I didn't need to open a transaction tracer to know this wasn't a routine liquidation event. When SKHX perpetual on Hyperliquid hit $927 on March 2025, the market didn't just correct—it collapsed. SK Hynix stock dropped 14.65% that day. The contract dropped to a price implying a 99% decline. That gap isn't leverage. It's a system failure.
Let me be clear: a 10x or 20x long on a Korean stock equity perpetual doesn't go to $927 unless the pricing engine is broken. The margin mechanics on HyperCore are solid—I've stress-tested similar engines. The bottleneck wasn't the blockchain or the matching engine. It was the oracle relay. And that relay was controlled by a single entity: TradeXYZ, the market deployer.
This is the story of how Hyperliquid's ambitious HIP-3 framework—designed to let anyone create custom perpetual markets—became the vector for a flash crash that exposed a profound design flaw. It's a story about the gap between innovation and risk management, about how giving deployers control over pricing without adequate guardrails creates a single point of failure that can break a market in minutes.
The Context: Hyperliquid and the HIP-3 Experiment
Hyperliquid is a high-performance, independent Layer 1 blockchain optimized for derivatives trading. Its core product is a fully on-chain order book for perpetual futures, matched by a custom consensus engine called HyperCore. The platform has achieved low latency and high throughput, attracting significant volume and TVL.
But Hyperliquid's real innovation—and its risk—lies in HIP-3. This improvement proposal allows third parties to deploy their own perpetual markets on Hyperliquid. The deployer (TradeXYZ, in this case) controls critical parameters: the oracle definition, the oracle price feed, leverage limits, and settlement logic. HyperCore handles the execution and margin calculations, but the deployer is the sole source of the price input.
TradeXYZ deployed the SKHX market in early 2025. SKHX is a synthetic perpetual tracking the stock price of SK Hynix, a major Korean semiconductor company. The market used a triple-source pricing mechanism for the mark price: the Hyperliquid order book mid-price, the Pyth Lazer oracle price, and a third price provided by TradeXYZ's own relayer. The final mark price was the median of these three.
On paper, that sounds robust. In practice, it created a vulnerability that TradeXYZ's relayer could—and did—fail catastrophically.
The Core Dissection: How the Relayer Broke
Let's trace the attack vector transaction by transaction. On the day of the crash, the KOSPI index triggered a circuit breaker due to a 10.84% drop. SK Hynix stock opened sharply lower, eventually closing down 14.65%. That's a volatile but not unexpected move for a single stock.
The SKHX perpetual, however, collapsed to $927—a price that implies the stock had lost over 99% of its value. No leveraged product should do that unless the pricing mechanism is disconnected from reality.
Here's what I believe happened based on the available data and my own forensic experience with similar failures:
Step 1: The Korean market opens with a gap down.
SK Hynix opens significantly lower. The stock price data feeds into multiple sources: the Korean exchange itself, Pyth Lazer (which aggregates global exchange data), and TradeXYZ's own relayer.
Step 2: TradeXYZ's relayer produces a stale or corrupted price.
The relayer is a backend service that periodically pushes prices to Hyperliquid. During a circuit breaker, trade halts can cause stale data. But more critically, the relayer may have a flawed algorithm for handling cross-market data—specifically the USD/KRW exchange rate and the stock's dollar-denominated value.
SK Hynix is traded in KRW on the KOSPI. The SKHX contract likely denominates in USD. The relayer must convert the KRW stock price to USD using an exchange rate feed. If during the opening panic the exchange rate feed lagged or spiked, the computed dollar price could deviate wildly. Combine that with a stock that is already down 14%, and you get a formula for disaster.
Step 3: The median calculation picks the wrong price.
Hyperliquid's mark price is the median of three sources: - Order book mid-price (likely illiquid during the open, so it follows the low price) - Pyth Lazer (likely updating, but maybe slower during circuit breaker) - TradeXYZ's corrupted relayer price
If two of the three sources are low or corrupted, the median will be low. If the order book is thin and the relayer output is near zero, the mark price plummets. The system then triggers mass liquidations, which further depress the order book, creating a death spiral.
Step 4: The flash crash executes in seconds.
The contract goes from $X (pre-open) to $927. Liquidations cascade. Open interest drops 20% in a single day. The damage is done before anyone can manually intervene.
This sequence matches what I've seen in other oracle failures—most notably the 2020 Compound flash loan exploit, where a logical flaw in the interest rate calculation allowed a single transaction to drain liquidity. The difference here is that the flaw wasn't in the core protocol; it was in the deployer-controlled relayer. That's a systemic failure of the HIP-3 framework.
The Missing Pieces: What We Still Don't Know
Despite the event being several days old, TradeXYZ and Hyperliquid have released no detailed post-mortem. We don't know:
- The exact price of each of the three sources at the moment of the crash.
- Whether TradeXYZ's relayer algorithm had a known bug or a configuration error.
- Whether the USD/KRW conversion was a contributing factor.
- Whether any single transaction triggered the collapse, or if it was a gradual decay.
This opacity is itself a red flag. In my experience, teams that delay transparency usually have something to hide—or they're still trying to figure out what went wrong. Neither is comforting.
The Contrarian Angle: Did the Bull Case Survive?
Let's be fair to the optimists. Hyperliquid's core engine—HyperCore—did what it was supposed to do. It processed the liquidations correctly. The order book didn't halt. The blockchain didn't fail. The crash was contained to one market. That's a testament to the platform's isolation properties.
Moreover, the HIP-3 framework is designed to allow innovation without permission. TradeXYZ couldn't have deployed SKHX on most other platforms—they would have required centralized approval or a synthetic asset pool. HIP-3 gave them the flexibility to create a product that traders clearly wanted (OI was significant before the crash).
But the bulls miss the point: flexibility without safety is recklessness. HIP-3 gives deployers control over the most sensitive parameter in a derivatives market—the price input. That's like letting an airline pilot choose their own altimeter without cross-checking. In calm skies, it works fine. In a storm, it's a crash waiting to happen.
The crash doesn't kill the bull case for Hyperliquid itself—the platform has strong fundamentals. But it kills the narrative that HIP-3 markets are safe for retail participants without additional safeguards. The premium that traders assign to Hyperliquid relative to dYdX or GMX will shrink until a solution is deployed.
The Takeaway: Accountability, Not Blame
We need a clear answer to two questions: - What exactly broke in TradeXYZ's relayer? - What will Hyperliquid do to prevent this from happening again?
If the answer to the first is 'a simple bug that we've fixed' and the answer to the second is 'we're adding a mandatory second oracle source and real-time monitoring for deployers,' then this event becomes a valuable stress test. If the answer is silence or vague statements, then trust will erode irreversibly.
The broader lesson for DeFi is that semi-decentralized models—where the platform controls the settlement but the deployer controls the inputs—are inherently fragile. They combine the worst of both worlds: the platform's lack of responsibility with the deployer's lack of oversight. Regulation will eventually force a choice between full decentralization (with community-driven oracle selection) and full centralization (with audited, insured price feeds).
For now, I'm watching the on-chain data. The wallets aren't moving suspiciously, and the team hasn't panicked. That's a good sign. But the clock is ticking. Every day without a detailed report is a day that the shadow of $927 grows longer.
You don't need to be a forensic detective to see the flaw. You just need to look at the system architecture. And once you see it, you can't unsee it.
