The recent POPCAT incident on Hyperliquid has once again reminded traders that decentralised perpetual platforms come with risks that often remain hidden until a major event exposes them.
In a matter of minutes, a single actor triggered roughly $4.9 million in losses for Hyperliquid’s liquidity vault by exploiting the combination of large leveraged positions and thin market depth.
The impact did not stop at POPCAT alone, as the pattern closely reflected an earlier episode involving the JellyJelly token. This article explains what actually happened, how the manipulation unfolded, and why it reveals deeper structural issues in the platform’s protection mechanisms.
How the Manipulation Took Place
The chain of events began when a whale withdrew around $3 million in USDC from a centralised exchange and distributed the funds across nearly twenty separate wallets. From these wallets, the individual opened extremely large long positions on POPCAT using leverage.
With only $3 million in margin, the total value of the positions reached between $20 million and $30 million. These positions were fully executed, meaning the trader became directly exposed to even minor price movements that might move POPCAT towards liquidation territory.
Once the positions were open, the trader proceeded with the next stage of the plan. A massive buy wall was placed on the order book at around $0.21, valued at roughly $20 million in limit orders.
This amount was far beyond the trader’s actual capital, yet limit orders do not require the full amount to be available unless they are filled.
The buy wall was never executed, but its presence created the impression of strong demand waiting to absorb any sell pressure at that price. Both human traders and automated systems often interpret such a wall as genuine interest, which can stabilise the market and discourage selling.
For a brief period, POPCAT’s price appeared steady, and trading activity increased as other participants perceived the buy wall as reliable support. This stability was short-lived. When the trader cancelled the entire buy wall in a single action, the apparent demand evaporated instantly.
The price dropped within moments, and the large long positions were pushed straight into liquidation.
Because POPCAT trades in a relatively thin market, the drop occurred too quickly for Hyperliquid’s liquidation system to close the positions at a price that would protect the remaining margin.
The liquidation engine faced a situation where the trader’s $3 million collateral could not cover the loss created by the sudden decline. The remaining deficit automatically transferred to Hyperliquid’s HLP vault, which functions as the counterparty to traders on the platform.
This is why the vault recorded a loss of around $4.9 million. When a position collapses faster than it can be liquidated, the vault absorbs the difference.
POPCAT proved to be an ideal target for this attack because it has shallow market depth. Despite having a recognisable market presence, the liquidity across exchanges is not strong enough to withstand dramatic shifts in the order book.
A large buy wall can influence the behaviour of the market without requiring the trader to commit real capital at that scale. Once the buy wall disappeared, the price had little resistance and fell quickly enough to trigger a chain reaction of liquidations.
The sequence of actions suggests that the trader’s intention was not profit but disruption. The use of multiple wallets, oversized positions relative to margin, and the deliberate removal of a large buy wall in one step all point to a coordinated and planned attempt to stress the platform.
On-chain analysts have even linked several wallets involved in this incident to the same group responsible for a previous manipulation involving the JellyJelly token.
Why the Pattern Mirrors JellyJelly
The resemblance to the JellyJelly incident is significant. In the earlier case, another actor opened a large position on an asset with limited liquidity and used sharp price movements to force losses on the HLP vault.
The system once again failed to liquidate the position at a safe price, and the vault was left to cover the remaining loss. Both cases demonstrate a similar structural weakness that Hyperliquid has yet to fully address.
The most striking similarity lies in the choice of assets. Tokens such as POPCAT and JellyJelly have relatively thin order books where prices can shift rapidly with only modest trading volume.
When a large buy wall or sell wall appears, the market responds as though the order reflects genuine demand or supply.
In reality, these walls can be strategically placed and removed to distort market expectations. Once removed, the price often swings sharply, creating ideal conditions for liquidation cascades.
The design of Hyperliquid places the vault as the balancing force for all leveraged positions. While this works well for assets with deep liquidity, it becomes a point of vulnerability for tokens with shallow markets.
When a trader opens an oversized position on a token that cannot absorb abrupt movement, the vault becomes responsible for a level of risk it was never designed to manage. If the market moves beyond the expected liquidation levels, the vault ends up absorbing the remaining loss.
Another issue is the absence of firm restrictions on the size of positions that can be opened on assets with limited liquidity. With relatively small amounts of capital, a trader can control leverage worth tens of millions of dollars.
This makes it possible for a determined actor to manipulate prices and create instability without needing to commit significant funds. The combination of large leverage, thin liquidity, and multi-wallet execution creates an environment where targeted attacks become feasible.
The JellyJelly incident was an early warning that Hyperliquid needed to strengthen its risk controls for niche assets. However, the POPCAT event demonstrates that the improvements required have not yet been implemented.
Two incidents with nearly identical mechanics occurring in succession suggest that the platform has an ongoing systemic weakness in its handling of liquidation risk for assets with limited depth.
Conclusion
The POPCAT incident illustrates how a single actor can use thin liquidity, oversized leverage, and strategic order placement to inflict significant losses on a decentralised perpetual platform.
With a pattern almost identical to the JellyJelly case, the event highlights underlying weaknesses in Hyperliquid’s position sizing rules and liquidation process.
Unless the platform strengthens its risk protections, similar scenarios may reappear whenever a token with shallow market depth is added to the trading list.
For traders, this serves as a reminder that transparency alone does not eliminate market risk, especially when structural gaps allow a single participant to move prices faster than the system can react.