DeFi

USDC

Security

Reserve

Hyperliquid

On Thursday, a single user on the decentralized trading platform Hyperliquid lost about $21 million after a private key leak led to an exploit involving the platform’s Hyperdrive lending protocol.
According to blockchain security company PeckShield, the attacker targeted 17.75 million DAI (<a href="/dai-price-index" rel="noopener noreferrer nofollow">DAI</a>) and 3.11 million SyrupUSDC, a synthetic version of the USDC stablecoin used within Hyperdrive, and subsequently bridged the stolen funds to Ethereum.
PeckShield has not confirmed how the private key was compromised.
<figure><img src="https://s3.cointelegraph.com/uploads/2025-10/0199ced4-4eb5-73bc-8841-f0d4024da755" title="" alt="Trader loses $21M on Hyperliquid after private key leak: How to stay protected">
 <figcaption style="text-align: center;">Source: <a href="https://x.com/PeckShieldAlert/status/1976577386469839269" rel="noopener noreferrer nofollow" target="https://x.com/PeckShieldAlert/status/1976577386469839269">PeckShieldAlert</a>
 </figcaption>
</figure>
The exploit comes amid <a href="https://cointelegraph.com/news/how-aster-lighter-and-hyperliquid-are-competing-for-the-next-era-of-onchain-trading" rel="noopener noreferrer nofollow">rapid growth for Hyperliquid</a>, which has attracted significant attention due to its points-based rewards program designed to boost liquidity and user participation. The program recently culminated in a major airdrop to over 94,000 addresses.
Over the past week alone, the platform has processed more than $3.5 billion in trading volume, according to data from <a href="https://defillama.com/dexs" rel="noopener noreferrer nofollow" target="_blank">DefiLlama</a>.
Still, as decentralized exchanges (DEXs) continue to experience renewed activity, the incident underscores a familiar question: How can users remain secure in an ecosystem built on self-custody and smart contracts?
Related: <a href="https://cointelegraph.com/news/chainalysis-seizable-crypto-assets-national-reserves-2025" rel="noopener noreferrer nofollow">As US Bitcoin Reserve stalls, Chainalysis flags $75B in seizable crypto</a>
<h2 id="how-traders-can-stay-protected">How traders can stay protected</h2>
While the cause of Thursday’s exploit remains under investigation, security analysts emphasize that decentralized exchange users can take several precautions to minimize risk.
DEXs like Hyperliquid give traders full custody of their crypto assets, but that control also means they bear full responsibility for securing them. Experts recommend maintaining a <a href="https://cointelegraph.com/news/store-crypto-wallet-security" rel="noopener noreferrer nofollow">“hot” wallet for active trading</a> and a “cold” wallet for long-term storage, ensuring that most funds remain offline and out of reach of online threats.
Only a small portion of a trader’s assets should remain in wallets connected to DEXs to limit potential losses in the event of a private key compromise or malicious smart contract.
Related: <a href="https://cointelegraph.com/learn/articles/hardware-vs-software-wallets" rel="noopener noreferrer nofollow">Hardware vs. software wallets: Key differences</a>
To protect against private key exploits, Hyperliquid users should never share their private keys or seed phrases, even during API wallet setup. Hyperliquid’s official documentation explicitly <a href="https://hyperliquid.gitbook.io/hyperliquid-docs/onboarding/how-to-start-trading" rel="noopener noreferrer nofollow" target="_blank">warns</a>: “Do not share your private key with anyone.”
Users should also be cautious of fake “authorization” pages or support messages on platforms like Telegram or Discord, which often impersonate official staff to steal credentials.
<figure><img src="https://s3.cointelegraph.com/uploads/2025-10/0199ced4-5389-735d-a7a3-91fd96a2abe1" title="" alt="Trader loses $21M on Hyperliquid after private key leak: How to stay protected">
 <figcaption style="text-align: center;">As of the third quarter of 2025, crypto exchanges and DeFi protocols were the top two attack vectors for hacks and exploits. Source: CertiK
 </figcaption>
</figure>
In the wake of the Hyperliquid exploit, crypto exchange MEXC <a href="https://www.mexc.com/en-PH/news/what-hyperliquid-traders-need-to-do-after-the-hyperdrive-exploit/113483" rel="noopener noreferrer nofollow" target="_blank">advised</a> users to “check positions and approvals on a block explorer,” noting that exploits often occur when traders grant excessive permissions to DeFi protocols.&nbsp;
Security experts recommend regularly reviewing and revoking unnecessary permissions using tools like Etherscan’s Token Approvals feature or similar onchain management platforms.
Related: <a href="https://cointelegraph.com/news/q3-2025-crypto-hacks-losses-drop-37-percent" rel="noopener noreferrer nofollow">Crypto hack losses down 37% in Q3 as tactics shift to wallets</a>

Trader loses $21M on Hyperliquid after private key leak: How to stay protected

Table of Contents

Cointelegraph

Other articles published on Oct 10, 2025

Join our free newsletter for daily crypto updates!