HYPERLEAKAGE: A CRITICAL VULNERABILITY IN HYPERLIQUID'S MOBILE LINKING FEATURE

Summary from the TLDR Crypto newsletter

Hyperliquid, a top decentralized exchange, faces a critical security flaw in its mobile linking feature, where QR codes transmit users' trading private keys via URL parameters to an AWS CDN—exposing them to potential insider access. Although the keys lack withdrawal permissions, attackers could exploit them to manipulate trades, risking user funds and platform stability. Hyperliquid's co-founder downplayed the issue despite a $1,000 bounty awarded for its disclosure. This vulnerability underscores the urgent need for stronger security protocols in DeFi to protect user assets and maintain trust in decentralized systems.