Fake Hyperliquid App
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2sK5CJ…7BWmSummary
A fraudulent mobile application impersonating Hyperliquid, the decentralized perpetuals exchange, was identified on the Google Play Store in November 2025 by on-chain investigator ZachXBT. The app, published under the developer name 'Tvtion Inc.', replicated Hyperliquid's branding and interface to harvest users' seed phrases, transmitting them to an external server. An Ethereum address linked to the operation has been associated with thefts exceeding $281,000; Hyperliquid has never released an official mobile application, making any such listing inherently fraudulent.
Connected Entities
5 entities · 60 linked investigations- Fake Hyperliquid App→mentioned with→Hyperliquid(70%)
- Fake Hyperliquid App→mentioned with→ZachXBT(70%)
- Fake Hyperliquid App→mentioned with→SushiSwap(65%)
- Fake Hyperliquid App→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Hyperliquid→mentioned with→Ethereum(70%)
- SushiSwap→mentioned with→Ethereum(60%)
- SushiSwap→mentioned with→ZachXBT(65%)
Timeline(4 events)
June 2025
Cybersecurity firm Cyble Research and Intelligence Labs (CRIL) identifies over 20 malicious crypto applications on the Google Play Store impersonating platforms including Hyperliquid, SushiSwap, and PancakeSwap, all using seed-phrase harvesting techniques.
CoinEdition / Cyble CRIL report26 June 2025
A separate Google Ads phishing campaign targeting Hyperliquid users is reported, in which fraudulent ads for HypurrScan (hypurrscan.net) redirect users to a fake Cloudflare CAPTCHA page designed to execute malicious commands on Windows machines.
The Coin Republic7 November 2025
ZachXBT publishes a warning via his Telegram investigations channel (post 287) about a fake Hyperliquid application on the Google Play Store published by developer 'Tvtion Inc.', identifying Ethereum theft address 0x8c12C21C394D9174c3b1a086A97d2C5523ABb8F5. The post receives over 126,000 views.
ZachXBT Investigations Telegram / Phemex News8 November 2025
Multiple crypto news outlets including CoinEdition, CryptoTimes, and CryptoRank cover ZachXBT's warning, reporting the theft address has been linked to losses exceeding $281,000 and that a parallel Apple App Store variant resulted in approximately $28,000 stolen from two users.
CryptoTimes / CryptoRank / CoinEditionDecision Log
- hash: HqBaxQuXtc8fp8UXhaJJiFbSt2BxDiY5t4ex1NFASp59
- hash: DkcpcayfzcL5nfVBC9Am9mVDECdPFVNuFTz8qb2kd16k
- hash: EiafowiKSb9tKvaaJEs9xuGRgfs7MbJhXUXNi82TMFLf
- hash: DSvJzbJw5b9Uh2Tg3YMBWbmWroqje6CuM9bU1tMQasoB
This investigation is cryptographically anchored to the Solana blockchain (4 events).
model: claude-sonnet
generated: 5/4/2026, 4:05:06 PM
last updated: 6/13/2026, 6:18:49 PM
15 viewsavoid.net — verified advice for a post-truth world