Verify a decision

{"actor":"system:backfill","investigation_id":"372e4c34-0aef-4d67-830a-99444005a580","kind":"publish","page_slug":"popcat-manipulation-november-2025","published_at":"2026-10-13T05:15:45.588Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"POPCAT manipulation (November 2025)","sections":[{"content":"Per Cointelegraph, on-chain analyst Lookonchain reported that an actor withdrew 3 million USDC from OKX and split it across 19 fresh wallets, then opened more than $26 million in leveraged long positions on the POPCAT perpetual contract on Hyperliquid and placed a buy wall of about $20 million near $0.21. CCN (via Yahoo Finance) reports the attack began early on 12 November 2025, used roughly 5x leverage, and that when the wall was cancelled POPCAT 'plunged roughly 30% within seconds'. Figures for total long size vary across outlets (about $26 million to about $30 million), and the exact price move is given only in the CCN report. The actor behind the wallets has not been publicly identified in the sources reviewed; all attribution of intent is alleged.","heading":"Incident description","severity":"high","sources":[{"credibility":2,"name":"Cointelegraph - Hyperliquid HLP POPCAT attack","type":"news_article","url":"https://cointelegraph.com/news/hyperliquid-hlp-popcat-attack-3m-wipeout"},{"credibility":2,"name":"CCN via Yahoo Finance - Hyperliquid hit by third market manipulation attack in 2025","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-hit-third-market-manipulation-113215395.html"},{"credibility":2,"name":"ForkLog - Hyperliquid halts transactions amid meme coin manipulation concerns","type":"news_article","url":"https://forklog.com/en/hyperliquid-halts-transactions-amid-meme-coin-manipulation-concerns/"}]},{"content":"Reports put the loss absorbed by Hyperliquid's HLP liquidity vault at about $4.9 million (Cointelegraph, Halborn), with CCN describing roughly $4.5-4.9 million in bad debt. The alleged attacker's own capital of about $3 million was reportedly wiped out through liquidation and no profit was reported. Halborn characterises the event as exploiting the design of Hyperliquid's pools rather than a specific code vulnerability. Depositors in the vault bore the loss.","heading":"Losses and impact on HLP vault","severity":"high","sources":[{"credibility":2,"name":"Cointelegraph - Hyperliquid HLP POPCAT attack","type":"news_article","url":"https://cointelegraph.com/news/hyperliquid-hlp-popcat-attack-3m-wipeout"},{"credibility":2,"name":"Halborn - Explained: the Hyperliquid hack (November 2025)","type":"research","url":"https://halborn.com/blog/post/explained-the-hyperliquid-hack-november-2025"},{"credibility":2,"name":"CCN via Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-hit-third-market-manipulation-113215395.html"}]},{"content":"Cointelegraph reported that the Hyperliquid bridge stopped processing withdrawals for about an hour, with a developer saying a contract was paused via an emergency lock function; Hyperliquid did not officially link the pause to the POPCAT incident. Halborn and ForkLog describe deposits and withdrawals being paused or the Arbitrum bridge being temporarily halted. No formal Hyperliquid statement was located in the sources reviewed, so its official characterisation is unverified. A CoinGecko analysis, a single source, alleges a validator vote was used to intervene in pricing; this is not corroborated here. Outlets differ on terminology (exploit versus market manipulation).","heading":"Platform response and unresolved questions","severity":"medium","sources":[{"credibility":2,"name":"Cointelegraph - Hyperliquid HLP POPCAT attack","type":"news_article","url":"https://cointelegraph.com/news/hyperliquid-hlp-popcat-attack-3m-wipeout"},{"credibility":2,"name":"ForkLog - Hyperliquid halts transactions","type":"news_article","url":"https://forklog.com/en/hyperliquid-halts-transactions-amid-meme-coin-manipulation-concerns/"},{"credibility":2,"name":"CoinGecko - Hyperliquid HLP vault analysis","type":"research","url":"https://www.coingecko.com/learn/hyperliquid-hlp-vault-analysis"}]},{"content":"CCN describes this as Hyperliquid's third market-manipulation attack of 2025, following a March 2025 incident involving JELLYJELLY and a July 2025 incident involving TST. Reports note Hyperliquid permits up to 50x leverage on certain markets, and that thin liquidity in smaller tokens is the common factor. Users depositing to HLP or trading low-liquidity perpetuals face recurring risk of this kind.","heading":"Pattern of prior incidents","severity":"medium","sources":[{"credibility":2,"name":"CCN via Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-hit-third-market-manipulation-113215395.html"},{"credibility":2,"name":"Halborn - Explained: the Hyperliquid hack (November 2025)","type":"research","url":"https://halborn.com/blog/post/explained-the-hyperliquid-hack-november-2025"}]}],"sources_used":[{"credibility":2,"name":"Cointelegraph - Hyperliquid HLP POPCAT attack","type":"news_article","url":"https://cointelegraph.com/news/hyperliquid-hlp-popcat-attack-3m-wipeout"},{"credibility":2,"name":"CCN via Yahoo Finance - third market manipulation attack","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-hit-third-market-manipulation-113215395.html"},{"credibility":2,"name":"Halborn - Explained: the Hyperliquid hack (November 2025)","type":"research","url":"https://halborn.com/blog/post/explained-the-hyperliquid-hack-november-2025"},{"credibility":2,"name":"ForkLog - Hyperliquid halts transactions","type":"news_article","url":"https://forklog.com/en/hyperliquid-halts-transactions-amid-meme-coin-manipulation-concerns/"},{"credibility":2,"name":"CoinGecko - Hyperliquid HLP vault analysis","type":"research","url":"https://www.coingecko.com/learn/hyperliquid-hlp-vault-analysis"}],"summary":"In November 2025 an unidentified trader allegedly funded 19 wallets with about $3 million USDC withdrawn from OKX, opened leveraged POPCAT perpetual longs on Hyperliquid, placed a roughly $20 million buy order near $0.21 and then cancelled it. Liquidations reportedly left Hyperliquid's community-owned HLP vault with about $4.5-4.9 million in bad debt, while the trader's own roughly $3 million was reportedly lost. Coverage describes it as market manipulation exploiting thin liquidity and pool design rather than a code exploit; no individual has been publicly identified.","timeline":[{"date":"2025-11","date_evidence":"The attack \"began early Nov. 12.\"","date_original":"2025-11-12","event":"Alleged attacker funds 19 wallets with about $3M USDC from OKX, opens leveraged POPCAT longs, places and cancels a ~$20M buy wall near $0.21; HLP absorbs about $4.5-4.9M bad debt.","source":"CCN via Yahoo Finance","source_url":"https://finance.yahoo.com/news/hyperliquid-hit-third-market-manipulation-113215395.html"},{"date":"2025-11-13","date_evidence":"Nov 13, 2025","event":"Cointelegraph reports the incident and a roughly one-hour bridge withdrawal pause.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/hyperliquid-hlp-popcat-attack-3m-wipeout"},{"date":"2025-11","event":"Halborn publishes technical explainer characterising the event as a pool-design-based price manipulation.","source":"Halborn","source_url":"https://halborn.com/blog/post/explained-the-hyperliquid-hack-november-2025"}]},"v":1}