OAK — OnChain Attack Knowledge

Worked example · 2025-01

Hyperliquid trading-bot malware campaign — Arbitrum / Hyperliquid — 2025

Loss
aggregate mid-six-figures USD across the campaign cohort. Individual victim losses range from mid-four-figures (smaller trading accounts with a few thousand dollars of margin) to low-six-figures (larger trading accounts with significant margin deposited on Hyperliquid). The Hyperliquid ecosystem's API-key-based trading architecture — where API secrets have withdrawal capabilities and are not scoped to trading-only permissions — made the per-victim loss shape particularly severe: a compromised API secret enabled full account withdrawal, not just trade execution on the victim's behalf.
OAK Techniques observed
OAK-T4.010 (Fake Security-Tool / Browser-Extension Phishing — primary; fake "Hyperliquid Trading Bot SDK" Chrome extensions impersonated legitimate trading-bot tooling rather than general wallet extensions, demonstrating that T4.010 extends beyond wallet extensions to protocol-specific tooling); OAK-T11.009 (Supply-Chain Attack via Compromised Package Distribution — co-occurring; the campaign's npm/developer-tooling distribution surface overlapped with trader-tooling supply-chain campaigns, with shared infrastructure fingerprints between the Chrome extension campaign and malicious npm packages targeting the Hyperliquid developer ecosystem).
Attribution
pseudonymous The Chrome extension publisher accounts (typosquatted developer-account names) and the associated command-and-control (C2) infrastructure showed patterns overlapping with npm trader-tooling supply-chain campaigns targeting the Hyperliquid and broader perps-DEX developer ecosystem. The attribution-confidence is "strong" at the campaign-cluster level (infrastructure fingerprint overlap with known trader-tooling supply-chain campaigns) and "pseudonymous" at the individual-operator level (no named individuals publicly attributed).
Key teaching point
T4.010 extends beyond general wallet extensions (MetaMask, Ledger, Rabby, Phantom) to protocol-specific tooling — any browser-extension distribution surface targeting a specific trading ecosystem is a T4.010 vector. The Hyperliquid campaign demonstrates that the load-bearing T4.010 primitive is the extension-store distribution channel (Chrome Web Store, Firefox Add-ons) as a trust surface, not the specific tool being impersonated. When a trading ecosystem has API-key-based architecture where API secrets carry withdrawal capabilities, the per-victim extraction surface is structurally more severe than seed-phrase-exfiltration extensions targeting general wallet users — the API secret is the direct withdrawal primitive, not a key-material root requiring derivation.

Summary

Hyperliquid is a perpetual-futures DEX on its own L1 (built on Arbitrum) with an API-key-based trading architecture. Traders interact with Hyperliquid via API — depositing collateral, placing orders, managing positions, and withdrawing funds are all conducted through API calls authenticated with an API secret key. The Hyperliquid API secret has broad permissions: it can withdraw funds, not just execute trades. This API-key-based architecture created a specific T4.010 surface distinct from the general wallet-extension phishing campaigns covered by the first T4.010 canonical example.

During the 2025-01 to 2025-03 surge in Hyperliquid trading volumes — driven by the Hyperliquid points program (rewarding trading volume with points toward a future airdrop) and the launch of new perp markets on the platform — a campaign emerged that targeted Hyperliquid trader-bot developers with fake "Hyperliquid Trading Bot SDK" Chrome extensions and companion desktop applications. Unlike the general MetaMask/Ledger extension phishing campaigns (T4.010 first example), these extensions impersonated specific trading-bot tooling rather than general wallet extensions.

The campaign exploited the trader-bot developer demographic: users who were building automated trading strategies for Hyperliquid, searching for SDK libraries, trading-bot templates, and developer tooling. The fake extensions appeared in the Chrome Web Store under names like "Hyperliquid Trading Bot SDK," "HL Trader Pro," "Hyperliquid Algo Builder," and "HL Market Maker Toolkit" — names that mimicked genuine developer tooling that a Hyperliquid trader-bot builder would search for. The extensions requested broad permissions (read all browsing data, communicate with cooperating websites, clipboard access) and, when installed, exfiltrated Hyperliquid API secrets and private keys stored in the browser's local storage or entered into the extension's configuration UI.

The extraction surface was particularly high-impact for two reasons:

  1. The Hyperliquid API secret is a direct withdrawal primitive — it authorises fund withdrawals, not just trading. There is no permission-scoping mechanism that limits an API secret to trade-only operations. A compromised API secret means the attacker can withdraw all funds from the victim's Hyperliquid account, regardless of the victim's intended use of the API key (e.g., only for a trading bot to place orders).
  2. The trader-bot developer demographic typically had larger account balances than the average retail wallet user — a developer running an automated trading strategy on Hyperliquid had deposited significant margin capital, making the per-victim extraction amount higher than a typical wallet-extension phishing victim.

The campaign also had an npm supply-chain overlap: security researchers identified malicious npm packages (hyperliquid-trading-bot-utils, hl-sdk-helpers, hyperliquid-signer-lib) that shared C2 infrastructure with the Chrome extension campaign. These npm packages targeted the same trader-bot developer demographic via a different distribution surface — the npm registry — and similarly exfiltrated API secrets. The shared infrastructure fingerprints (TLS certificate issuance patterns, C2 domain registration, hosting provider overlap) indicated that the Chrome extension campaign and the npm campaign were operated by the same cluster.

The campaign was identified by security researchers in 2025-04, reported to Google Chrome Web Store and npm registry security teams, and the malicious extensions and packages were taken down. The takedown window — from first extension publication to removal — was approximately 4-6 weeks for the most-impactful extensions, during which the campaign accumulated its extraction.

Timeline (UTC)

When Event OAK ref
2025-01 to 2025-03 Hyperliquid trading volumes surge (points program, new perp markets); trader-bot developer community expands (attacker incentive surface expands)
2025-03 Fake "Hyperliquid Trading Bot SDK" Chrome extensions appear under typosquatted publisher names; extensions request broad permissions (read all data, clipboard, cooperating sites) T4.010 (protocol-specific tooling phishing)
2025-03 to 2025-04 Malicious npm packages (hyperliquid-trading-bot-utils, hl-sdk-helpers, hyperliquid-signer-lib) identified; shared C2 infrastructure with Chrome extension campaign confirmed T4.010 + T11.009 (supply-chain overlap)
2025-04 Security researchers identify and report; Chrome Web Store and npm registry remove malicious listings; community advisories published (defender-side identification and takedown)
2025-05 Residual campaigns at lower volume; Hyperliquid publishes API-key scoping documentation and recommends API-key rotation for affected users (ongoing low-level surface; protocol-side hardening)

Realised extraction

Aggregate mid-six-figures USD across the campaign cohort. Individual victim losses range from mid-four-figures (smaller trading accounts) to low-six-figures (larger trading accounts with significant margin). The Hyperliquid API-key architecture — where API secrets carry withdrawal capabilities and are not scoped to trading-only permissions — made the per-victim extraction severe: a single compromised API secret enabled full account withdrawal. The aggregate mid-six-figures figure is a conservative reconstruction from on-chain Hyperliquid withdrawal tracing, victim self-reporting in Hyperliquid Discord and Telegram channels, and API-secret-compromise incident reports. The per-victim loss is structurally larger than a typical wallet-extension phishing victim (where seed-phrase exfiltration requires wallet-import and multi-chain sweep) because the Hyperliquid API secret is a single-surface withdrawal primitive.

Public references

  • Hyperliquid API documentation and API-secret permission model (pre- and post-2025 security advisories)
  • Hyperliquid points program documentation and trading-volume incentive structure (2025-Q1)
  • Google Chrome Web Store — extension-listing takedown records for Hyperliquid-impersonating extensions
  • npm registry — malicious-package takedown records (hyperliquid-trading-bot-utils, hl-sdk-helpers, hyperliquid-signer-lib)
  • Security-researcher reports: C2 infrastructure fingerprinting linking Chrome extension and npm campaigns (2025-04)
  • Hyperliquid community advisories: Discord and Telegram API-secret-rotation guidance (2025-04 to 2025-05)
  • [hyperliquidphishing2025] — Hyperliquid trading-bot malware campaign (2025). Industry reports and community documentation.
  • [nptraderphishing2025] — npm trader-tooling supply-chain campaigns (2025). Package-registry security advisories.

Techniques demonstrated (2)