On Saturday, September 27, 2025, at approximately 22:00 Singapore time (SGT), the Hyperdrive team was alerted to suspicious on-chain activity affecting the Primary and Treasury USDT₀ markets. Out of an abundance of caution, all markets were immediately paused while we investigated.

Following a rapid internal review, we confirmed that the activity was the result of a malicious exploit. Our incident response plan was activated, and a dedicated war room was assembled consisting of the Hyperdrive core team, external auditors, and an on-chain forensics group.

Each Hyperdrive Market is a stand-alone ERC-4626 vault where the loan token serves as the vault asset. Markets allow users to supply and withdraw collateral, and to borrow and repay debt.

A key feature of the protocol is support for the Operator model defined in EIP-7540, which allows approved operators to manage user positions on their behalf. Currently, the only approved operator across all markets is the Hyperdrive Router — a multicall-style contract that batches multiple actions into a single transaction to enhance user experience.

The Router also includes a general CALL action type, designed to permit external contract calls. For safety, the CALL action is governed by an allowlist that restricts execution to approved external contracts. However, this allowlist was referencing the Hyperdrive Address Registry, which serves as a canonical mapping of all protocol contract addresses — including core Market contracts themselves.

By using the Router’s CALL action in combination with the Address Registry, the attacker was able to target the Market contracts directly and perform operations as an authorized operator. This led to three distinct exploit vectors:

1. Borrowing USDT against user accounts on the Primary USDT₀ Market.

2. Withdrawing thBILL collateral from the Treasury USDT₀ Market.

3. Sweeping unspent ERC-20 token allowances from users who had previously approved the Router but never completed a redemption.

The first two exploits were mitigated when the markets were paused. The third vector targeted residual token allowances and was unrelated to active market state.

Upon confirming the exploit:

• All markets were paused to prevent further action.

• The Router contract was upgraded to a bricked version, effectively disabling all functionality and eliminating any further risk.

• The response and containment measures were completed within a few hours of the initial alert.

After stabilizing the system, the team elected to perform a remediation of user funds before resuming market operations due to the nature of the exploit involving user-level borrowing actions.

Our priority throughout the process has been user protection and transparency. The following steps were taken:

• Comprehensive forensic analysis to identify all affected accounts.

• Balance and position remediation for impacted users.

• Security patch and architectural update to the Router and Address Registry integration.

While all components of the system had previously been audited, the Router’s CALL action had been reviewed in isolation. In context, the design was secure, but the interaction with the Address Registry introduced an unforeseen systemic risk — a lesson that underscores the importance of holistic, system-level audits in modular architectures.

We are unable to publicly identify the threat actor responsible at this time. However, on-chain forensics indicate that the threat actor has been involved in multiple exploits across other protocols. The threat actor is currently the target of at least one ongoing law enforcement investigation. We are cooperating with ecosystem partners to share intelligence and strengthen collective defenses.

This incident serves as a reminder that even well-audited, permission-restricted systems can be exploited through unexpected composability.

We remain deeply committed to maintaining the security, integrity, and transparency of the Hyperdrive protocol.

We thank our community, partners, and users for their patience and support as we continue to make Hyperdrive stronger and more resilient.

— The Hyperdrive Team

On Saturday, September 27, 2025, at approximately 22:00 Singapore time (SGT), the Hyperdrive team was alerted to suspicious on-chain activity affecting the Primary and Treasury USDT₀ markets. Out of an abundance of caution, all markets were immediately paused while we investigated.

Following a rapid internal review, we confirmed that the activity was the result of a malicious exploit. Our incident response plan was activated, and a dedicated war room was assembled consisting of the Hyperdrive core team, external auditors, and an on-chain forensics group.

Each Hyperdrive Market is a stand-alone ERC-4626 vault where the loan token serves as the vault asset. Markets allow users to supply and withdraw collateral, and to borrow and repay debt.

A key feature of the protocol is support for the Operator model defined in EIP-7540, which allows approved operators to manage user positions on their behalf. Currently, the only approved operator across all markets is the Hyperdrive Router — a multicall-style contract that batches multiple actions into a single transaction to enhance user experience.

The Router also includes a general CALL action type, designed to permit external contract calls. For safety, the CALL action is governed by an allowlist that restricts execution to approved external contracts. However, this allowlist was referencing the Hyperdrive Address Registry, which serves as a canonical mapping of all protocol contract addresses — including core Market contracts themselves.

By using the Router’s CALL action in combination with the Address Registry, the attacker was able to target the Market contracts directly and perform operations as an authorized operator. This led to three distinct exploit vectors:

1. Borrowing USDT against user accounts on the Primary USDT₀ Market.

2. Withdrawing thBILL collateral from the Treasury USDT₀ Market.

3. Sweeping unspent ERC-20 token allowances from users who had previously approved the Router but never completed a redemption.

The first two exploits were mitigated when the markets were paused. The third vector targeted residual token allowances and was unrelated to active market state.

Upon confirming the exploit:

• All markets were paused to prevent further action.

• The Router contract was upgraded to a bricked version, effectively disabling all functionality and eliminating any further risk.

• The response and containment measures were completed within a few hours of the initial alert.

After stabilizing the system, the team elected to perform a remediation of user funds before resuming market operations due to the nature of the exploit involving user-level borrowing actions.

Our priority throughout the process has been user protection and transparency. The following steps were taken:

• Comprehensive forensic analysis to identify all affected accounts.

• Balance and position remediation for impacted users.

• Security patch and architectural update to the Router and Address Registry integration.

While all components of the system had previously been audited, the Router’s CALL action had been reviewed in isolation. In context, the design was secure, but the interaction with the Address Registry introduced an unforeseen systemic risk — a lesson that underscores the importance of holistic, system-level audits in modular architectures.

We are unable to publicly identify the threat actor responsible at this time. However, on-chain forensics indicate that the threat actor has been involved in multiple exploits across other protocols. The threat actor is currently the target of at least one ongoing law enforcement investigation. We are cooperating with ecosystem partners to share intelligence and strengthen collective defenses.

This incident serves as a reminder that even well-audited, permission-restricted systems can be exploited through unexpected composability.

We remain deeply committed to maintaining the security, integrity, and transparency of the Hyperdrive protocol.

We thank our community, partners, and users for their patience and support as we continue to make Hyperdrive stronger and more resilient.

— The Hyperdrive Team