As a result, HLP not only avoided a massive loss but also secured a net profit of $703,000. The Hyper Foundation pledged to compensate affected users except for addresses linked to the manipulation.
Following the emergency liquidation, Hyperliquid took the dramatic step of completely delisting JELLY from their platform. This decisive action eliminated any possibility of similar attacks using the same token, while sending a clear message about the platform’s willingness to take drastic measures to protect its liquidity vault.
Throughout the crisis, Hyperliquid maintained transparent communication with its community, providing regular updates about the situation and their emergency interventions. This transparency helped maintain user confidence, though not everyone was pleased. Some criticized the intervention for contradicting the decentralized nature of DEXs.
After evidence of suspicious market activity, the validator set convened and voted to delist JELLY perps.
All users apart from flagged addresses will be made whole from the Hyper Foundation. This will be done automatically in the coming days based on onchain data. There is no…
— Hyperliquid (@HyperliquidX) March 26, 2025
6. Analysis of Vulnerabilities
The attack exposed critical weaknesses in the infrastructure of Hyperliquid. By exploiting these vulnerabilities, the attacker had turned a JELLY short position into a devastating weapon against the platform.
Inadequate Position Limits
The most glaring vulnerability exposed was Hyperliquid’s lack of appropriate position limits for illiquid assets. While position limits existed for major cryptocurrencies, the absence of scaled restrictions for smaller-cap tokens created an exploitable gap in the platform’s risk management framework.
Oracle Vulnerability
The attack highlighted the persistent challenge of oracle reliability in DeFi platforms. Hyperliquid’s price oracles failed to recognize the artificial nature of the JELLY short order and its price movements, treating the manipulated price as legitimate market data. This underscores the ongoing challenge of creating manipulation-resistant price feeds for decentralized trading platforms.
Automated Position Inheritance
Hyperliquid’s automated position inheritance mechanism, while designed to maintain market stability, created a systemic risk when applied to a manipulated asset. The blind transfer of liquidated JELLY short positions to the platform’s liquidity pool, without size-based restrictions or human oversight, created a potential pathway for catastrophic losses.
Absence of Circuit Breakers
Traditional financial markets employ circuit breakers to halt trading during extreme price volatility. The absence of similar mechanisms in Hyperliquid’s protocol allowed the manipulation to proceed uninterrupted. This incident has sparked renewed debate about implementing circuit breakers in DeFi protocols without compromising their decentralized ethos.
7. Industry Implications
The JELLY short sell incident has sparked discussions within the DeFi community about risk management and platform security. Multiple perpetual exchanges have announced reviews of their position limits and liquidation mechanisms, particularly for lower-liquidity assets. This represents a collective acknowledgment that the industry’s risk management frameworks require significant refinement.
Bitget CEO Gracy Chen even compared Hyperliquid to FTX, stating: “Hyperliquid founder has the ability to delist coins, liquidate positions, and more. No different than SBF moving funds around.” This comparison once again highlights the contrast between emergency interventions and DeFi’s core decentralization principles.
Conclusion
The JELLY short incident has raised concerns about Hyperliquid’s liquidation mechanisms, highlighting how whales or institutions can exploit margin systems to manipulate the market. Despite the sophisticated technology underlying these platforms, they remain vulnerable to the same market manipulation tactics that have plagued traditional finance for centuries.
Without stricter risk controls, similar strategies could continue to disrupt derivatives exchanges, posing ongoing challenges for market stability. To stay ahead of risks and navigate the volatility of the crypto market with confidence, follow FMCPAY for the latest news, crypto insights, and expert guidance.