A Hyperliquid user’s account was reportedly taken over without authorization, with roughly 738,600 USDC already moved out, according to ChainCatcher. Another 10,287 HYPE was unstaked in the incident. The report said part of the stolen funds was traced to an address suspected to be مرتبط with Bitget. At the time of review, the 10,287 HYPE remained in the staking balance and had not entered the withdrawal queue. If the attacker proceeds with cWithdraw, those assets could be moved further after a seven-day waiting period. ChainCatcher also said two similar recent cases led to secondary thefts of staked assets because users lacked an emergency pause tool they could trigger themselves, with combined losses exceeding $1.1 million. Suggested fixes included a pre-enabled Guardian or Recovery mechanism that would only temporarily freeze withdrawals, transfers, and authorization changes, expire automatically, and require a time lock, evidence review, and on-chain records for recovery.
A Hyperliquid user’s account was reportedly compromised through unauthorized control, and about 738,600 USDC has already been transferred out, according to ChainCatcher. Another 10,287 HYPE was also unstaked.
The report said the victim account was a certain address, and part of the stolen funds moved to an address suspected to be associated with Bitget.
Unstaked HYPE has not yet entered the withdrawal queue
As of the latest check, the 10,287 HYPE remained in the staking balance and had not entered the withdrawal queue. If the attacker goes on to initiate cWithdraw, the assets could be moved further after a seven-day waiting period.
Similar cases and proposed safeguards
ChainCatcher said two similar recent cases resulted in staked assets being stolen a second time because there was no user-triggered emergency pause mechanism. Losses across those cases exceeded $1.1 million.
The suggested measures included introducing a Guardian or Recovery mechanism that users could enable in advance. Under that design, only withdrawals, transfers, and authorization changes would be temporarily paused. The pause would expire automatically, and account recovery would require a time lock, evidence review, and an on-chain record.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
