View source for HyperDrive Router Set As Operator State Changes Triggered

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/hyperdriveroutersetasoperatorstatechangestriggered.php}}
{{Unattributed Sources}}

[[File:Hyperdrive.jpg|thumb|HyperDrive Logo/Homepage]]HyperDrive, a core stablecoin money market within the Hyperliquid ecosystem, was compromised due to a vulnerability in its contract design. The issue arose from users granting the Router unrestricted operator permissions, allowing attackers to execute arbitrary calls on the whitelisted Market contract, which resulted in the manipulation of users' positions. The exploit was traced to a sophisticated threat actor linked to other high-profile attacks. Following the incident, HyperDrive paused all markets and withdrawals, conducted a thorough investigation, and quickly implemented a patch within 48 hours. Funds have been restored to affected accounts, and markets are now fully operational. HyperDrive is committed to transparency and will release a post-mortem report, while also working to reinforce the protocol's security. Affected users were compensated, and the team thanked the community for their support during this time.<ref name="hyperdrivefitweet1-21243" /><ref name="hyperdrivefitweet2-21244" /><ref name="hyperdrivefitweet3-21245" /><ref name="cryptonyarutweet-21246" /><ref name="hyperdrivesetuptransaction-21247" /><ref name="hyperdriveattacktransaction-21248" /><ref name="diemkantweet-21249" /><ref name="vickydiamond21tweet-21250" /><ref name="inaiveaitwitter-21251" /><ref name="principecriptotwitter-21252" /><ref name="kandlefitwitter-21253" /><ref name="cryptosangeettwitter-21254" /><ref name="autumngood35twitter-21255" /><ref name="cheekycryptotwitter-21256" /><ref name="socatisaitwitter-21257" /><ref name="cande21990211twitter-21258" /><ref name="0xtheweb3labstwitter-21259" /><ref name="unchainedpodtwitter-21260" /><ref name="cartelxbttwitter-21261" /><ref name="trustblockhqtwitter-21262" /><ref name="k10ndiketwitter-21263" /><ref name="hyperdrivetwitterx-21264" /><ref name="hyperdrivehomepage-21265" /><ref name="mirrorxyzhyperdrive-21266" />

== About HyperDrive ==
HyperDrive is Hyperliquid's premier stablecoin money market, designed as the core infrastructure for making everything on the HyperCore ecosystem more liquid. The platform aims to be the cornerstone of the fast-growing stablecoin market, which is expected to become one of the largest sectors in crypto. With a focus on sustainable yields, HyperDrive allows users to supply stablecoins for lending, stake $HYPE for rewards, and use Hyperliquid's proprietary strategies, such as the Hyperliquidity Provider (HLP) vault, to generate returns. These strategies ensure that yields are driven by sound, sustainable mechanics, addressing the common issue of declining DeFi yields that plagued the market in 2022.

The stablecoin market has seen explosive growth, with assets like USDC, USDT0, and USDe now exceeding $243 billion in total supply. HyperDrive was built to capitalize on this trend, leveraging the rise of stablecoins in decentralized finance (DeFi) for various uses, from remittances to protecting against hyperinflation. However, the market's early success was marred by unsustainable yields, prompting HyperDrive to focus on long-term, sustainable growth solutions. By using innovative vaults and collateral strategies, such as tokenizing HyperCore vaults and offering managed yield and looping strategies, HyperDrive seeks to transform stablecoin yields into a stable, reliable revenue stream for users.

Looking ahead, HyperDrive envisions becoming the default infrastructure for yield generation in the crypto space. Every crypto wallet is expected to hold stablecoins, which will continuously earn, borrow, and compound through the platform. As Hyperliquid continues to grow, HyperDrive will integrate more stablecoins, tokenization protocols, vaults, and yield opportunities to create a comprehensive ecosystem for maximizing returns. In five years, HyperDrive aims to be the central hub for stablecoin yields, driving value and utility in the crypto world.

== The Reality ==
Unfortunately, the market router was incorrectly set as an operator during deployment, creating the conditions for an exploitable vulnerability.

== What Happened ==
HyperDrive was compromised due to a vulnerability in its contract design allowing unauthorized calls.
{| class="wikitable"
|+Key Event Timeline - HyperDrive Router Set As Operator State Changes Triggered
!Date
!Event
!Description
|-
|August 1st, 2025 10:33:52 PM MDT
|Hyperdrive Router Set As Operator
|A transaction which sets up the permissions vulnerability in the protocol. "During the lending process, the user sets the Router as Operator, but the Router can execute any Call to addresses in the whitelist, and coincidentally the Market is in the whitelist."
|-
|September 27th, 2025 6:54:52 AM MDT
|Hyperdrive Attack Transaction
|The attack transaction which is related to this exploit.
|-
|September 27th, 2025 7:55:00 AM MDT
|Analysis By CryptoNyaRu Posted
|Twitter/X user CryptoNyaRu publishes an initial analysis of the exploit transaction in Chinese, including links to the related transactions viewable in the block explorer.
|-
|September 27th, 2025 8:00:00 AM MDT
|Team Reportedly Aware Of Activity
|The approximate time that the Hyperdrive team became aware of the suspicious activity (assuming that their post is meant to say September and not June).
|-
|September 27th, 2025 6:27:00 PM MDT
|Initial Hyperdrive Announcement
|The Hyperdrive Finance team posts on Twitter/X to announce that they are aware of the exploit, only two markets ("Primary USDT0 Market and the Treasury USDT Market") are affected/vulnerable, and further updates will be available in the future.
|-
|September 28th, 2025 12:38:00 AM MDT
|Intermediate Update Posted
|The HyperDrive team posts an intermediate update on Twitter/X. They "have identified the root cause and corrected the issue. We have also identified the affected accounts and are enacting a compensatory plan shortly. We expect normal market functioning to resume within 24 hours, if not significantly sooner."
|-
|September 28th, 2025 6:29:00 PM MDT
|Hyperdrive Restoration Update
|Hyperdrive posts an update announcing that all markets have now reopened. "All markets are fully operational and funds have been restored to all impacted accounts."
|}

== Technical Details ==
Hyperdrive was compromised because users granted the Router unrestricted operator permissions during borrowing/lending flows, and the Router itself was allowed to make arbitrary calls to any to address on a whitelist — and crucially the Market contract was on that whitelist. In practice this meant that anyone who could trigger the Router could instruct it to call the Market contract on behalf of a user. An attacker used that pathway: a user transaction sets the Router as operator (see tx 0x5456d8...a12cb), the Router’s design allows arbitrary whitelisted to calls and the Market (ID 0x05d2...280c, address 0xa52257...d09) is whitelisted, and a third‑party then invoked the Router to issue calls into the Market that altered those users’ positions (see tx 0xcaf5ea...66a6639). Router address: 0x8D9e168a8Fd102Ea52Ba3Cc43d4C613Bb6c89F32.

Technically the root causes were over‑broad operator approvals on user accounts plus a trust assumption in the Router/whitelist model: the whitelist permitted a privileged contract (the Market) to be called indirectly via a Router that could be set as an operator by any user. That combination allowed a third party to trigger state‑changing Market logic against users’ vaults without the users’ intent. Short mitigations include narrowing operator permissions, removing or restricting the Router’s ability to proxy arbitrary whitelisted calls, moving whitelist checks to require the original caller to be an authorized actor (not just the to target), and adding explicit user consent or timelocks for operator-initiated critical actions.

Twitter/X user Diemkan explained further:

"The fundamental design flaw in Hyperdrive's contracts, where the router could call any whitelisted contract, is a serious security vulnerability. This opens the system up to potential privilege escalation attacks, which is a much deeper issue than just a simple bug.

Adding an LLM agent on top of this flawed architecture would not fix the underlying problem. If the agent has access to the router, it could potentially exploit this privilege flaw to perform unauthorized actions."

== Total Amount Lost ==
The amount lost has varied between $782k and $783k through various sources.

The total amount lost has been estimated at $782,000 USD.

== Immediate Reactions ==
The issue first surfaced on June 27, 2025, around 10:00 PM Singapore time, when suspicious activity was detected in the Primary and Treasury USDT0 markets. In response, the team paused all markets and withdrawals while conducting a thorough investigation with the help of auditors and security specialists. Hyperdrive publicly acknowledged exploit within 12 hours and identified that is was affecting two markets: the Primary USDT0 Market and the Treasury USDT Market. The team began working on a patch to address the vulnerability and exploring various options to mitigate the impact on affected users. Hyperdrive emphasized their commitment to transparency and promised a detailed post-mortem report once the investigation is complete. Hyperdrive reiterated that their long-term vision of building the best protocol on Hyperliquid remains unchanged.

== Ultimate Outcome ==
All markets are now fully operational with funds restored to all affected accounts. Users were remediated and a patch was able to be developed, reviewed, and implemented within 48 hours. Markets resumed normally.

The attack was traced to a sophisticated threat actor associated with high-profile attacks on other protocols.

== Total Amount Recovered ==
Affected users have reportedly been made whole by the HyperDrive team.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
Hyperdrive has committed to releasing a full postmortem in the future. According to the latest update from HyperDrive, "[t]he investigation is currently ongoing and we will reveal more information at the appropriate time."

Hyperdrive expressed gratitude to the security community, its Hyperliquid partners, and especially its users for their support during this challenging period. Users who are still experiencing issues or believe their accounts have not been fully remediated are encouraged to open a support ticket via Hyperdrive's Discord server. The team remains committed to transparency and is focused on reinforcing the protocol's security moving forward.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="hyperdrivefitweet1-21243">[https://twitter.com/hyperdrivedefi/status/1972095669403111519 Hyperdrive Finance - "We are aware of the recent issues affecting the Hyperdrive protocol. At this time, we are able to confirm that the issues affect only two markets: the Primary USDT0 Market and the Treasury USDT Market." - Twitter/X] (Accessed Sep 29, 2025)</ref>

<ref name="hyperdrivefitweet2-21244">[https://twitter.com/hyperdrivedefi/status/1972189259504537624 Hyperdrive Finance - "We have identified the root cause and corrected the issue. We have also identified the affected accounts and are enacting a compensatory plan shortly. We expect normal market functioning to resume within 24 hours, if not significantly sooner." - Twitter/X] (Accessed Sep 29, 2025)</ref>

<ref name="hyperdrivefitweet3-21245">[https://twitter.com/hyperdrivedefi/status/1972458715354935611 Hyperdrive Finance - "All markets are fully operational and funds have been restored to all impacted accounts." - Twitter/X] (Accessed Sep 29, 2025)</ref>

<ref name="cryptonyarutweet-21246">[https://twitter.com/CryptoNyaRu/status/1971936681617248264 CryptoNyaRu - "During the lending process, the user sets the Router as Operator, but the Router can execute any Call to addresses in the whitelist, and coincidentally the Market is in the whitelist" - Twitter/X] (Accessed Sep 29, 2025)</ref>

<ref name="hyperdrivesetuptransaction-21247">[https://hyperevmscan.io/tx/0x5456d89a71c594b922f5753fd992a0fcd0ff366fa68400395fa09e1b773a12cb Hyperdrive Router Set As Operator - HyperEVMScan] (Accessed Sep 29, 2025)</ref>

<ref name="hyperdriveattacktransaction-21248">[https://hyperevmscan.io/tx/0xcaf5ea61c438339431e32a4bcf8b1ce893b873599e6a56b6df37af74066a6639 Hyperdrive Attack Transaction - HyperEVMScan] (Accessed Sep 29, 2025)</ref>

<ref name="diemkantweet-21249">[https://twitter.com/Diemkan/status/1972740475414270413 Diemkan - "In summary, this is a concerning security design issue that needs to be addressed at the core contract level, rather than just adding a new interface on top of it." - Twitter/X] (Accessed Sep 29, 2025)</ref>

<ref name="vickydiamond21tweet-21250">[https://twitter.com/vickydiamond21/status/1972425543397392799 Vicki.hl - "A Hyperliquid-based lending protocol, @hyperdrivedefi lost about $782,000 worth of tokens following a smart contract exploit Saturday night, in the third notable security incident affecting the popular Layer 1 network." - Twitter/X] (Accessed Sep 29, 2025)</ref>

<ref name="inaiveaitwitter-21251">[https://twitter.com/i_naiveai/status/1971941873003778319 @i_naiveai Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="principecriptotwitter-21252">[https://twitter.com/PrincipeCripto/status/1972613372500963433 @PrincipeCripto Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="kandlefitwitter-21253">[https://twitter.com/KandleFi/status/1972559514558959840 @KandleFi Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="cryptosangeettwitter-21254">[https://twitter.com/CryptoSangeet/status/1972731737588511159 @CryptoSangeet Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="autumngood35twitter-21255">[https://twitter.com/autumn_good_35/status/1972639139637186905 @autumn_good_35 Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="cheekycryptotwitter-21256">[https://twitter.com/CheekyCrypto/status/1972361520290889986 @CheekyCrypto Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="socatisaitwitter-21257">[https://twitter.com/SocatisAI/status/1972225278937374897 @SocatisAI Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="cande21990211twitter-21258">[https://twitter.com/Cande21990211/status/1972540260388094393 @Cande21990211 Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="0xtheweb3labstwitter-21259">[https://twitter.com/0xTheWeb3Labs/status/1972679682668556575 @0xTheWeb3Labs Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="unchainedpodtwitter-21260">[https://twitter.com/Unchained_pod/status/1972674988948795726 @Unchained_pod Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="cartelxbttwitter-21261">[https://twitter.com/cartelxbt/status/1972419681945268448 @cartelxbt Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="trustblockhqtwitter-21262">[https://twitter.com/TrustblockHQ/status/1972700410231353437 @TrustblockHQ Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="k10ndiketwitter-21263">[https://twitter.com/K10NDIKE/status/1972537059517554733 @K10NDIKE Twitter] (Accessed Sep 29, 2025)</ref>

<ref name="hyperdrivetwitterx-21264">[https://twitter.com/hyperdrivedefi Hyperdrive Finance Twitter/X Account] (Accessed Sep 29, 2025)</ref>

<ref name="hyperdrivehomepage-21265">[https://hyperdrive.fi/ Hyperdrive Homepage] (Accessed Sep 29, 2025)</ref>

<ref name="mirrorxyzhyperdrive-21266">[https://mirror.xyz/0x0c31773aF12C949f671e138FC28dD7E7289304d3/oWLnxarUEBoMh4TWF3VuB43P1Nb9N6c0IUGI6yEgb5w Hyperdrive - THE Stablecoin Money Market - Mirror.xyz] (Accessed Sep 29, 2025)</ref></references>