{"investigation":{"slug":"hypurr-nfts","entity_name":"Hypurr NFTs","trust_score":66,"severity_base":null,"score_modifier":24,"confidence":1,"status":"published","content_type":"investigation","summary":"Hypurr NFTs are a 4,600-piece cat-themed NFT collection airdropped by the Hyper Foundation on September 28, 2025, to early Hyperliquid users who participated in the November 2024 Genesis Event. On the day of launch, blockchain investigator ZachXBT flagged the theft of eight Hypurr NFTs from compromised HyperEVM wallets, yielding approximately $400,000 in profit for the attacker. The collection itself is a legitimate product of the Hyper Foundation, but the incident exposed wallet security vulnerabilities in the HyperEVM ecosystem and coincided with a broader pattern of exploits across Hyperliquid-based protocols in late September 2025.","sections":[{"content":"Hypurr NFTs are a 4,600-piece collection of cat-themed digital collectibles deployed on the HyperEVM, the Ethereum-compatible execution layer of the Hyperliquid blockchain. The collection was created and distributed by the Hyper Foundation as a reward for early supporters. Of the 4,600 NFTs, 4,313 were airdropped to participants who opted in during the November 2024 Genesis Event — the event marking the launch of the HYPE token — while 144 were retained by the Hyper Foundation and 143 were allocated to developers and artists. Eligibility required users to have earned sufficient points in Hyperliquid's Season 1 rewards program and to have opted into the Hypurr airdrop during the Genesis Event. The Hyper Foundation applied address clustering and behavioral analysis to restrict duplicate claims, with approximately 87% unique wallet holders. NFTs were distributed automatically on-chain with no manual claim required.","heading":"Overview and Collection Details","sources":[],"severity":"medium"},{"content":"On September 28, 2025, the same day the Hypurr NFT airdrop launched, blockchain investigator ZachXBT published a Telegram post identifying a theft of eight Hypurr NFTs from compromised wallets. The attacker's identified address, 0x72785d42874e965086829ea789a703fe1a5238df, received the stolen NFTs — including Hypurr #2485 and Hypurr #3800 — and quickly sold them for approximately $400,000 in profit. At the time of the theft, the collection's floor price had risen to approximately 1,595 HYPE (roughly $76,000 per NFT). The victims were described as Genesis Event participants whose HyperEVM wallets had been compromised. The exact method by which the wallet private keys were obtained remains unconfirmed; common vectors in similar incidents include phishing, malicious smart contracts, malware, keyloggers, and insecure private key storage. ZachXBT did not publicly attribute the attack to a known actor or group.","heading":"ZachXBT-Flagged Wallet Exploit","sources":[],"severity":"medium"},{"content":"Hyperliquid operates two parallel systems: a high-performance off-chain exchange layer for trading, and HyperEVM — an Ethereum Virtual Machine-compatible chain that serves as the general programmability layer and supports NFT standards (ERC-721/ERC-1155). HyperEVM launched in February 2025 following the November 2024 Genesis Event. Because HyperEVM uses the same Externally Owned Account (EOA) model as Ethereum, wallets on HyperEVM are subject to the same private key compromise vectors that affect all Ethereum-based wallets. Users who received Hypurr NFTs did so directly into their HyperEVM wallets, meaning NFT custody was tied to the security posture of individual user wallets rather than a custodial or smart contract escrow system. The September 28 theft demonstrated that holders whose wallets were previously compromised — whether through prior phishing, malware, or credential leaks — were exposed to immediate NFT drain upon airdrop distribution.","heading":"HyperEVM Infrastructure and Wallet Security Risks","sources":[],"severity":"medium"},{"content":"The Hypurr NFT exploit occurred against a backdrop of multiple high-profile security incidents affecting Hyperliquid-adjacent protocols in 2025. In March 2025, the JELLYJELLY token manipulation incident caused losses of up to $13.5 million to Hyperliquid's HLP vault before validators intervened and delisted the asset, raising questions about oracle manipulation and centralization of governance. In late September 2025, within days of the Hypurr NFT airdrop, two additional Hyperliquid ecosystem protocols were exploited: Hyperdrive (a lending protocol) lost approximately $782,000 after a CertiK-confirmed vulnerability in its router contract allowed arbitrary call exploitation, draining USDT0 and thBILL liquidity pools; and HyperVault, alleged to have been a rug pull, lost approximately $3.6 million with funds laundered through Tornado Cash. These incidents are independent of the Hypurr NFT collection itself, but they reflect systemic security concerns about protocols and applications built on the Hyperliquid/HyperEVM stack.","heading":"Broader Hyperliquid Ecosystem Security Context","sources":[],"severity":"medium"},{"content":"Despite the security incident, the Hypurr NFT collection generated significant market activity following the airdrop. Within 24 hours of launch on September 28, 2025, trading volume reached approximately 1.3 million HYPE (over $62 million), and the collection was listed on OpenSea. Individual NFTs traded at six-figure prices in secondary markets, with at least one sale reportedly reaching $467,000. The floor price subsequently settled to approximately 1,260 HYPE (roughly $55,000–$58,000) in subsequent weeks, with an estimated market capitalization above $300 million. The Hyper Foundation later donated $254,000 in HYPE to ZachXBT, becoming his second-largest supporter, though this donation has not been characterized as compensation related to the exploit.","heading":"Market Performance and Secondary Sales","sources":[],"severity":"medium"},{"content":"Separately from the wallet exploit, the high value of the Hypurr collection attracted third-party scammers creating fraudulent airdrop websites. At least one phishing domain — claim-hyperliquid[.]xyz — was identified as impersonating a legitimate Hyperliquid interface to steal cryptocurrency from users seeking to claim Hypurr NFTs or HYPE tokens. This phishing activity is unrelated to the Hyper Foundation or the legitimate airdrop, but represents an additional risk to users searching for Hypurr NFT claim instructions.","heading":"Fake Airdrop Scam Activity","sources":[],"severity":"medium"}],"timeline":[{"date":"2024-11","event":"Hyperliquid Genesis Event launches, marking the HYPE token launch. Eligible users opt in to receive a future Hypurr NFT airdrop. HyperEVM not yet live.","source":"","source_url":"https://x.com/HyperFND/status/1972329725080313970","date_original":"2024-11-01"},{"date":"2025-02","event":"HyperEVM launches as the general programmability layer for Hyperliquid, enabling NFT and smart contract deployment.","source":"","source_url":"https://x.com/HyperFND/status/1972329725080313970","date_original":"2025-02-01"},{"date":"2025-03-26","event":"JELLYJELLY token manipulation on Hyperliquid causes up to $13.5 million in losses to HLP vault before validators delist the asset, raising centralization concerns.","source":"","source_url":"https://www.coindesk.com/markets/2025/03/26/hyperliquid-delists-jellyjelly-after-vault-squeezed-in-usd13m-tussle"},{"date":"2025-09-27","event":"Hyperdrive, a lending protocol on Hyperliquid, is exploited for approximately $782,000 via a router contract vulnerability allowing arbitrary calls, confirmed by CertiK.","source":"","source_url":"https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/"},{"date":"2025-09-28","event":"Hyper Foundation airdrops 4,600 Hypurr NFTs on HyperEVM to Genesis Event participants. Collection generates over $62 million in trading volume within 24 hours. Floor price exceeds $76,000.","source":"","source_url":"https://airdropalert.com/blogs/hypurr-nfts-the-biggest-nft-airdrop/"},{"date":"2025-09-28","event":"ZachXBT publishes Telegram post identifying attacker address 0x72785d42874e965086829ea789a703fe1a5238df as having drained 8 Hypurr NFTs from compromised HyperEVM wallets belonging to Genesis Event participants, profiting approximately $400,000.","source":"","source_url":"https://finance.yahoo.com/news/zachxbt-flags-400k-exploit-hypurr-093215277.html"},{"date":"2025-09-28","event":"HyperVault, a Hyperliquid-based protocol, allegedly exit scams for approximately $3.6 million, with funds laundered through Tornado Cash.","source":"","source_url":"https://www.ainvest.com/news/hyperliquid-faces-security-crisis-700-000-stolen-hyperdrive-hack-3-6m-hypervault-exploit-2509/"},{"date":"2025-10","event":"Hypurr NFT floor price settles at approximately $55,000 amid ongoing ecosystem security concerns. Collection remains actively traded on OpenSea.","source":"","source_url":"https://thedefiant.io/news/nfts-and-web3/hyperliquid-s-hypurr-nfts-settle-at-usd55-000-floor-amid-ecosystem-expansion","date_original":"2025-10-01"}],"sources_used":[{"url":"https://finance.yahoo.com/news/zachxbt-flags-400k-exploit-hypurr-093215277.html","name":"ZachXBT Flags $400K Exploit: Hypurr NFTs Drained From Compromised HyperEVM Wallets - Yahoo Finance","type":"news_article","archive_url":"http://web.archive.org/web/20250929122458/https://finance.yahoo.com/news/zachxbt-flags-400k-exploit-hypurr-093215277.html","credibility":2,"archive_timestamp":"2025-09-29T12:24:58+00:00"},{"url":"https://www.ccn.com/news/technology/zachxbthypurr-400k-exploit-hyperliquid/","name":"ZachXBT Flags $400K Exploit: Hypurr NFTs Drained From Compromised HyperEVM Wallets - CCN","type":"news_article","archive_url":"http://web.archive.org/web/20260126121709/https://www.ccn.com/news/technology/zachxbthypurr-400k-exploit-hyperliquid/","credibility":2,"archive_timestamp":"2026-01-26T12:17:09+00:00"},{"url":"https://cryptonews.com/news/hyperliquids-hypurr-nfts-hit-76k-floor-price-but-hacker-steals-8-for-400k-profit/","name":"Hyperliquid's Hypurr NFTs Hit $76K Floor Price, But Hacker Steals 8 for $400K Profit - CryptoNews","type":"news_article","archive_url":"http://web.archive.org/web/20250929104524/https://cryptonews.com/news/hyperliquids-hypurr-nfts-hit-76k-floor-price-but-hacker-steals-8-for-400k-profit/","credibility":2,"archive_timestamp":"2025-09-29T10:45:24+00:00"},{"url":"https://insidebitcoins.com/news/hypurr-nft-fetches-467k-after-airdrop-as-400k-hack-hits-hyperliquid","name":"Hypurr NFT Fetches $467K After Airdrop As $400K Hack Hits Hyperliquid - InsideBitcoins","type":"news_article","archive_url":"http://web.archive.org/web/20251109194845/https://insidebitcoins.com/news/hypurr-nft-fetches-467k-after-airdrop-as-400k-hack-hits-hyperliquid","credibility":2,"archive_timestamp":"2025-11-09T19:48:45+00:00"},{"url":"https://ambcrypto.com/hyperliquids-hypurr-nft-airdrop-backfires-400k-hack-sparks-jitters/","name":"Hyperliquid's Hypurr NFT airdrop backfires – $400K hack sparks jitters - AMBCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20260525195607/https://ambcrypto.com/hyperliquids-hypurr-nft-airdrop-backfires-400k-hack-sparks-jitters/","credibility":2,"archive_timestamp":"2026-05-25T19:56:07+00:00"},{"url":"https://thedefiant.io/news/nfts-and-web3/hyperliquid-s-hypurr-nfts-settle-at-usd55-000-floor-amid-ecosystem-expansion","name":"Hyperliquid's Hypurr NFTs Settle at $55,000 Floor Amid Ecosystem Expansion - The Defiant","type":"news_article","archive_url":"http://web.archive.org/web/20260224234401/https://thedefiant.io/news/nfts-and-web3/hyperliquid-s-hypurr-nfts-settle-at-usd55-000-floor-amid-ecosystem-expansion","credibility":2,"archive_timestamp":"2026-02-24T23:44:01+00:00"},{"url":"https://airdropalert.com/blogs/hypurr-nfts-the-biggest-nft-airdrop/","name":"Hypurr NFTs, the biggest NFT airdrop of 2025 - Airdrop Alert","type":"news_article","archive_url":"http://web.archive.org/web/20260526032901/https://airdropalert.com/blogs/hypurr-nfts-the-biggest-nft-airdrop/","credibility":3,"archive_timestamp":"2026-05-26T03:29:01+00:00"},{"url":"https://x.com/HyperFND/status/1972329725080313970","name":"Hyper Foundation on X: Hypurr NFTs deployed on HyperEVM","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.coindesk.com/markets/2025/03/26/hyperliquid-delists-jellyjelly-after-vault-squeezed-in-usd13m-tussle","name":"HyperLiquid Delists JELLY After Vault Squeezed in $13M Tussle - CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260218133517/https://www.coindesk.com/markets/2025/03/26/hyperliquid-delists-jellyjelly-after-vault-squeezed-in-usd13m-tussle","credibility":1,"archive_timestamp":"2026-02-18T13:35:17+00:00"},{"url":"https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/","name":"Hyperdrive Exploit Drains US$782K in Third Major Hyperliquid Security Breach - CryptoNews Australia","type":"news_article","archive_url":"http://web.archive.org/web/20251208104217/https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/","credibility":2,"archive_timestamp":"2025-12-08T10:42:17+00:00"},{"url":"https://www.ainvest.com/news/hyperliquid-faces-security-crisis-700-000-stolen-hyperdrive-hack-3-6m-hypervault-exploit-2509/","name":"Hyperliquid Faces Security Crisis: $700K Stolen in Hyperdrive Hack and $3.6M in HyperVault Exploit - AInvest","type":"news_article","archive_url":"https://web.archive.org/web/20260724181301/https://www.ainvest.com/news/hyperliquid-faces-security-crisis-700-000-stolen-hyperdrive-hack-3-6m-hypervault-exploit-2509/","credibility":3,"archive_timestamp":"2026-07-24T18:13:01+00:00"},{"url":"https://www.pcrisk.com/removal-guides/29899-hyperliquid-hype-airdrop-scam","name":"Hyperliquid ($HYPE) Airdrop Scam - PCRisk","type":"research","archive_url":"http://web.archive.org/web/20251213132958/https://www.pcrisk.com/removal-guides/29899-hyperliquid-hype-airdrop-scam","credibility":2,"archive_timestamp":"2025-12-13T13:29:58+00:00"},{"url":"https://crypto-economy.com/hyperliquids-hypurr-nfts-hit-record-floor-but-exploit-nets-hacker-400k/","name":"Hyperliquid's Hypurr NFTs Hit Record Floor, But Exploit Nets Hacker $400K - Crypto Economy","type":"news_article","archive_url":"http://web.archive.org/web/20250929131329/https://crypto-economy.com/hyperliquids-hypurr-nfts-hit-record-floor-but-exploit-nets-hacker-400k/","credibility":2,"archive_timestamp":"2025-09-29T13:13:29+00:00"}],"source_tags":["zachxbt"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:04:55.787609+00:00","updated_at":"2026-08-29T01:33:17.26+00:00"}}