HLP’s Profit Bursts and Notable Incidents
Hyperliquid's community-owned market-making vault, HLP, has generated $136.9M in cumulative profit since its May 2023 launch, growing total value locked from zero to a peak of $603.9M in September 2025. While TVL has swung between roughly $150M and $600M across repeated boom-bust cycles, cumulative PnL has climbed in a near-staircase pattern, long flat stretches punctuated by sharp jumps that tend to arrive precisely when market volatility is at its peak.
Two of those jumps account for a disproportionate share of the vault's lifetime earnings. The October 10, 2025 market-wide flash crash added an estimated $41.5M to HLP's PnL in a single weekend, resulting in a ~10% gain for depositors. On January 31, 2026, the liquidation of trader Garrett Jin's leveraged ETH long added another $15M, a single-event return of 5.8% to depositors. Combined, these two events account for roughly 41% of HLP's all-time profit, despite covering a combined span of less than two weeks out of the vault's nearly three-year history. This highlights HLP’s antifragile design where HLP's best days are the market's worst.
The vault has also been deliberately targeted on multiple occasions, and has absorbed every attack without its cumulative PnL ever turning negative. Two separate manipulation attempts in 2025, the March 26 JELLYJELLY incident and the November 12 POPCAT attack, were each engineered by traders exploiting how the vault inherits liquidated positions. Both failed to break it.
TVL Decline Reflects Growing Depositor Caution
Despite its general success, HLP's total value locked peaked at $603.9M in September 2025 and has since fallen to roughly $268.6M by June 2026, a decline of more than 55% over nine months. While cumulative PnL has continued its gradual climb across the same period, the gap between new deposits coming in and existing depositors withdrawing has widened noticeably.
Two factors likely explain the outflow. First, the vault's manipulation incidents have become increasingly visible and increasingly patterned. JELLYJELLY in March 2025, followed by POPCAT in November 2025, and a separate Fartcoin-related incident in April 2026, demonstrated that HLP's role as backstop liquidator makes it a predictable and repeatable target for coordinated attacks. Each incident renewed scrutiny of whether the vault's passive depositors are adequately compensated for the tail risk they are absorbing.
Second, HLP's PnL profile is not a steady yield. The chart makes clear that the vault can go weeks or months generating little to no measurable profit, with meaningful returns concentrated in a small number of high-volatility events. For depositors expecting consistent returns, those long flat stretches offer little incentive to keep capital locked in the vault when manipulation risk remains an open question.
What HLP actually is
HLP, short for Hyperliquidity Provider, is Hyperliquid's protocol-owned vault. Anyone holding USDC on Hyperliquid can deposit into it, and in return depositors share proportionally in the vault's PnL from three sources: market-making spreads across the exchange's 100-plus listed perps, funding rate capture, and backstop liquidations. When a trader's position falls below maintenance margin and the order book cannot absorb the full size of the close, HLP becomes the counterparty of last resort, taking over the position and unwinding it over time. This dual role, liquidity provider in normal markets, backstop absorber in stressed ones, is precisely what makes the vault most profitable when volatility spikes. There is no performance fee. Profits, and losses, flow entirely to depositors.
The JELLYJELLY Incident
On March 26, 2025, a trader shorted the low-liquidity memecoin JELLYJELLY, then pumped its spot price across exchanges until HLP, which had inherited the losing short through the liquidation engine, faced unrealized losses that peaked between $12M and $13.5M. Two centralized exchanges briefly listing JELLY futures during the squeeze added further pressure on the vault. Rather than let the position run, Hyperliquid's validator set voted within minutes to delist the JELLY contract and force-settle every open position at the attacker's original entry price rather than the manipulated market price. HLP's position ultimately closed at a profit of about $703,000 meaning that the attack failed.
The governance precedent, however, was controversial as it showed that a protocol marketed as decentralized used a centralized validator vote to override market pricing during an active attack, a decision that drew comparisons to centralized exchange bailouts and renewed scrutiny of how much control Hyperliquid's validator set actually holds. In the end, Hyperliquid’s swift action has worked in depositors' favor.
The POPCAT Attack
By November 12, 2025, attackers had a clear playbook. An anonymous trader withdrew $3M in USDC from a centralized exchange, split it across 19 wallets, built a roughly $26M to $30M leveraged long position in the memecoin POPCAT behind a fake $20M buy wall, then pulled the wall (removed $20M worth of limit buy orders). The resulting price collapse triggered cascading liquidations that left HLP with approximately $4.9M in bad debt, the third manipulation event targeting the vault within the year. Hyperliquid temporarily paused its Arbitrum bridge as a precaution before resuming normal operations. The $4.9M loss represented less than 1% of HLP's TVL at the time, and cumulative PnL continued climbing in the weeks that followed.
October 10 Was HLP’s Single Best Day
A tariff announcement triggered the largest single-day deleveraging event in crypto history on October 10, 2025, with roughly $19B liquidated across the market in 24 hours. Hyperliquid alone accounted for more than $10B of that figure, the highest of any venue. HLP, acting as the market's backstop liquidator, is estimated to have earned $40M to $41.5M in fees that weekend, a roughly 10% return to depositors in under 48 hours. The event also triggered Hyperliquid's first cross-margin auto-deleveraging event in over two years, as liquidations briefly outran available counterparties. Where most participants were nursing losses, HLP was collecting them. While the event was devastating for most traders, Hyperliquid’s technical design was showcased as it handled record liquidations (the highest of any platform on 10/10) without incurring any bad debt.
Methodology
HLP vault data was sourced from Hyperliquid's public info API via the vaultDetails endpoint, queried against the HLP vault address (0xdfc24b077bc1425ad1dea75bcb6f8158e10df303) on June 30, 2026. The API's allTime portfolio bucket returns a fixed downsampled series of approximately 93 data points spanning the vault's full history. To ensure consistent spacing, this series was resampled to a biweekly cadence by selecting the nearest available snapshot to each 14-day target interval, resulting in 83 data points used in the chart.
Cumulative PnL figures are drawn from the pnlHistory field, which represents the vault's all-time accumulated profit since inception rather than a daily or periodic measure. TVL figures are drawn from the accountValueHistory field of the same response, representing total USDC deposited in the vault at each snapshot.
Figures for individual incidents, including the October 10 flash crash, JELLYJELLY manipulation, POPCAT attack, and Garrett Jin liquidation, were sourced from on-chain analysts including MLM, and from crypto media including CoinDesk and The Block. Where figures vary across sources, ranges are stated. Incident dates reflect the date of the on-chain event as reported, not the snapshot date nearest to that event in the biweekly series.
If you cite these insights, we would appreciate a link credit to this article on CoinGecko, which allows us to keep supplying you with useful data-led content.
Related article: Hyperliquid Top Builders
This study is for illustrative and informational purposes only, and is not financial advice.
Or check it out in the app stores
