Hyperliquid User Private Key Compromise Hack

On October 10, 2025, a Hyperliquid user lost approximately $21 million worth of cryptocurrency after their private key was leaked to an attacker. The hacker gained full wallet control and bridged the stolen funds to Ethereum, including $17.75 million in DAI stablecoin and $3.11 million in MSYRUPUSDP, without exploiting any smart contract vulnerabilities.

The theft was caused by a private key compromise rather than a smart contract exploit, as evidenced by the attacker having complete wallet control to sign transactions directly. Private keys prove ownership of a crypto wallet and allow transaction signing, meaning possession of the key grants total control over the wallet's funds. According to blockchain security experts, private keys are typically leaked through phishing sites, malware-infected devices, or poor storage practices such as unencrypted seed phrases saved in cloud storage or screenshots.

The attacker systematically drained the victim's Hyperliquid wallet and immediately bridged the stolen assets to Ethereum for further laundering or conversion. The exact method of how the victim's private key was exposed remains unclear at the time of reporting.