{"investigation":{"slug":"hypervault","entity_name":"HyperVault","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"HyperVault (also known as HyperVaultFi, ticker @hypervaultfi) was a yield optimization protocol built on the Hyperliquid Layer 1 blockchain that marketed itself as a multichain DeFi hub offering APRs of up to 95%. On September 26, 2025, approximately $3.6 million in user funds were drained from the protocol, bridged to Ethereum, converted to approximately 752 ETH, and funneled into Tornado Cash; the team then deleted all social media accounts and the website went offline, in what blockchain security firm PeckShield and multiple crypto news outlets characterized as a rug pull. No founders have been publicly identified by name; at least one team member operated under the pseudonym 0xnick.","sections":[{"content":"HyperVault, operating as @hypervaultfi, presented itself as an unmanaged, auto-compounding vault system and yield aggregator built on Hyperliquid's Layer 1 blockchain. The protocol promised annual percentage rates as high as 95% APR for its HYPE liquidity pools and up to 76% on stablecoins. At its peak, the platform held approximately $5.9 million in total value locked (TVL) across more than 1,100 depositors. The protocol marketed itself as a multichain DeFi hub, claiming funds were deployed across various DeFi protocols to generate yield. All team members operated under pseudonyms; one is referenced in reporting only as 0xnick.","heading":"Protocol Overview","sources":[{"url":"https://defillama.com/protocol/hypervault","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.okx.com/en-us/learn/hypervault-rug-pull-defi-scam","name":"okx.com","type":"other","credibility":3},{"url":"https://beincrypto.com/hyperliquid-hypervault-rug-pull/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 26, 2025, blockchain security firm PeckShield flagged an abnormal withdrawal from HyperVault. Approximately $3.6 million in user assets were drained from the protocol's vaults. The stolen assets included approximately $1.55 million in WHYPE tokens, $191,494 in UPUMP tokens, $107,358 in USDC, and other tokens. The funds were then bridged from the Hyperliquid blockchain to Ethereum, converted into ETH, and approximately 752 ETH was deposited into Tornado Cash — a privacy mixer — in what security analysts described as a coordinated operation completed within hours. The Hyperliquid network itself was unaffected; only HyperVault protocol contracts were drained. Following the drainage, the team deactivated all online presence: the website became inaccessible, the X account @hypervaultfi was deleted, and the Discord server went offline. DefiLlama now shows a $0 TVL for the protocol with a warning that it 'rug pulled user funds.' The use of Tornado Cash made fund recovery virtually impossible for affected users.","heading":"Exit Scam and Fund Drainage","sources":[{"url":"https://defillama.com/protocol/hypervault","name":"defillama.com","type":"other","credibility":3},{"url":"https://bitcoinist.com/defi-alert-hypervaults-3-6-million-rug-pull/amp/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/","name":"coinedition.com","type":"other","credibility":3},{"url":"https://www.coinspeaker.com/hypervault-rug-pull-3-6m/amp/","name":"coinspeaker.com","type":"other","credibility":3},{"url":"https://crypto.news/hypervault-raises-rug-pull-fears-after-3-6m-vanishes/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"A significant red flag preceding the incident was the project's alleged fabrication of audit partnerships. When questioned by community members about the protocol's security, HyperVault developers publicly stated that audits were 'pending via Spearbit, Pashov, and Code4rena.' When contacted, Pashov blockchain audit firm stated it was the 'first time I hear the project with this name,' directly contradicting HyperVault's claims. Code4rena's public listings showed no active or pending audits for HyperVault. No confirmation from Spearbit has been publicly reported. These fabricated audit claims were cited by analysts as evidence of deliberate deception designed to build false credibility with depositors.","heading":"Fabricated Audit Claims","sources":[{"url":"https://bitcoinist.com/defi-alert-hypervaults-3-6-million-rug-pull/amp/","name":"bitcoinist.com","type":"other","credibility":3},{"url":"https://coincentral.com/hypervault-vanishes-3-6m-drained-in-suspected-rug-pull/","name":"coincentral.com","type":"other","credibility":3},{"url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks","name":"okx.com","type":"other","credibility":3},{"url":"https://x.com/hypingbull/status/1963685902946824642","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Community member HypingBull issued an alert on September 4, 2025 — more than three weeks before the rug pull — warning users to withdraw funds from the protocol immediately. HypingBull's post on X flagged discrepancies between the developers' claimed audit partnerships and the reality that none of the named audit firms had any involvement with HyperVault. At the time of HypingBull's warning, the protocol held approximately $700,000 in TVL. Despite this public warning, the protocol's TVL grew substantially to approximately $5.9 million before the exit was executed on September 26, 2025, suggesting the team used the intervening period to attract additional deposits.","heading":"Early Warning Signs","sources":[{"url":"https://x.com/hypingbull/status/1963685902946824642","name":"x.com","type":"other","credibility":3},{"url":"https://beincrypto.com/hyperliquid-hypervault-rug-pull/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.coinspeaker.com/hypervault-rug-pull-3-6m/amp/","name":"coinspeaker.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No real-world identities have been publicly linked to the HyperVaultFi team. At least one team member operated under the pseudonym 0xnick, who was cited in reporting as having described the product as still being in early stages prior to the incident. The fully anonymous team structure is consistent with patterns observed in other DeFi exit scams where pseudonymity shields perpetrators from accountability. No arrests, legal filings, or official identifications of the HyperVault team have been publicly reported as of May 2026.","heading":"Team Anonymity and Identity","sources":[{"url":"https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/00e88-hypervaultfi-suspected-rug-pull-takes-3-6m","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions by the SEC, CFTC, DOJ, or any other authority against HyperVault or its operators have been publicly reported as of May 2026. The use of Tornado Cash to launder the approximately 752 ETH substantially impedes on-chain tracing. Given the full anonymity of the team and the use of privacy-mixing infrastructure, recovery of funds is considered extremely unlikely by security analysts. Users affected by the rug pull were advised to revoke all wallet permissions previously granted to the HyperVault protocol.","heading":"Regulatory and Law Enforcement Status","sources":[{"url":"https://beincrypto.com/hyperliquid-hypervault-rug-pull/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560604989007","name":"bitget.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, a widely followed blockchain investigator, is noted as having flagged HyperVault. The specific nature, timing, and content of ZachXBT's flag have not been independently confirmed through a primary source in this investigation. Multiple crypto media outlets and the AVOID.NET platform have noted the ZachXBT flag. ZachXBT has a documented history of identifying DeFi exit scams and rug pulls; however, the specific post or report related to HyperVault was not independently verified through a primary source in this investigation.","heading":"ZachXBT Flag","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-09-04","event":"Community member HypingBull posts warning on X flagging HyperVault's fabricated audit claims (Spearbit, Pashov, Code4rena) and urging immediate withdrawals; TVL at approximately $700,000 at this point.","source":""},{"date":"2025-09-26","event":"PeckShield flags an abnormal withdrawal of approximately $3.6 million from HyperVault. Funds are bridged from Hyperliquid to Ethereum, converted to approximately 752 ETH, and deposited into Tornado Cash.","source":""},{"date":"2025-09-26","event":"HyperVault deletes X account @hypervaultfi, takes website offline, and shuts down Discord server. Protocol TVL drops to $0.","source":""},{"date":"2025-09-26","event":"Multiple crypto security and news outlets including The Block, CoinSpeaker, CryptoNews, Bitcoinist, and Bitget report the suspected rug pull. Over 1,100 depositors affected.","source":""}],"sources_used":[{"url":"https://defillama.com/protocol/hypervault","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250926161148/https://defillama.com/protocol/hypervault","credibility":3,"archive_timestamp":"2025-09-26T16:11:48+00:00"},{"url":"https://www.okx.com/en-us/learn/hypervault-rug-pull-defi-scam","name":"okx.com","type":"other","archive_url":"https://web.archive.org/web/20260829181132/https://www.okx.com/en-us/learn/hypervault-rug-pull-defi-scam","credibility":3,"archive_timestamp":"2026-08-29T18:11:32+00:00"},{"url":"https://beincrypto.com/hyperliquid-hypervault-rug-pull/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251017143803/https://beincrypto.com/hyperliquid-hypervault-rug-pull/","credibility":3,"archive_timestamp":"2025-10-17T14:38:03+00:00"},{"url":"https://bitcoinist.com/defi-alert-hypervaults-3-6-million-rug-pull/amp/","name":"bitcoinist.com","type":"other","archive_url":"http://web.archive.org/web/20250929232732/https://bitcoinist.com/defi-alert-hypervaults-3-6-million-rug-pull/amp/","credibility":3,"archive_timestamp":"2025-09-29T23:27:32+00:00"},{"url":"https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/","name":"coinedition.com","type":"other","archive_url":"http://web.archive.org/web/20250927111528/https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/","credibility":3,"archive_timestamp":"2025-09-27T11:15:28+00:00"},{"url":"https://www.coinspeaker.com/hypervault-rug-pull-3-6m/amp/","name":"coinspeaker.com","type":"other","archive_url":"http://web.archive.org/web/20250926161017/https://www.coinspeaker.com/hypervault-rug-pull-3-6m/amp/","credibility":3,"archive_timestamp":"2025-09-26T16:10:17+00:00"},{"url":"https://crypto.news/hypervault-raises-rug-pull-fears-after-3-6m-vanishes/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251009060524/https://crypto.news/hypervault-raises-rug-pull-fears-after-3-6m-vanishes/","credibility":3,"archive_timestamp":"2025-10-09T06:05:24+00:00"},{"url":"https://coincentral.com/hypervault-vanishes-3-6m-drained-in-suspected-rug-pull/","name":"coincentral.com","type":"other","archive_url":"http://web.archive.org/web/20250927002620/https://coincentral.com/hypervault-vanishes-3-6m-drained-in-suspected-rug-pull/","credibility":3,"archive_timestamp":"2025-09-27T00:26:20+00:00"},{"url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks","name":"okx.com","type":"other","archive_url":"http://web.archive.org/web/20260809115710/https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks","credibility":3,"archive_timestamp":"2026-08-09T11:57:10+00:00"},{"url":"https://x.com/hypingbull/status/1963685902946824642","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20251010041001/https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/","credibility":3,"archive_timestamp":"2025-10-10T04:10:01+00:00"},{"url":"https://cryptorank.io/news/feed/00e88-hypervaultfi-suspected-rug-pull-takes-3-6m","name":"cryptorank.io","type":"other","archive_url":"http://web.archive.org/web/20250928212055/https://cryptorank.io/news/feed/00e88-hypervaultfi-suspected-rug-pull-takes-3-6m","credibility":3,"archive_timestamp":"2025-09-28T21:20:55+00:00"},{"url":"https://www.bitget.com/news/detail/12560604989007","name":"bitget.com","type":"other","archive_url":"http://web.archive.org/web/20260809115457/https://www.bitget.com/news/detail/12560604989007","credibility":3,"archive_timestamp":"2026-08-09T11:54:57+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:15.42906+00:00","updated_at":"2026-08-29T18:16:45.234995+00:00"}}