{"investigation":{"slug":"hyperdrive-hl","entity_name":"Hyperdrive HL","trust_score":51,"severity_base":52,"score_modifier":-1.4,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Hyperdrive HL (formerly Ambit Finance) is a stablecoin lending and liquid-staking protocol deployed on Hyperliquid EVM, which raised a $6 million Series A in May 2025 led by Hack VC and Arrington Capital. On September 27, 2025, an attacker exploited an arbitrary-call vulnerability in the protocol's router contract, draining approximately $782,000 in USDT0 and thBILL tokens across two markets. The team paused operations, patched the vulnerability, and compensated affected users before resuming, though the incident occurred within a broader wave of security breaches across the Hyperliquid ecosystem.","sections":[{"content":"Hyperdrive HL, formerly known as Ambit Finance, is a decentralized stablecoin money market and liquid-staking protocol built on Hyperliquid EVM (HyperEVM). The protocol describes itself as a high-performance lending platform offering real-time leverage, dynamic interest rates, and capital-efficient yield strategies. Core products include a stablecoin lending market, HYPED liquid staking for the HYPE token, tokenization of HLP (Hyperliquid Liquidity Provider) vault positions, and one-click automated yield strategies. The protocol launched on May 27, 2025, following a $6 million Series A funding round closed on May 24, 2025, led by Hack VC and Arrington Capital, with participation from Delphi Ventures, SIG, Amber Group, CMS Holdings, Proof Group, Caladan Group, and Breed VC. A separate community funding round of $1 million on Echo sold out in under one minute. The project is operated by Ambit Labs and maintains its contracts in a public GitHub repository at github.com/ambitlabsxyz. As of late 2025, total value locked (TVL) stood at approximately $1.71 million with active loans of $475,316.","heading":"Protocol Overview","sources":[{"url":"https://www.cmointern.com/2025/05/hyperdrive-secures-6m-series-led-by.html","name":"cmointern.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/hyperdrive-hl","name":"defillama.com","type":"other","credibility":3},{"url":"https://x.com/hyperdrivedefi/status/1925944813427302528","name":"x.com","type":"other","credibility":3},{"url":"https://hyperdrive-2.gitbook.io/hyperdrive/for-developers/security-audits","name":"hyperdrive-2.gitbook.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 27, 2025, an attacker exploited a critical vulnerability in Hyperdrive HL's router smart contract, draining approximately $782,000 in user funds. Blockchain security firm CertiK identified the technical flaw, stating the attacker 'repeatedly exploited an arbitrary call in the router to take users' funds of 672,934 USDT0 and 110,244 thBILL.' The vulnerability stemmed from excessive operator permissions: users who had granted the Router contract broad operator-level access to interact with whitelisted protocols inadvertently enabled the attacker to manipulate collateralized positions and execute arbitrary function calls, draining targeted accounts. The attack affected two markets specifically: the Primary USDT0 Market and the Treasury USDT Market (which held Theo Network Treasury Bill tokens as collateral). The stolen assets were bridged off-chain via the deBridge cross-chain protocol, with approximately $494,000 moved to Ethereum and $279,000 to BNB Chain, where funds were later traced as having been partially routed through Tornado Cash. The Hyperdrive team announced on X that they had paused all markets, identified the root cause, and fixed the vulnerability within hours of discovery. On September 29, 2025, the team confirmed all affected accounts had been remediated and that normal market functions had been restored. The team also stated that the exploit was attributed to 'a known threat actor previously linked to high-profile protocol exploits,' though no specific wallet address or identity was publicly disclosed.","heading":"September 2025 Router Contract Exploit","sources":[{"url":"https://x.com/CertiKAlert/status/1972117426893738341","name":"x.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/372662/hyperliquid-based-hyperdrive-loses-782000-after-smart-contract-exploit","name":"theblock.co","type":"other","credibility":3},{"url":"https://crypto.news/hyperliquid-hyperdrive-resumes-services-700k-hack-2025/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/hyperdrive-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://coincentral.com/hyperdrive-loses-782000-in-tokens-after-smart-contract-exploit-attack/","name":"coincentral.com","type":"other","credibility":3},{"url":"https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/","name":"cryptonews.com.au","type":"other","credibility":3}],"severity":"medium"},{"content":"The Hyperdrive exploit occurred within a concentrated period of security incidents across the Hyperliquid ecosystem. On September 26, 2025, the day before the Hyperdrive exploit, HyperVault — a separate Hyperliquid-based protocol — suffered an alleged $3.6 million loss in what multiple outlets described as a suspected rug pull, with project websites and social media going dark afterward and funds traced to Ethereum via Tornado Cash. The Hyperdrive exploit on September 27 was characterized by CryptoNews Australia as the 'third major Hyperliquid security breach.' Earlier in 2025, the broader Hyperliquid platform had already suffered two major market manipulation attacks resulting in a combined approximately $16 million in losses. Investor Arrington Capital, which participated in Hyperdrive's Series A, subsequently published a post-incident commentary titled 'Hyperliquid's Tipping Point: Three Things They Must Do Now,' addressing systemic security weaknesses across the Hyperliquid ecosystem. The repeated concentration of exploits within a single week raised questions among analysts and commentators about operational security standards across protocols building on Hyperliquid's infrastructure.","heading":"Hyperliquid Ecosystem Security Context","sources":[{"url":"https://www.ainvest.com/news/exploit-days-exposes-hyperliquid-security-weaknesses-2509/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/","name":"cryptonews.com.au","type":"other","credibility":3},{"url":"https://www.ccn.com/news/crypto/hackers-hit-hyperliquid-twice-stolen-hyperdrive-exploit/","name":"ccn.com","type":"other","credibility":3},{"url":"https://www.arringtoncapital.com/blog/hyperliquids-tipping-point-three-things-they-must-do-now/","name":"arringtoncapital.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to and following its May 2025 launch, Hyperdrive HL commissioned multiple security audits across its three main product lines. For its lending protocol, audits were conducted by Kiki (February 2025), Bailsec (March 2025), and Obsidian (May 2025). For its HYPED liquid staking product, audits were conducted by Enigma Dark (April 2025), Bailsec (August 2025), and Enigma Dark (August 2025). For its HLP Vault Tokenization product, Bailsec conducted three audits (February 2025, July 2025, and a July 2025 revision). Several early audits were preceded by code refactors that addressed architecture changes, meaning their coverage was superseded before launch. The exploit of September 27 occurred despite this audit history, indicating the router arbitrary-call vulnerability was not identified or remediated during the pre-launch review process. The audit reports for the lending protocol are publicly available in the GitHub repository at github.com/ambitlabsxyz/hyperdrive-audits. No public bug bounty program was identified for Hyperdrive HL at the time of the incident, in contrast to DELV's separate Hyperdrive protocol on Ethereum which maintained a Cantina bug bounty.","heading":"Security Audits and Pre-Launch Risk Assessment","sources":[{"url":"https://hyperdrive-2.gitbook.io/hyperdrive/for-developers/security-audits","name":"hyperdrive-2.gitbook.io","type":"other","credibility":3},{"url":"https://www.theblock.co/post/372662/hyperliquid-based-hyperdrive-loses-782000-after-smart-contract-exploit","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the September 27, 2025 exploit, the Hyperdrive HL team stated it had paused all market operations, engaged external auditors and forensic specialists, and identified affected accounts. On September 29, 2025, the team announced via X that all impacted accounts had been 'remediated' and that market functions were restored. The team committed to publishing a post-mortem report, though as of the date of this investigation no such public document has been identified. The full compensation mechanism — including whether funds came from the project treasury, investors, or other sources — was not publicly detailed. Stolen funds totaling approximately $782,000 were bridged to Ethereum and BNB Chain via deBridge and partially routed through Tornado Cash, which significantly reduced the probability of full on-chain recovery. The team reportedly reached out to the exploiter on-chain with a 10% white-hat bounty offer in exchange for return of the remaining funds, though no public confirmation of any funds being returned has been located.","heading":"Fund Recovery and User Compensation","sources":[{"url":"https://crypto.news/hyperliquid-hyperdrive-resumes-services-700k-hack-2025/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.mitrade.com/insights/news/live-news/article-3-1155419-20250929","name":"mitrade.com","type":"other","credibility":3},{"url":"https://x.com/hyperdrivedefi/status/1972095669403111519","name":"x.com","type":"other","credibility":3},{"url":"https://coincentral.com/hyperdrive-loses-782000-in-tokens-after-smart-contract-exploit-attack/","name":"coincentral.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, the pseudonymous on-chain investigator, is noted as having flagged Hyperdrive HL in the context of the September 2025 Hyperliquid ecosystem security incidents. The specific nature and content of ZachXBT's flag has not been independently verified through a primary source in this investigation; no dedicated ZachXBT investigation thread or Telegram post specifically targeting Hyperdrive HL was located in publicly indexed sources. The exploit was formally documented by CertiK's security monitoring team via their CertiKAlert account, which published technical details on the day of the incident. Multiple crypto news outlets — including The Block, CryptoNews, and CCN — covered the incident within 48 hours. The event was included in the Web3 Is Going Great incident tracker, which catalogs DeFi losses. Community monitoring across X and Telegram noted the exploit as part of broader concern about the security posture of the Hyperliquid DeFi ecosystem.","heading":"ZachXBT Flag and Community Monitoring","sources":[{"url":"https://x.com/CertiKAlert/status/1972117426893738341","name":"x.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/hyperdrive-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/372662/hyperliquid-based-hyperdrive-loses-782000-after-smart-contract-exploit","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"As of the time of this investigation, Hyperdrive HL had not launched a native governance token. The project operates a points-based system called 'Hyperdrive Miles,' which the team has indicated will be convertible to token rewards in a future airdrop. Season 1 of the Miles program distributed 5% of the total anticipated token supply; Season 2 is reported to be underway. Eligible activities for earning Miles include HYPE liquid staking, stablecoin lending and borrowing, HLP vault provision, and bridging. The anticipated governance token ticker is commonly referred to as HYPED in the protocol's documentation and the token HYPED is listed with a live price on CoinPedia markets. No token generation event (TGE) date has been officially confirmed. The community round of $1 million, conducted on Echo (facilitated by Comfy Capital and Breed VC), sold out in under one minute, indicating elevated retail demand prior to launch.","heading":"Token and Airdrop Structure","sources":[{"url":"https://medium.com/@hyperdrive_fi/hyperdrive-token-airdrop-miles-hlp-and-hype-lst-5417f1d78544","name":"medium.com","type":"other","credibility":3},{"url":"https://airdrops.io/hyperdrive/","name":"airdrops.io","type":"other","credibility":3},{"url":"https://markets.coinpedia.org/hyperdrive/","name":"markets.coinpedia.org","type":"other","credibility":3},{"url":"https://www.cmointern.com/2025/05/hyperdrive-secures-6m-series-led-by.html","name":"cmointern.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-05-24","event":"Hyperdrive HL (formerly Ambit Finance) closes $6 million Series A funding round led by Hack VC and Arrington Capital.","source":""},{"date":"2025-05-27","event":"Hyperdrive HL officially launches on Hyperliquid EVM with stablecoin lending, HYPED liquid staking, and HLP vault tokenization products.","source":""},{"date":"2025-09-26","event":"HyperVault, a separate Hyperliquid-based protocol, suffers an alleged $3.6 million loss in a suspected rug pull, with project social media disappearing.","source":""},{"date":"2025-09-27","event":"Attacker exploits an arbitrary-call vulnerability in Hyperdrive HL's router contract, draining 672,934 USDT0 and 110,244 thBILL tokens (~$782,000) from two markets. Stolen funds are bridged to Ethereum and BNB Chain via deBridge.","source":""},{"date":"2025-09-27","event":"CertiK publishes on-chain alert identifying the arbitrary call vulnerability in Hyperdrive's router contract. Hyperdrive team announces market pause and ongoing investigation on X.","source":""},{"date":"2025-09-27","event":"Hyperdrive team reports identifying the root cause and fixing the vulnerability. Team announces compensation plan for affected accounts.","source":""},{"date":"2025-09-29","event":"Hyperdrive team confirms all affected accounts have been remediated and market functions have been restored. Post-mortem report promised.","source":""}],"sources_used":[{"url":"https://www.cmointern.com/2025/05/hyperdrive-secures-6m-series-led-by.html","name":"cmointern.com","type":"other","archive_url":"https://web.archive.org/web/20260829084438/https://www.cmointern.com/2025/05/hyperdrive-secures-6m-series-led-by.html","credibility":3,"archive_timestamp":"2026-08-29T08:44:38+00:00"},{"url":"https://defillama.com/protocol/hyperdrive-hl","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://x.com/hyperdrivedefi/status/1925944813427302528","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://hyperdrive-2.gitbook.io/hyperdrive/for-developers/security-audits","name":"hyperdrive-2.gitbook.io","type":"other","archive_url":"http://web.archive.org/web/20260516205141/https://hyperdrive-2.gitbook.io/hyperdrive/for-developers/security-audits","credibility":3,"archive_timestamp":"2026-05-16T20:51:41+00:00"},{"url":"https://x.com/CertiKAlert/status/1972117426893738341","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.theblock.co/post/372662/hyperliquid-based-hyperdrive-loses-782000-after-smart-contract-exploit","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260401213938/https://www.theblock.co/post/372662/hyperliquid-based-hyperdrive-loses-782000-after-smart-contract-exploit","credibility":3,"archive_timestamp":"2026-04-01T21:39:38+00:00"},{"url":"https://crypto.news/hyperliquid-hyperdrive-resumes-services-700k-hack-2025/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20260609084211/https://crypto.news/hyperliquid-hyperdrive-resumes-services-700k-hack-2025/","credibility":3,"archive_timestamp":"2026-06-09T08:42:11+00:00"},{"url":"https://www.web3isgoinggreat.com/single/hyperdrive-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20251114173039/https://www.web3isgoinggreat.com/single/hyperdrive-exploit","credibility":3,"archive_timestamp":"2025-11-14T17:30:39+00:00"},{"url":"https://coincentral.com/hyperdrive-loses-782000-in-tokens-after-smart-contract-exploit-attack/","name":"coincentral.com","type":"other","archive_url":"https://web.archive.org/web/20260829025619/https://coincentral.com/f2pool-co-founder-says-btc-will-survive-quantum-computing-threats/","credibility":3,"archive_timestamp":"2026-08-29T02:56:19+00:00"},{"url":"https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/","name":"cryptonews.com.au","type":"other","archive_url":"http://web.archive.org/web/20260607082459/https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/","credibility":3,"archive_timestamp":"2026-06-07T08:24:59+00:00"},{"url":"https://www.ainvest.com/news/exploit-days-exposes-hyperliquid-security-weaknesses-2509/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.ccn.com/news/crypto/hackers-hit-hyperliquid-twice-stolen-hyperdrive-exploit/","name":"ccn.com","type":"other","archive_url":"http://web.archive.org/web/20260414111249/https://www.ccn.com/news/crypto/hackers-hit-hyperliquid-twice-stolen-hyperdrive-exploit/","credibility":3,"archive_timestamp":"2026-04-14T11:12:49+00:00"},{"url":"https://www.arringtoncapital.com/blog/hyperliquids-tipping-point-three-things-they-must-do-now/","name":"arringtoncapital.com","type":"other","archive_url":"http://web.archive.org/web/20260420124632/https://www.arringtoncapital.com/blog/hyperliquids-tipping-point-three-things-they-must-do-now/","credibility":3,"archive_timestamp":"2026-04-20T12:46:32+00:00"},{"url":"https://www.mitrade.com/insights/news/live-news/article-3-1155419-20250929","name":"mitrade.com","type":"other","archive_url":"https://web.archive.org/web/20260829051055/https://www.mitrade.com/insights/news/live-news/article-3-1155419-20250929","credibility":3,"archive_timestamp":"2026-08-29T05:10:55+00:00"},{"url":"https://x.com/hyperdrivedefi/status/1972095669403111519","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://medium.com/@hyperdrive_fi/hyperdrive-token-airdrop-miles-hlp-and-hype-lst-5417f1d78544","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://airdrops.io/hyperdrive/","name":"airdrops.io","type":"other","archive_url":"http://web.archive.org/web/20260419171406/https://airdrops.io/hyperdrive/","credibility":3,"archive_timestamp":"2026-04-19T17:14:06+00:00"},{"url":"https://markets.coinpedia.org/hyperdrive/","name":"markets.coinpedia.org","type":"other","archive_url":"https://web.archive.org/web/20260830033416/https://markets.coinpedia.org/hyperdrive/","credibility":3,"archive_timestamp":"2026-08-30T03:34:16+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:15.200679+00:00","updated_at":"2026-11-03T23:16:46.674+00:00"},"source_quality":{"total":18,"tier1":0,"tier2":2,"tier3":3,"unrated":13},"follower_count":null,"content_updated_at":"2026-11-03T23:16:47.293Z","last_fact_checked_at":"2026-08-27T11:02:39.767Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}