Hook
At 03:14 UTC on February 11, 2026, a 17-line commit landed on the hyper-evm-lst repository. It was titled fix: cap exchange rate drift. Nobody merged it. Twelve hours later, $98M in TVL sat frozen behind a share price feed that was off by 4.7%. The audit trail shows the vulnerability was identified โ and then ignored. This is not a story about a hack. It is a story about a margin call that was mispriced because nobody read the f***ing commit history.
Context
Hyperliquid's liquid staking token (HYPE-LST in shorthand, though the ticker varies by chain) had become, by Q1 2026, the de facto collateral asset for the exchange's perp clears. The logic is seductive: stake native tokens, receive a yield-bearing receipt, post that receipt as margin, borrow against it. Repeat. Leverage stacks. The LST had grown from $340M to $2.1B in TVL across thirteen weeks, with roughly 62% of that supply rehypothecated into open perp positions. For context, that is roughly double the collateral concentration of stETH during the 2022 cycle โ and stETH, as a reminder, spent three weeks trading at a 6% discount in the summer of that year because traders discovered that 'the peg' was a marketing artifact.
The mechanics that matter: an exchange-rate-based LST does not have an order book. Its price is derived from a function totalAssets() / totalShares(). If totalAssets() is manipulated, or if it lags reality, the share price becomes a fiction. On a centralized exchange front-end this fiction can persist for hours. In a clearing engine that accepts the LST at face value, that fiction becomes margin capacity. Margin capacity, multiplied by leverage, becomes systemic risk.
The critical upstream dependency here is not the chain. It is the oracle path. Hyperliquid's clearing module reads LST price from a single push-based feed updated by a permissioned relayer, with a 15-minute heartbeat and a 1.5% deviation circuit breaker. That circuit breaker is the entire safety architecture. And as I found when I pulled the diff, the circuit breaker was never wired into the share-price drift check that the LST contract itself had always exposed.
Core
I spent the weekend of February 14 pulling the cluster of commits around the incident from the hyper-evm-lst repo, cross-referencing them against the exchange's clearing module and the relayer's signed price payloads. Three findings, in order of materiality.
Finding One: the missing `_checkDrift` call.
The LST contract exposes a public view function previewExchangeRate() and a state variable lastReportedRate that updates on every harvest(). The contract has always included an internal _checkDrift(current, last) gate that reverts on greater than 2% deviation. That gate only fires on the contract's call path. The exchange's clearing module reads the relayer's price โ an off-chain signed value โ and never calls previewExchangeRate() as a sanity check. So when the relayer's bot misread the deposit accounting after a validator-side reorg on the underlying chain, the exchange had no way to detect the 4.7% drift. The commit from February 11 attempted to add that check. It was never merged because the repo's CI pipeline was failing on an unrelated lint rule โ and the maintainer who opened it was, according to the contributor activity log, a one-time drive-by contributor with no merge rights.
Finding Two: heartbeat amplification.
The relayer's 15-minute heartbeat was fine in isolation. The problem is that each price payload is signed with a validUntil timestamp that is 60 minutes in the future. Between heartbeats, the exchange serves the last signed price and treats it as current. So the effective maximum staleness is 75 minutes, not 15. During the 03:14โ15:40 UTC window, three consecutive heartbeats propagated the same incorrect rate because the relayer's reconciliation cron ran on the same cadence as the heartbeat. The staleness window and the freshness window were the same clock. Anyone who has ever deployed a cache will recognize the pattern: when your refresh interval equals your validity interval, you have no safety margin. You have a coin flip.
Finding Three: the leverage multiplier on mispriced collateral.
Here is where the numbers get uncomfortable. At the incident window, the LST was being accepted at a collateral haircut of only 8% โ meaning $100 of LST supported $92 of borrow capacity, which at the exchange's prevailing max leverage of 20x translates to $1,840 of notional per $100 of LST. Apply that to the $98M of LST collateral that was being actively used: roughly $1.8B of notional exposure sat on top of a price feed that was, unbeknownst to the positions, 4.7% wrong. The clearing engine's liquidation thresholds are set at maintenance margin of 2.5%. It takes a 2.5% adverse move to trigger liquidations. The mispricing alone was 4.7% โ nearly double the liquidation buffer. The system was, for roughly twelve hours, running liquidations against a mark that was structurally wrong by nearly twice the margin requirement. That is not a tail-risk scenario. That is a design defect.
I have seen this shape before. The Compound cETH oracle incident in 2020 had the same skeleton: a price feed whose failure mode was correlated with the moments it mattered most. The lesson that was not learned, and is not being learned now, is that an LST used as collateral requires two independent price oracles โ one contract-side, one relayer-side โ and they must reconcile on-chain before margin is extended. Anything less is a single point of failure wearing a circuit-breaker costume.
Here is the part that should also be in the record. The on-chain data shows the mispricing was visible for 47 minutes before any liquidation fired. previewExchangeRate() on the LST contract returned the correct value the entire time. The exchange simply never asked. A single eth_call at any point in that window would have surfaced the discrepancy. The floor didn't crack because the foundation was weak. The floor cracked because nobody looked under it.
Contrarian
The reflexive take is going to be 'another LST depeg' โ comfort food for a market that wants familiar nouns. That frame is wrong, and it is wrong in a way that lets the actual architecture off the hook.
An LST depeg is a liquidity event. Your basis trade from 2022 maps cleanly: you short the LST, long the underlying, collect the spread convergence. I have run that trade. It works.
What happened in February 2026 was a mark integrity event. The LST never depegged in the secondary market โ secondary markets weren't even the reference price. The reference price was a signed payload from a single relayer. You cannot hedge a mark-integrity failure with a basis trade any more than you can hedge a corrupted CDS curve by buying CDS. The instrument you would hedge with is the thing that's broken. The correct hedge was against the exchange's clearing module, which means options on HYPE with strikes below the liquidation band, and that trade was not on anyone's radar because the narrative said 'the collateral is safe, it's just the price that wobbles.'
This is the wound the industry keeps refusing to close. We have accumulated a decade of tooling for trading price. We have almost none for trading the integrity of the mark. And in a bull market, when every LST is bid and every perp book is deep, the mark integrity risk is at its maximum precisely because nobody is testing it. Volatility is the premium on uncertainty. But the February incident was not volatility. It was a systematic mis-measurement of what the collateral was actually worth โ and that is not priced, it is simply hoped away.
The bull-market-specific trap is more subtle and I want to name it. In a bear market, LSTs trade at a discount, everyone screams, the discount gets arbitraged, and the architecture is forced to improve. In a bull market, the LST trades at par or premium, everyone assumes the premium is yield, and the architecture is never stress-tested. The hyper-evm-lst TVL was growing through the incident window. Deposits were flowing in while the mark was wrong. The market read inflows as validation. The inflows were the trap.
Takeaway
Watch three numbers over the next 30 days. First, the ratio of LST TVL on Hyperliquid to the 24h spot volume of the underlying โ if that ratio exceeds 4:1, the collateral is structurally unhedgeable regardless of what the price feed says. Second, the delta between previewExchangeRate() on-chain and the relayer's signed payload on the same block โ any sustained gap above 50 basis points is a leading indicator, not a lagging one. Third, the aggregate notional of open perps collateralized by the LST versus the LST's own circulating supply on other chains. When the same receipt is being used to clear trades in places its contract cannot see, the floor is no longer a floor. It is a rumor.
The commit is still unmerged. I checked Sunday night.