Original Title: (Hyperliquid personally reconciles, the perfect public relations behind is the underlying siege of competitors)
Original Author: angelilu, Foresight News
On December 20, 2025, a technical article published on blog.can.ac (Reverse Engineering Hyperliquid) directly dismantled the Hyperliquid binary file through reverse engineering, accusing it of nine serious issues ranging from 'insolvency' to 'God mode backdoor.' The article bluntly stated:
'Hyperliquid is a centralized trading platform disguised as a blockchain.'
In the face of FUD, Hyperliquid's official response was a lengthy article, perhaps this is not just a simple rebuttal, but a declaration of war on the route of 'who is the true decentralized trading facility.' Although the official clarified the issue of fund security, there remain intriguing 'blank spaces' in certain sensitive areas of decentralization.
Where did the 362 million dollars go? The audit blind spots under the 'dual ledger'.
One of the most damaging points in the accusations is that the user assets within the Hyperliquid system are 362 million dollars less than the on-chain reserves. If true, this means that it operates as a partially reserved 'on-chain FTX'.
However, upon verification, this is a misinterpretation caused by 'architectural upgrades' leading to information asymmetry. The auditor's logic is: Hyperliquid reserves = USDC balance on the Arbitrum cross-chain bridge. Based on this logic, he checked the cross-chain bridge address and found that the balance was indeed less than the total user deposits.
Hyperliquid responds that it is undergoing a complete evolution from 'L2 AppChain' to 'independent L1'. In this process, asset reserves have evolved into a dual-track system:
The accuser completely ignores the native USDC on HyperEVM, according to on-chain data (as of the time of publication):
· Arbitrum cross-chain balance: 3.989 billion USDC (can be checked on Arbiscan).
· Native balance of HyperEVM: 362 million USDC (can be checked on Hyperevmscan)
· HyperEVM contract balance: 0.59 billion USDC.
Total solvency = 3.989 billion + 362 million + 59 million ≈ 4.351 billion USDC.
This figure matches exactly with the total user balances on HyperCore. The so-called '362 million gap' is precisely the native assets that have already migrated to HyperEVM. This is not a disappearance of funds but a transfer of funds between different ledgers.
The 9-point accusation reconciliation: What has been clarified? What has been avoided?
Accusations that have been clarified.
Accusation: 'CoreWriter' God mode: The accusation states that it can print money out of thin air and misappropriate funds.
Response: The official explanation is that this is the interface for L1 and HyperEVM interaction (such as staking), with restricted permissions and no ability to misappropriate funds.
Accusation: 362 million funding gap.
Response: As mentioned above, this is due to uncalculated Native USDC.
Accusation: Unpublished lending agreements.
Response: The official points out that the documentation for the spot/lending function (HIP-1) has been made public and is in the pre-release stage, not operating in secret.
Accusations that have been acknowledged but have reasonable explanations.
Accusation: The binary file contains 'modify transaction volume' code (TestnetSetYesterdayUserVlm).
Response: Acknowledged. But explains that this is testnet (Testnet) residual code used to simulate fee logic, and the mainnet nodes have physically isolated this path, preventing execution.
Accusation: Only 8 broadcasting addresses can submit transactions.
Response: Acknowledged. It explains that this is an anti-MEV (Maximum Extractable Value) measure to prevent users from being front-run. It promises to implement a 'multi-proposer' mechanism in the future.
Accusation: The chain can be 'frozen intentionally' and has no revocation feature.
Response: Acknowledged. It explains that this is a standard process during network upgrades, requiring a full network pause to switch versions.
Accusation: Oracle prices can be instantly overridden.
Response: Explained as a design for system security. In order to promptly liquidate bad debts during extreme fluctuations like 10/10, the validator oracle indeed has not set a time lock.
Response missing / ambiguous.
In our verification, there are two points of accusation that were not directly addressed or completely resolved in the official response:
Accusation: Governance proposals are unqueryable, users can only see that voting has occurred, but the on-chain data does not include the specific text of the proposals.
Response: The official did not address this point in the long article. This means that Hyperliquid's governance is still a 'black box' for ordinary users, where you can see the results but not the process.
Accusation: The cross-chain bridge has no 'escape hatch', withdrawals may be indefinitely reviewed, and users cannot force withdrawals back to L1.
Response: Although the official explained that the locking of the bridge during the POPCAT incident was for safety, it did not refute the architectural fact of 'no escape hatch'. This indicates that at the current stage, users' assets entering and exiting are highly dependent on the release of the validator set, lacking the censorship-resistant forced withdrawal capability of L2 Rollup.
'Pulling down' competitors.
The most interesting aspect of this incident is that it forced Hyperliquid to reveal its cards, giving us the opportunity to reassess the landscape of the Perp track. The official response rarely 'pulled down' competitors, targeting Lighter, Aster, and even industry giant Binance.
It stated that 'Lighter uses a single centralized sequencer, and its execution logic and zero-knowledge proof (ZK) circuits are not public. Aster uses centralized matching and even provides dark pool trading, which can only be achieved in the case of a single centralized sequencer with unverifiable execution processes. Other protocols containing open-source contracts do not have verifiable sequencers.'
Hyperliquid bluntly categorizes these competitors, claiming they all rely on 'centralized sequencers'. The official emphasizes: On these platforms, apart from the sequencer operators, no one can see the complete state snapshot (including order book history and position details). In contrast, Hyperliquid attempts to eliminate this 'privilege' by having all validators execute the same state machine.
And this 'pulling down' may also stem from Hyperliquid's concerns about its current market share. According to DefiLlama's trading volume data over the past 30 days, the market landscape has formed a three-way competition:
· Lighter: Trading volume of 232.3 billion dollars, currently ranking first, accounting for about 26.6%.
· Aster: Trading volume of 195.5 billion dollars, ranked second, accounting for about 22.3%.
· Hyperliquid: Trading volume of 182 billion dollars, ranked third, accounting for about 20.8%.
Faced with the later rising trading volumes of Lighter and Aster, Hyperliquid attempted to play the 'transparency' card - namely, 'Although I have 8 centralized broadcasting addresses, I am fully on-chain and verifiable; while you can't even check'. However, it is worth noting that although Hyperliquid slightly lags behind the top two in trading volume, it shows a crushing advantage in open interest (OI).
Public response: Who is shorting HYPE?
In addition to technical and financial issues, the community is most concerned about recent rumors that the HYPE token has been shorted and dumped by 'insiders'. In response, a member of the Hyperliquid team provided a qualitative reply on Discord: 'The shorting address starting with 0x7ae4 belongs to a former employee', who was once a team member but was dismissed in early 2024. The personal trading actions of this former employee are unrelated to the current Hyperliquid team. The platform emphasizes that extremely strict HYPE trading restrictions and compliance reviews are currently in place for all active employees and contractors, prohibiting insider trading.
This response attempts to downgrade the accusation of 'team wrongdoing' to 'former employee's personal behavior', but the community may still expect more detailed disclosures regarding the transparency of token distribution and unlocking mechanisms.
Don't Trust, Verify
Hyperliquid's clarification tweet can be described as a textbook-level crisis PR - not relying on emotional output but on data, code links, and architectural logic. It did not stop at proving its innocence but turned the tables, strengthening its brand and advantages of 'fully on-chain state' by comparing its architecture with competitors.
Although FUD has been debunked, the implications of this incident for the industry are profound. As DeFi protocols evolve into independent application chains (AppChain), the architecture becomes increasingly complex, and asset distribution becomes more fragmented (Bridge + Native). The traditional method of 'just looking at contract balances' is no longer effective.
For Hyperliquid, proving that 'money is there' is just the first step. The real challenge lies in gradually transferring the authority of those 8 submission addresses while maintaining high performance and resistance to MEV, truly achieving the transition from 'transparent centralization' to 'transparent decentralization', which is the necessary path to becoming the 'ultimate DEX'.
For users, this incident once again confirms the iron rule of the crypto world: do not trust any narratives, verify every byte.
Original link.
