Two incidents in one week

Trading on DeFi is a bit like flying on autopilot.

Most of the time, the plane handles itself – smooth, efficient, and often safer than a human hand.

But if there’s a flaw in that autopilot system… everyone on board might be at risk.

Case in point: what just happened to Hyperdrive, a yield/markets protocol built on the Hyperliquid ecosystem.

Hackers found a bug in one of Hyperdrive’s routers – basically a piece of code that tells money where to go. And that bug gave them permission to do things they shouldn’t have been able to do.

The result: ~$773K drained from two user accounts, mostly in thBILL, a token that represents US Treasury bills.

The stolen funds were split up and sent across different blockchains – BNB Chain and Ethereum – a common technique that makes money harder to recover.

To contain the damage, Hyperdrive froze its markets, then patched the bug and promised to reimburse the affected users.

Now, sure, crypto hacks happen… uhh, very often. But this one stings a bit more because of what was taken.

thBILL is backed by US Treasuries, aka one of the safest assets in TradFi. That’s why people buy it: it feels low-risk.

Keyword: feels.

To be clear, thBILL itself wasn’t compromised; the vulnerability was in Hyperdrive’s router. But that doesn’t change the outcome: people still lost money.

Which brings us to the takeaway here – in DeFi, it’s not enough to trust the asset; you also have to trust the code that handles it.

And, to be fair, the “trust” part has been a little wobbly in the Hyperliquid ecosystem lately.

Just a few days before the Hyperdrive exploit, another Hyperliquid-linked project, HyperVault, had some sketchy stuff goin’ on:

About $3.6M was suddenly withdrawn from the protocol, bridged to Ethereum, swapped into ETH, and passed through Tornado Cash (a privacy tool often used to hide where money goes).

Then, HyperVault’s website went offline, socials were deleted, and the team gave no explanation.

If 2+2=4, and 5+5=10, this sure looks like a rug pull – in other words, the project’s own team might’ve stolen the money.

So, two incidents like this, super close together, understandably made some people question whether they can trust Hyperliquid in general.

“So, what’s the takeaway? Hyperliquid = bad?” – you, maybe.

… No. Hyperdrive and HyperVault are separate projects that just happen to run on Hyperliquid. The Hyperliquid = bad minset wouldn’t protect you, because the problems weren’t caused by the base layer.

But then, what can protect you? Well, you can take some steps to limit your risk – though none of them are perfect:

👉 Choose platforms with a good track record: history isn’t a guarantee, but it’s better than nothing;

👉 Look for real audits: like multiple independent audits, bug bounties, and teams that respond fast when things go wrong;

👉 Don’t put all your eggs in one basket: while it’s tempting to dump everything into the platform with the best yields, if it goes down, you’re stuck. Keeping funds across different wallets, chains, or even partly in traditional accounts reduces the risk;

👉 Keep long-term funds in self-custody: the safest place for assets you don’t plan to move often is usually a hardware wallet (like a Ledger) or some other offline/self-custody setup.

All that being said, using DeFi always means taking on some level of risk.

In exchange, you get direct control over your money, faster access, lower costs, and fewer barriers than TradFi.

But there’s no autopilot you can trust blindly. The only true defense is deciding which risks you’re okay flying with, and which ones aren’t worth boarding the plane for.