Fact-check findings

No source the reviewer could reach confirms or contradicts the claim.

1. #5[unverifiable][awaiting moderator]in section: Laundering and Fund Tracing

   “one places it as a smaller first-phase extraction about an hour before the main minting event (Hyperbridge post-mortem)”

   reviewerHyperbridge post-mortem describes the 245 ETH as a smaller first-phase extraction about an hour before the main mintCould not find the 245 ETH / one-hour-earlier detail in the post-mortem as fetched. Attribution to the post-mortem is unconfirmed.
   citedblog.hyperbridge.network/april-13-post-mortem/
2. #12[unverifiable][awaiting moderator]in the timeline

   “Hyperbridge expands to Polygon mainnet; the team markets the protocol as 'the world's safest bridge'.”

   reviewerHyperbridge expanded to Polygon mainnet in September 2025No source attached to the entry; date not verified.
3. #13[unverifiable][awaiting moderator]in section: June 2026 Relaunch and Architectural Rebuild

   “Rather than only patching the exploited components, Polytope Labs rebuilt the protocol's core architecture and relaunched in June 2026.”

   reviewerJune 2026 relaunch after architectural rebuild with HFT, subscriptions of $50-$1,000Cited sources returned 403 and I found no independent confirmation of the relaunch. Third-party evidence of retirement of Hyperbridge services exists, see omissions.
   citedwww.cryptotimes.io/2026/06/16/hyperbridg…uilt-everything/

The cited evidence supports part of the claim but not all of it.

1. #10[partially supported][awaiting moderator]in section: Incident Response, Compensation and Recovery Plan

   “An emergency fix adding bounds validation to MMR leaf verification was deployed within 72 hours, by about April 16, 2026.”

   reviewerEmergency bounds-validation fix deployed within 72 hours, by about April 16; redeployment began by May 11April 16 fix merged into the library confirmed; whether it was deployed to production by then is not stated. Redeployment date May 11 confirmed.
   citedblog.hyperbridge.network/april-13-post-mortem/
2. #11[partially supported][awaiting moderator]in the timeline

   “Polytope Labs publicly launches the Hyperbridge cross-chain bridge.”

   reviewerPolytope Labs publicly launched Hyperbridge in November 2023Entry has no source. Wikipedia places founding in 2023 and Hyperbridge launch in 2024, so a 2023-11 public launch is not supported and may conflate founding with launch.

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: April 13, 2026 Token Gateway Exploit

   “On April 13, 2026, an attacker exploited a critical vulnerability in the Merkle Mountain Range (MMR) verifier used by Hyperbridge's Ethereum gateway contract (Token Gateway).”

   reviewerHyperbridge exploit occurred April 13, 2026 via an out-of-bounds MMR leaf in the Ethereum Token GatewayOfficial post-mortem and Wikipedia agree.
   citedblog.hyperbridge.network/april-13-post-mortem/
2. #2[confirmed][no action needed]in section: April 13, 2026 Token Gateway Exploit

   “Shallow liquidity limited the cash-out to roughly 108.2 ETH (about $237,000).”

   reviewerAttacker cashed out about 108.2 ETH (~$237,000)Matches CoinDesk.
   citedwww.coindesk.com/tech/2026/04/13/attacke…-just-usd250-000
3. #3[confirmed][no action needed]in section: Revised Loss Assessment

   “Hyperbridge revised total realized losses to approximately $2.5 million”

   reviewerLosses revised to about $2.5M across Ethereum, Base, BNB Chain and ArbitrumCorroborated by Wikipedia and multiple search results. Cited page itself was blocked.
   citedwww.cryptotimes.io/2026/04/16/hyperbridg…-2-5m-from-237k/
4. #4[confirmed][no action needed]in section: Laundering and Fund Tracing

   “A portion of the stolen funds, reported as approximately 245 ETH extracted from the TokenGateway contract, was deposited into Tornado Cash, the OFAC-sanctioned Ethereum mixing service, complicating recovery.”

   reviewerAbout 245 ETH from TokenGateway was deposited into Tornado CashSupported as a reported claim; hedged wording on the page is appropriate.
   citedprotos.com/hyperbridge-exploited-less-th…-day-hack-prank/
5. #6[confirmed][no action needed]in section: Pre-Exploit Security Claims and April Fools Prank

   “On April 1, 2026, about 12 days before the exploit, Hyperbridge posted on X falsely claiming that North Korea's Lazarus Group had drained $37 million from the protocol.”

   reviewerApril 1 prank claimed Lazarus drained $37M; Rickroll blog 'Why Hyperbridge Can't Be Hacked'; 'hope you have a quantum computer bro'Page properly hedges the quote as 'reportedly'.
   citedprotos.com/hyperbridge-exploited-less-th…-day-hack-prank/
6. #7[confirmed][no action needed]in section: Alleged Dismissal of Security Researchers

   “Reports and screenshots indicate that in February 2026 a bug bounty hunter flagged critical vulnerabilities to the Hyperbridge team and allegedly received the response 'exploit them if you found them.'”

   reviewerFebruary 2026 bug bounty hunter told 'exploit them if you found them'Reported as alleged on both Protos and the page; appropriately hedged.
   citedprotos.com/hyperbridge-exploited-less-th…-day-hack-prank/
7. #8[confirmed][no action needed]in section: Audits and Smart Contract Security Track Record

   “A post-exploit SRLabs audit identified 14 vulnerabilities: 1 critical, 3 high, 5 medium, 4 low and 1 informational, all reported as remediated.”

   reviewerPost-exploit SRLabs audit found 14 vulnerabilities (1/3/5/4/1), all remediatedNote the audit scoped solidity-merkle-trees and IntentGatewayV2; the page's inference about broader code quality is editorial.
   citedblog.hyperbridge.network/april-13-post-mortem/
8. #9[confirmed][no action needed]in section: Audits and Smart Contract Security Track Record

   “Identical bugs were found in two upstream ecosystem libraries, which Hyperbridge disclosed to Parity Technologies on April 21, 2026.”

   reviewerHyperbridge disclosed identical bugs to Parity on April 21, 2026Matches post-mortem.
   citedblog.hyperbridge.network/april-13-post-mortem/