On Thursday, a single user on the decentralized trading platform Hyperliquid lost about $21 million due to a private key leak that triggered an exploit involving the platform’s Hyperdrive lending protocol.

According to PeckShield, a blockchain security firm, the attack targeted 17.75 million DAI and 3.11 million SyrupUSDC, a synthetic USDC stablecoin utilized in Hyperdrive, which were then bridged to Ethereum.

PeckShield has yet to determine how the private key was compromised.

Source Source: PeckShieldAlert

The incident coincides with rapid growth for Hyperliquid, which gained traction due to its rewards program aimed at increasing liquidity and participation from users, culminating in a major airdrop affecting over 94,000 addresses.

In just the past week, the platform has processed upward of $3.5 billion in trading volume, based on data from DefiLlama.

As decentralized exchanges (DEXs) continue to thrive, this incident raises vital questions about user security in a self-custody and smart contract-based environment.

How Traders Can Enhance Their Security

Although the cause of this incident continues to be examined, security analysts stress that DEX users can adopt precautions to mitigate risks.

DEXs like Hyperliquid provide traders with complete custody over their crypto assets, but this autonomy comes with the responsibility of securing those assets. Experts advocate for using a “hot” wallet for everyday transactions and a “cold” wallet for long-term savings to keep the majority of assets offline and shielded from online threats.

It is advisable to keep only a fraction of a trader’s assets in wallets linked to DEXs to confine potential losses in cases of private key breaches or malicious smart contracts.

To safeguard against private key exploits, Hyperliquid users must refrain from sharing their private keys or seed phrases, even during API wallet configurations. The platform’s official guidelines categorically warn, “Do not share your private key with anyone.”

Users should also be wary of counterfeit “authorization” pages or support communications on platforms like Telegram or Discord, as these often impersonate legitimate staff to expropriate credentials.

As of Q3 2025 As of the third quarter of 2025, crypto exchanges and DeFi protocols are the most exploited sectors. Source: CertiK

Post-exploit, crypto exchange MEXC has recommended that users “check positions and approvals on a block explorer,” emphasizing that breaches often happen when traders permit excessive access to DeFi protocols.

Security experts advise consistently reviewing and revoking unnecessary permissions through tools like Etherscan’s Token Approvals feature or similar management platforms.