What happened
Hyperdrive's September 2025 exploit affected its Primary USDT0 and Treasury USDT markets on Hyperliquid, with reported losses of approximately $782,000. Published analysis attributed the withdrawals to excessive Router permissions. Hyperdrive paused the markets and later said affected accounts had been restored.
Technical root cause
The reported failure combined broad operator approvals with a Router permitted to call the privileged Market contract. Checking the destination whitelist did not prevent a third party from invoking operations against another user's account.
How it happened
- Users granted the Router operator permissions during lending flows.
- The Router could call whitelisted contracts, including the Market contract.
- An attacker used that combination to trigger changes to users' positions through the Router.
- Hyperdrive paused operations, patched the issue, and reported restoring affected accounts.
Protocol details
Classification
Protocol Logic / Borrowing and Lending / Access Control
Protocol Type
Lending
Implementation language
Solidity
Protocol links
Website
@hyperdrivedefi
Security review history
- BailSec View report
Evidence
- report @PeckShieldAlert incident report x.com
- report @CertiKAlert incident report x.com
- report @hyperdrivedefi incident report x.com
- analysis Website reference coincentral.com
- analysis DeFiLlama defillama.com
- analysis Sep 2025 - HyperDrive Router Set As Operator State Changes Triggered - $782k quadrigainitiative.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
