In November 2025 a trader used Popcat (POPCAT) perpetual futures to push the token up with a giant fake bid, then pulled the bid and let the price collapse, leaving the decentralized exchange Hyperliquid with about $4.9 million in bad debt. The attacker lost roughly $3 million of their own collateral in the process, which suggests the goal was to damage the venue or profit elsewhere rather than to win the trade. The episode is the clearest example of how a thinly traded memecoin can be turned against a leveraged market.
This article walks through what happened, why POPCAT was the chosen instrument, and what traders on any venue should take from it.
What Happened, Step by Step
The sequence below follows the on-chain reconstruction reported by CoinDesk and the post-mortem from blockchain security firm Halborn.
- Funding the wallets. About $3 million in USDC was withdrawn from a centralized exchange and split across 19 fresh wallets.
- Building the long. Those wallets opened leveraged long positions in POPCAT perpetuals worth a combined $20 million to $30 million on Hyperliquid.
- Placing the wall. A buy order of roughly $20 million sat on the book near $0.21, far larger than normal POPCAT depth. Other traders read it as real demand, and the price drifted higher.
- Pulling the wall. The giant bid was cancelled abruptly. With no support underneath, POPCAT dropped around 30% in minutes.
- The cascade. The attacker's own longs were liquidated along with other leveraged traders. The liquidation engine could not close positions at prices that covered the losses, and the shortfall landed on the platform's community liquidity vault, which absorbed about $4.9 million.
Reports at the time said Hyperliquid briefly paused bridge withdrawals while it assessed the damage. It was the venue's third manipulation incident of 2025, after episodes in March and July.
Why POPCAT Was the Target
The attacker needed a token that met two conditions: a perpetual market deep enough to hold $20 million-plus in positions, and a spot and order-book market thin enough that a single order could move the price. POPCAT fitted both.
At the time POPCAT traded near $0.21, giving it a market capitalization of about $200 million, yet real two-sided depth on its order books amounted to a small fraction of that. A $20 million bid represented many hours of normal buying interest sitting in one place. That imbalance is typical of memecoins with fixed supplies and concentrated holders, a point covered in our POPCAT tokenomics breakdown.
The perpetual market had also grown large relative to spot. When derivatives open interest dwarfs the liquidity that sets the reference price, a manipulator can move the reference cheaply and profit from, or simply damage, the much larger leveraged market attached to it.
Spoofing, Liquidation Cascades and Bad Debt
Three separate mechanics combined here, and each is worth understanding on its own.
Spoofing is placing large orders with no intention of letting them fill, in order to mislead other traders about supply and demand. It is illegal in regulated securities and futures markets, and hard to police on permissionless venues.
A liquidation cascade happens when falling prices force leveraged positions to close, and those forced sales push the price down further, triggering the next round of liquidations. Traders unfamiliar with how margin and leverage interact tend to underestimate how fast this unfolds on a thin market.
Bad debt is what is left when a liquidated position's losses exceed its collateral. Every derivatives venue needs a backstop for it. On Hyperliquid that backstop was a vault funded by users who deposit to earn market-making returns, which is why the loss fell on them. Our review of Hyperliquid's security record puts this incident alongside the platform's other stress events.
What It Did to POPCAT's Price
POPCAT never reclaimed the $0.21 level. The attack arrived as memecoin volume was already declining, and the flush removed a large block of leveraged long interest that had been supporting the price. By late 2026 POPCAT traded near $0.056, roughly a quarter of its pre-attack price, according to CoinGecko data.
Many chart watchers now treat the $0.21 zone as a major resistance level, since it marks where a large group of traders was wiped out. Our POPCAT price prediction uses that zone as the upper reference for the current cycle.
Lessons for Anyone Trading POPCAT
The attack did not touch anyone holding POPCAT in their own wallet, and it hurt leveraged traders badly. The practical takeaways:
- Distrust giant orders on thin books. A wall many times larger than normal depth is as likely to be bait as real demand. Learning to read an order book helps you spot the difference.
- Use lower leverage on memecoins. A 30% move in minutes is normal for POPCAT under stress. At 10x, that is a total loss before a stop can react.
- Set protective orders in advance. Placing stop-loss and take-profit orders when you open a position removes the need to react in real time.
- Separate trading from holding. Long-term holders who keep POPCAT in self-custody avoid liquidation risk entirely. Our guide to the best POPCAT wallets covers the options.
The episode also fed a longer story about the token. Popcat's audience grew out of a harmless clicker game, as told in the Popcat meme origin, and its best-known market event is a deliberate attack on a derivatives venue. Both belong to the reality of trading a memecoin.
Frequently Asked Questions
How much did Hyperliquid lose in the POPCAT attack?
Hyperliquid's community liquidity vault absorbed about $4.9 million in bad debt from the November 2025 POPCAT attack. The attacker also lost roughly $3 million in collateral. Losses fell on vault depositors rather than on ordinary traders' balances.
Was the POPCAT attack a hack?
The POPCAT event was market manipulation with no software exploit involved. The attacker used legitimate orders and positions, combining spoofing with leverage to trigger liquidations. No smart contract or code was broken.
Is POPCAT safe to trade after the attack?
POPCAT trades normally on major spot and derivatives markets, but the attack showed how quickly its price can move when liquidity is thin. Lower leverage, protective orders and awareness of order-book depth reduce the risk. Holding spot tokens carries no liquidation risk.
What a $3 Million Loss Bought
The POPCAT attack showed that a determined trader can turn a few million dollars into a larger loss for everyone on the other side, as long as the target market is thin and heavily leveraged. For POPCAT traders, the lesson is to respect how little liquidity sits behind a well-known ticker and to size positions for moves that feel impossible until they happen.
Trade POPCAT with that discipline on LeveX: buy POPCAT on spot for exposure without liquidation risk, or open measured positions in POPCAT perpetual futures with your stops set. For more explainers on the markets you trade, visit Crypto in a Minute.