Hyperliquid Account Compromise — $738.6K USDC Laundered + $956K HYPE Permanently Lost

On September 9, 2026, an attacker gained unauthorized access to a Hyperliquid user account — most likely via a leaked private key or an approved signing agent — and immediately drained approximately $738,600 USDC. The stablecoins were laundered through Circle's native CCTP bridge and fragmented into a peel chain of unequal tranches (roughly 443K, 450K, 147.5K, 147.8K and 50K) across multiple intermediary wallets before a portion reached an address linked to the Bitget exchange, a pattern designed to defeat automated tracing thresholds. Separately, the attacker immediately undelegated 10,287 staked HYPE tokens (worth roughly $956,000 at the time), triggering Hyperliquid's mandatory 7-day unstaking waiting period — a feature with no user-triggered pause, freeze, or recovery path once initiated. Before extracting the underlying funds, the attacker closed a series of active HIP-2 leveraged trading positions on the victim's account (including tokenized equities and commodities such as INTC, GOLD, SILVER, ZEC, PUMP), indicating the compromised account was an active trader rather than passive storage. Exactly at the expiration of the 7-day delay (around September 16-17), a withdrawal of the full 10,287 HYPE was initiated with no intervention having occurred in the interim, confirming the tokens as a permanent loss. Total combined loss across both legs of the theft is approximately $1.69M, more than double the figure initially reported based on the USDC leg alone.