Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #10[disputed][awaiting moderator]in section: Hyperliquid Ecosystem Security Context

   “Investor Arrington Capital, which participated in Hyperdrive's Series A, subsequently published a post-incident commentary titled 'Hyperliquid's Tipping Point: Three Things They Must Do Now,' addressing systemic security weaknesses across the Hyperliquid ecosystem.”

   reviewerArrington Capital subsequently published a post-incident commentary addressing systemic security weaknesses, titled 'Hyperliquid's Tipping Point: Three Things They Must Do Now'The page implies this commentary was written in response to the Hyperdrive hack ('subsequently published a post-incident commentary'), but the post actually predates the Hyperdrive exploit by six months and addresses different, earlier incidents.
   Proposed correction (not yet applied)

   Investor Arrington Capital, which participated in Hyperdrive's Series A, had earlier published a commentary titled 'Hyperliquid's Tipping Point: Three Things They Must Do Now' (published March 28, 2025, in response to the March 2025 ETH and JELLY market-manipulation incidents, months before the Hyperdrive exploit), addressing systemic security weaknesses across the Hyperliquid ecosystem.
   citedwww.arringtoncapital.com/blog/hyperliqui…hey-must-do-now/
2. #12[disputed][awaiting moderator]in section: Security Audits and Pre-Launch Risk Assessment

   “Several early audits were preceded by code refactors that addressed architecture changes, meaning their coverage was superseded before launch.”

   reviewerSeveral early audits were preceded by code refactors that addressed architecture changes, meaning their coverage was superseded before launchThe cited source says the refactors came after the audits (which is why coverage was superseded), but the page states they were 'preceded by' refactors — an inversion of the sequence, even though the conclusion (coverage superseded) is correct.
   Proposed correction (not yet applied)

   Several early audits were followed by code refactors that addressed architecture changes, meaning their coverage was superseded before launch.
   citedhyperdrive-2.gitbook.io/hyperdrive/for-d…/security-audits
3. #17[disputed][awaiting moderator]in section: Token and Airdrop Structure

   “The anticipated governance token ticker is commonly referred to as HYPED in the protocol's documentation and the token HYPED is listed with a live price on CoinPedia markets.”

   reviewerThe token HYPED is listed with a live price on CoinPedia marketsThe cited source itself contradicts the 'live price' claim; it explicitly states no price data is currently available for HYPED.
   Proposed correction (not yet applied)

   The anticipated governance token ticker is commonly referred to as HYPED in the protocol's documentation, and the token HYPED is listed on CoinPedia markets, though no live price is currently shown there.
   citedmarkets.coinpedia.org/hyperdrive/

No source the reviewer could reach confirms or contradicts the claim.

1. #13[unverifiable][awaiting moderator]in section: Security Audits and Pre-Launch Risk Assessment

   “No public bug bounty program was identified for Hyperdrive HL at the time of the incident, in contrast to DELV's separate Hyperdrive protocol on Ethereum which maintained a Cantina bug bounty.”

   reviewerNo public bug bounty program was identified for Hyperdrive HL at the time of the incidentThe absence of a bounty for Hyperdrive HL is plausible given no mention on its own audit page, but the comparison to a specific 'Cantina bug bounty' for DELV's Hyperdrive could not be independently confirmed from public sources checked.
   citedhyperdrive-2.gitbook.io/hyperdrive/for-d…/security-audits
2. #14[unverifiable][awaiting moderator]in section: Fund Recovery and User Compensation

   “The team reportedly reached out to the exploiter on-chain with a 10% white-hat bounty offer in exchange for return of the remaining funds, though no public confirmation of any funds being returned has been located.”

   reviewerThe team reportedly reached out to the exploiter on-chain with a 10% white-hat bounty offer in exchange for return of the remaining fundsNone of the four sources cited for this section mention a 10% white-hat bounty offer, and a broader web search found no record of one. The page's own 'reportedly' hedge is appropriate, but the claim is unsupported by its own citations and could not be verified elsewhere.
   citedcrypto.news/hyperliquid-hyperdrive-resum…-700k-hack-2025/www.mitrade.com/insights/news/live-news/…1155419-20250929coincentral.com/hyperdrive-loses-782000-…-exploit-attack/
3. #15[unverifiable][awaiting moderator]in section: ZachXBT Flag and Community Monitoring

   “The specific nature and content of ZachXBT's flag has not been independently verified through a primary source in this investigation; no dedicated ZachXBT investigation thread or Telegram post specifically targeting Hyperdrive HL was located in publicly indexed sources.”

   reviewerZachXBT flagged Hyperdrive HL in the context of the September 2025 security incidents, though this has not been independently verifiedThe page correctly self-flags this claim as unverified rather than asserting it as fact; this reviewer likewise found no primary ZachXBT source naming Hyperdrive HL. This is honest hedging, not a factual error.
4. #16[unverifiable][awaiting moderator]in section: Token and Airdrop Structure

   “Season 1 of the Miles program distributed 5% of the total anticipated token supply; Season 2 is reported to be underway.”

   reviewerHyperdrive Miles Season 1 distributed 5% of anticipated token supply; Season 2 is underwayBoth cited sources blocked automated access during this review, so the specific 5% Season 1 figure and Season 2 status could not be independently confirmed or refuted.
   citedmedium.com/@hyperdrive_fi/hyperdrive-tok…lst-5417f1d78544airdrops.io/hyperdrive/
5. #18[unverifiable][awaiting moderator]in section: Token and Airdrop Structure

   “No token generation event (TGE) date has been officially confirmed.”

   reviewerNo token generation event (TGE) date has been officially confirmedConsistent with the absence of a live price/TGE data on CoinPedia found during this review; could not find a confirmed TGE date independently.

A cited source no longer resolves or no longer says what the page attributes to it.

1. #21[link rot][awaiting moderator]in the cited sources

   “https://web.archive.org/web/20260829025619/https://coincentral.com/f2pool-co-founder-says-btc-will-survive-quantum-computing-threats/”

   reviewerThe archived snapshot recorded for the coincentral.com citation corresponds to the Hyperdrive exploit articleThe sources_used entry's primary url is correct and live, but its archive_url points to an unrelated CoinCentral article about a F2Pool founder's quantum-computing comments, not the Hyperdrive exploit story. A correct Wayback snapshot of the right article exists and is proposed as the replacement.
   Proposed correction (not yet applied)

   http://web.archive.org/web/20260829025614/https://coincentral.com/hyperdrive-loses-782000-in-tokens-after-smart-contract-exploit-attack/
   citedcoincentral.com/hyperdrive-loses-782000-…-exploit-attack/

The cited evidence supports part of the claim but not all of it.

1. #4[partially supported][awaiting moderator]in section: Protocol Overview

   “As of late 2025, total value locked (TVL) stood at approximately $1.71 million with active loans of $475,316.”

   reviewerAs of late 2025, TVL was approximately $1.71 million with active loans of $475,316Figures are directionally correct but do not match the live page at time of review; this is expected for a constantly-updating DeFi metric rather than a factual error, so no correction is proposed.
   citeddefillama.com/protocol/hyperdrive-hl

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “Hyperdrive HL (formerly Ambit Finance) is a stablecoin lending and liquid-staking protocol deployed on Hyperliquid EVM”

   reviewerHyperdrive HL was formerly known as Ambit FinanceName change and core description corroborated by cmointern.com and coincarp fundraising listings.
   citedwww.cmointern.com/2025/05/hyperdrive-sec…ries-led-by.html
2. #2[confirmed][no action needed]in section: Protocol Overview

   “led by Hack VC and Arrington Capital, with participation from Delphi Ventures, SIG, Amber Group, CMS Holdings, Proof Group, Caladan Group, and Breed VC”

   reviewer$6 million Series A closed May 24, 2025, led by Hack VC and Arrington Capital, with the stated participant listFully corroborated by the cited source; independent coincarp/techleap listings agree on the lead investors.
   citedwww.cmointern.com/2025/05/hyperdrive-sec…ries-led-by.html
3. #3[confirmed][no action needed]in section: Protocol Overview

   “A separate community funding round of $1 million on Echo sold out in under one minute.”

   reviewerHyperdrive launched May 27, 2025, and the Echo community round of $1 million sold out in under a minuteConfirmed.
   citedwww.cmointern.com/2025/05/hyperdrive-sec…ries-led-by.html
4. #5[confirmed][no action needed]in section: September 2025 Router Contract Exploit

   “stating the attacker 'repeatedly exploited an arbitrary call in the router to take users' funds of 672,934 USDT0 and 110,244 thBILL.'”

   reviewerSept 27, 2025 exploit drained ~$782,000 (672,934 USDT0 and 110,244 thBILL) via an arbitrary-call vulnerability in the router contract, per CertiKQuote and figures confirmed verbatim across multiple independent outlets.
   citedx.com/CertiKAlert/status/1972117426893738341www.theblock.co/post/372662/hyperliquid-…contract-exploitwww.web3isgoinggreat.com/single/hyperdrive-exploit
5. #6[confirmed][no action needed]in section: September 2025 Router Contract Exploit

   “The stolen assets were bridged off-chain via the deBridge cross-chain protocol, with approximately $494,000 moved to Ethereum and $279,000 to BNB Chain, where funds were later traced as having been partially routed through Tornado Cash.”

   reviewerStolen funds were bridged via deBridge, ~$494,000 to Ethereum and ~$279,000 to BNB Chain, with some later routed through Tornado CashConfirmed by independent CryptoNews coverage citing the same CertiK analysis.
   citedcryptonews.com.au/news/hyperdrive-exploi…y-breach-131037/
6. #7[confirmed][no action needed]in section: September 2025 Router Contract Exploit

   “The team also stated that the exploit was attributed to 'a known threat actor previously linked to high-profile protocol exploits,' though no specific wallet address or identity was publicly disclosed.”

   reviewerHyperdrive attributed the exploit to 'a known threat actor previously linked to high-profile protocol exploits'Could not access the original X post directly, but the exact phrase is corroborated by independent secondary coverage.
   citedx.com/hyperdrivedefi/status/1972095669403111519
7. #8[confirmed][no action needed]in section: Hyperliquid Ecosystem Security Context

   “On September 26, 2025, the day before the Hyperdrive exploit, HyperVault — a separate Hyperliquid-based protocol — suffered an alleged $3.6 million loss in what multiple outlets described as a suspected rug pull, with project websites and social media going dark afterward and funds traced to Ethereum via Tornado Cash.”

   reviewerHyperVault, a separate Hyperliquid protocol, suffered an alleged $3.6 million loss in a suspected rug pull on September 26, 2025, with social media going dark and funds traced via Tornado CashFully corroborated by independent reporting (The Block, Decrypt, Forklog).
   citedwww.ccn.com/news/crypto/hackers-hit-hype…erdrive-exploit/
8. #9[confirmed][no action needed]in section: Hyperliquid Ecosystem Security Context

   “Earlier in 2025, the broader Hyperliquid platform had already suffered two major market manipulation attacks resulting in a combined approximately $16 million in losses.”

   reviewerEarlier in 2025, Hyperliquid suffered two major market manipulation attacks totaling approximately $16 million in combined lossesConfirmed directly from the cited source.
   citedcryptonews.com.au/news/hyperdrive-exploi…y-breach-131037/
9. #11[confirmed][no action needed]in section: Security Audits and Pre-Launch Risk Assessment

   “For its lending protocol, audits were conducted by Kiki (February 2025), Bailsec (March 2025), and Obsidian (May 2025). For its HYPED liquid staking product, audits were conducted by Enigma Dark (April 2025), Bailsec (August 2025), and Enigma Dark (August 2025). For its HLP Vault Tokenization product, Bailsec conducted three audits (February 2025, July 2025, and a July 2025 revision).”

   reviewerHyperdrive commissioned audits by Kiki (Feb 2025), Bailsec (Mar 2025), Obsidian (May 2025) for lending; Enigma Dark (Apr 2025), Bailsec (Aug 2025), Enigma Dark (Aug 2025) for HYPED; Bailsec x3 (Feb 2025, Jul 2025, Jul 2025 revision) for HLP Vault TokenizationExact match to the cited primary source.
   citedhyperdrive-2.gitbook.io/hyperdrive/for-d…/security-audits
10. #19[confirmed][no action needed]in the timeline

    “Attacker exploits an arbitrary-call vulnerability in Hyperdrive HL's router contract, draining 672,934 USDT0 and 110,244 thBILL tokens (~$782,000) from two markets. Stolen funds are bridged to Ethereum and BNB Chain via deBridge.”

    reviewerAttacker exploits arbitrary-call vulnerability draining 672,934 USDT0 and 110,244 thBILL (~$782,000); funds bridged to Ethereum and BNB Chain via deBridgeConfirmed; dated correctly as Sept 27, 2025 per all outlets except one (The Block) that frames it as 'Saturday night,' which also resolves to Sept 27.
    citedwww.theblock.co/post/372662/hyperliquid-…contract-exploit
11. #20[confirmed][no action needed]in the timeline

    “HyperVault, a separate Hyperliquid-based protocol, suffers an alleged $3.6 million loss in a suspected rug pull, with project social media disappearing.”

    reviewerHyperVault suffers an alleged $3.6 million loss in a suspected rug pull on September 26, 2025Confirmed via The Block and other independent reporting.
    citedwww.ccn.com/news/crypto/hackers-hit-hype…erdrive-exploit/