DeFi faces new test as low-liquidity token gets manipulated

Introduction

Last week, DeFi saw another major exploit — this time targeting Hyperliquid, one of the largest decentralized perpetual futures platform. The attack followed a familiar pattern, reminiscent of past incidents like Mango Markets: exploit thin liquidity on spot and perp markets to manipulate the price of a low-liquidity token — in this case, Jelly-My-Jelly.

What happened? On March 26, 2025, a trader attacked Hyperliquid’s Liquidity Provider (HLP) vault by opening large positions in Jelly-My-Jelly’s perpetual futures market: One short worth ~$4 million, and two longs totaling ~$3 million.

Jelly-My-Jelly, a Solana-native token with a modest $15M market cap, was listed on both centralized (CEXs) and decentralized (DEXs) exchanges. Its daily liquidity, as measured by 1% market depth, averaged just $72K — less than half of similar low-cap tokens like Slerf ($190K) — and over 1,000 times lower than Solana’s native token, SOL.

For this attack, the trader carried out two coordinated actions while simultaneously opening short and long positions on the asset’s perpetual markets:

1. Forced Liquidation: They withdrew the margin supporting the short, triggering its forced liquidation and shifting the burden onto Hyperliquid’s HLP vault.
2. Spot Market Pump: At the same time, they aggressively bought Jelly-My-Jelly on spot markets. Due to the token’s thin liquidity, this caused a sharp price spike. Since Hyperliquid’s perpetual settlement relied on a spot-price-derived oracle, the manipulation immediately inflated perp prices.

Within an hour, Jelly-My-Jelly’s price surged over 500%, jumping from $0.00806 to $0.0517.

This price manipulation exposed cracks in Hyperliquid’s liquidation engine. As open interest exceeded key thresholds, new positions were blocked, preventing liquidators from effectively closing the liquidation of the attacker’s short position. The delay amplified losses, further worsening the situation for the HLP vault.

Adding fuel to the fire, Binance and OKX listed Jelly-My-Jelly perps on the same day, following a surge of activity on Bybit, where Jelly-My-Jelly hit its highest-ever daily volume at $150M.

Additionally, the Jellyjelly activity last week saw liquidations on either side of the market as prices whipsawed. Short liquidations dominated proceedings early in the day before longs were caught offside in the afternoon. The largest single liquidation on March 26 was a short position worth around $250k.

These operations show how calculated the attack was. On-chain data reveals that, as early as 10 days before the attack on March 26, the attacker was already running test transactions on Hyperliquid, likely to refine their strategy (read a complete analysis here).

Data points

Trump Media group works with Crypto.com on ETFs.

The Trump media group announced its intention to launch a range of crypto-related exchange-traded funds last week. It plans to launch funds investing in projects with a “Made in America” theme. This will include crypto assets such as BTC and CRO, the former’s price spiked following the announcement.

CRO is an exchange token for the Crypto.com platform. While exchange tokens had taken a hit after the FTX collapse, regulation in the U.S. has benefited these projects. However, volumes and liquidity remain very lower for these assets. While volume in CRO markets did spike after the election in November—and again last week—it remains far lower than other assets vying for ETF status.

The 2% market depth of CRO is only around $10mn on Kaiko Indices vetted exchanges. These are exchanges with USD-quoted pairs, eligible for ETF benchmark use. While this is very low and only a fraction of the liquidity available in BTC and ETH markets it does come closer to some other ETFs vying for approval at present, such as ADA and APT.

Volume and liquidity conditions had been crucial in the decision making process of the previous administration, with low liquidity seen as a deterrent to approval. However, with new leadership at the SEC issuers are getting more ambitious with applications.

Stablecoin CVD on US markets flips positive.

Last week saw heightened market volatility, with both crypto and stocks rallying on Monday as tariff concerns eased, only to retreat on Friday due to hotter-than-expected US inflation data and renewed stagflation fears.

Despite the pullback on Friday, USDT-USD cumulative volume delta (CVD) turned positive over the past 15 days, signaling a potential shift in sentiment. Historically, traders in developed markets accumulate stablecoins during bullish phases and liquidate them in downturns. In recent months, USDT-USD and USDT-EUR CVDs had remained negative, reflecting a cautious outlook.

In contrast, USDT accumulation remained strong in developing countries like Turkey, Colombia, and Mexico, driven by FX volatility.

While sentiment may be shifting, Bitcoin’s rising implied volatility (IV) signals uncertainty ahead. On Friday, BTC’s short-term IV surged above longer-term levels, with April contracts jumping from 47.8% on March 24 to 63.2% on March 30.

This suggests option traders are bracing for near-term turbulence, likely around the April 2 tariff announcement, with volatility concentrated in the short term.