Fake Hyperliquid App
Summary
A fraudulent mobile application impersonating Hyperliquid, the decentralized perpetuals exchange, was identified on the Google Play Store in November 2025 by on-chain investigator ZachXBT. The app, published under the developer name 'Tvtion Inc.', replicated Hyperliquid's branding and interface to harvest users' seed phrases, transmitting them to an external server. An Ethereum address linked to the operation has been associated with thefts exceeding $281,000; Hyperliquid has never released an official mobile application, making any such listing inherently fraudulent.
Connected Entities
1 entitiesTimeline(4 events)
2025-06-01
Cybersecurity firm Cyble Research and Intelligence Labs (CRIL) identifies over 20 malicious crypto applications on the Google Play Store impersonating platforms including Hyperliquid, SushiSwap, and PancakeSwap, all using seed-phrase harvesting techniques.
CoinEdition / Cyble CRIL report2025-06-26
A separate Google Ads phishing campaign targeting Hyperliquid users is reported, in which fraudulent ads for HypurrScan (hypurrscan.net) redirect users to a fake Cloudflare CAPTCHA page designed to execute malicious commands on Windows machines.
The Coin Republic2025-11-07
ZachXBT publishes a warning via his Telegram investigations channel (post 287) about a fake Hyperliquid application on the Google Play Store published by developer 'Tvtion Inc.', identifying Ethereum theft address 0x8c12C21C394D9174c3b1a086A97d2C5523ABb8F5. The post receives over 126,000 views.
ZachXBT Investigations Telegram / Phemex News2025-11-08
Multiple crypto news outlets including CoinEdition, CryptoTimes, and CryptoRank cover ZachXBT's warning, reporting the theft address has been linked to losses exceeding $281,000 and that a parallel Apple App Store variant resulted in approximately $28,000 stolen from two users.
CryptoTimes / CryptoRank / CoinEditionDecision Log
- hash: DkcpcayfzcL5nfVBC9Am9mVDECdPFVNuFTz8qb2kd16k
- hash: EiafowiKSb9tKvaaJEs9xuGRgfs7MbJhXUXNi82TMFLf
- hash: DSvJzbJw5b9Uh2Tg3YMBWbmWroqje6CuM9bU1tMQasoB
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet
generated: 5/4/2026, 4:05:06 PM
last updated: 6/13/2026, 6:18:49 PM
avoid.net — verified advice for a post-truth world