Stay connected with BizTech Community—follow us on Instagram and Facebook for the latest news and reviews delivered straight to you.
Another high-stakes manipulation attempt has shaken up the decentralized finance (DeFi) sector. This time, it was aimed at Hyperliquid, one of the fastest-growing perpetuals DEXs.
On November 12, 2025, Hyperliquid stopped allowing deposits and withdrawals on its Arbitrum infrastructure for a short time because it thought that the meme coin Popcat (POPCAT) was being used to manipulate prices in a coordinated way.
The incident cost the platform’s community-owned HyperLiquidity Provider (HLP) vault an unbelievable $4.9 million, which led to quick action to limit the damage. As investigations continue, this occurrence shows that even the strongest DeFi systems have weaknesses and makes us think about how advanced traders might take advantage of how the market works.
Hyperliquid, which is noted for its unique liquidity provision and high-leverage trading, has grown quickly in 2025, with daily transactions regularly going over $2 billion. But because so many people use it, it has become a target for dishonest people.
This is the third attack on the platform this year. The most recent instance not only shows how risky it is to trade meme currencies with leverage, but it also serves as a warning to the whole crypto community about how important it is to make decentralized exchanges safer.
The Popcat Scheme for Manipulation
According to on-chain analysis from companies like Arkham Intelligence and reports from CoinDesk, the manipulation started when a trader took $3 million in USDC out of the OKX exchange. The money was then spread out over 19 different wallets, which is a common way to hide activity and prevent being caught. The attacker used these wallets to open huge long positions on Popcat perpetuals, which gave them exposure worth between $20 million and $30 million.
The trader made a big “buy wall”—a lot of buy orders that were meant to keep the asset’s value up and draw in more people—to artificially raise the price. This move made the price of Popcat go up, which brought liquidity from the HLP vault.
The HLP vault automatically provides counter-positions to keep the market balanced. After the price had risen enough, the attacker suddenly took down the purchase wall, which caused Popcat’s value to drop sharply. The token dropped from about $0.20 to as low as $0.12 in just a few minutes, causing many people to sell their assets.
The effects were instantaneous and terrible. The attacker’s over-leveraged longs were wiped out in seconds, but the HLP vault, which had taken the short side, took most of the losses as Popcat’s price kept falling. On-chain detectives, including MLM and Hyperliquid’s own staff, agreed that this was planned: “This was not a trading error—it was a deliberate attempt to drain the vault,” MLM said in a long discussion on X that had more than 50,000 views.
Hyperliquid’s data shows that the vault’s unrealized losses reached a high of $12 million before the team stepped in and manually closed positions to stop the flow. The total damage was $4.9 million, which is a little amount compared to the platform’s $2.34 billion TVL, but it was enough to make users lose faith. Before the occurrence, Popcat, a meme coin based on Solana, had a market cap of $1.2 billion. In just 24 hours, it lost 26% of its value, showing how easily these assets can be manipulated.
Hyperliquid has dealt with this kind of thing before. A similar short squeeze on the Solana meme coin JELLYJELLY in March 2025 caused the HLP vault to lose $12 million in unrealized losses, which led to the asset being delisted. In August, there was another event in which coordinated attacks momentarily stopped liquidity pools from working. These instances happening over and over again have led to rumors that organized groups are going after the platform, possibly competitors or bad actors taking advantage of its open architecture.
Hyperliquid’s Response to an Emergency
Hyperliquid turned on its EmergencyLock feature in reaction to the Popcat disaster. This feature stops certain transaction channels during emergencies. This stopped deposits and withdrawals on Arbitrum, which stopped the spread of the virus while allowing trading on other chains like Solana to continue without interruption. “The blockchain is not being maintained; core operations are still going on,” the team said on X, reassuring users that their money was safe and that the suspension was just a precaution.
The HyperLiquidity Provider, a community-owned vault on the site that automatically balances deals to keep liquidity high, was the main target. The HLP’s algorithmic structure renders it vulnerable to attacks that induce unbalanced positions through quick price fluctuations. This is because it is meant to work like a centralized exchange in a DeFi context. The developers of Hyperliquid acted immediately to fix things by manually closing dangerous positions. This is an unusual step that shows how the protocol’s hybrid governance mechanism works.
There was a quick outcry from the community. On Discord and X, members asked for compensation, and some even called for a “bailout fund” from protocol fees. The team promised to do a comprehensive investigation and maybe make things right, but they stressed that the issue only happened in the Popcat market. A developer update said, “We’re improving vault protections and looking into anti-manipulation oracles.” This means that they are making changes to stop “degen warfare” from happening again.
Bigger Effects on Meme Coins and DeFi
This episode shows the biggest weakness of perp DEXs, that they are open to manipulation, which is harder for centralized exchanges to catch through surveillance.
Hyperliquid’s fast growth—$2.83 billion in daily volume, up 22% in September—has made it a target. For example, it makes more money than its competitors ($7.12 million a day vs. $2.79 million). Meme coins like Popcat have $1.2 billion caps but low liquidity, which increases risks. Attacks like this could keep retail investors from participating, since 26% declines wipe out billions.
Chainalysis says that protocols need to move beyond basic oracles to AI-driven anomaly detection for the $300 billion DeFi sector. This is a wake-up call. Regulators may look closely at the CFTC’s 2025 perp standards, which could require DEXs to have better AML measures to stop anonymous exploits. In Asia, where 18 million people in Indonesia own memecoins, similar problems with local DEXs like PancakeSwap could lead to calls for OJK audits.
The fact that Hyperliquid’s TVL stayed consistent at $2.34 billion after the incident demonstrates that the community is strong, but if it keeps getting hammered, people might leave. “Hyperliquid’s the future, but manipulation’s the killer—fix or fade,” one trader tweeted.
Conclusion
Hyperliquid stopped Arbitrum flows on November 12 because of Popcat manipulation, which cost $4.9 million in vault losses. This shows how easy it is to manipulate DeFi, as a $3 million-funded attacker used 19 wallets to carry out a pump-and-dump.
Even if the platform’s EmergencyLock was damaged and trade started again in other places, this third attack in 2025 shows that more advanced security measures are needed.
For meme coins and perps, this is a warning: volatility attracts predators. As Hyperliquid investigates and makes changes, this occurrence could lead to changes across the industry. For now, though, confidence is up in the air—be careful while trading in degen’s area.
