September 28, 2025 — DeFi money-market protocol Hyperdrive has paused markets after confirming an exploit that drained roughly $773,000 from two accounts tied to its Treasury Bill (thBILL) market. Early incident reports point to a targeted compromise of positions, not a flaw in the thBILL token itself.
Blockchain sleuths tracked the haul as it was split and bridged across networks—about 288.37 BNB to BNB Chain and 123.6 ETH to Ethereum—moves consistent with rapid obfuscation playbooks seen in recent DeFi thefts.
nvestigators now believe the attackers likely funneled portions of the funds through an obscure anonymizing service dubbed zeroexch.io, using fragmentation and cross-chain hops to blur on-chain provenance before final dispersal.
Hyperdrive said it suspended all money markets and withdrawals while the probe continues. Independent coverage has flagged a potential arbitrary-call/router weakness as a working theory for initial access, though the team emphasized that thBILL itself shows no direct vulnerability.