After Hyperdrive was attacked with a $700,000 vulnerability, what was revealed behind it?

Event Review

The Hyperliquid ecosystem has encountered another issue. The DeFi protocol Hyperdrive was attacked in the early hours of September 27, with improper configuration of the routing contract's operational permissions allowing hackers to manipulate collateral positions, directly stealing 673,000 USDT and 110,000 thBILL tokens. The team reacted relatively quickly, announcing on September 29 that they had compensated all users and restored trading, but this marks the second major security incident in the Hyperliquid ecosystem in recent times.

Attack Link Analysis

The stolen funds have been traced to the Ethereum and BNB chains, with some laundered through Tornado Cash. This breach is typical—the routing contract was granted excessive permissions during the lending process, allowing hackers to make arbitrary calls to whitelisted contracts. The vulnerability was patched within hours after confirmation, but market confidence has already been damaged.

Ecological Hazards Emerge

This is already the second major incident in the Hyperliquid ecosystem this year:

• The $3.6 million rug pull before HyperVault
• The $700,000 vulnerability in Hyperdrive now

The deeper issue is that the number of Hyperliquid verification nodes is limited, amplifying centralization risks. Additionally, security audits seem to lag behind the pace of project iterations, gradually exposing the vulnerabilities of the DeFi ecosystem.

Future Trends

Hyperdrive claims to strengthen security audits and continues to advance the tokenization of U.S. Treasury bonds (in collaboration with Theo Network). At the same time, Hyperliquid's native stablecoin USDH has just been launched, and whether this new asset can alleviate market skepticism remains to be seen.