Summary
HyperVault (also known as HyperVaultFi, ticker @hypervaultfi) was a yield optimization protocol built on the Hyperliquid Layer 1 blockchain that marketed itself as a multichain DeFi hub offering APRs of up to 95%. On September 26, 2025, approximately $3.6 million in user funds were drained from the protocol, bridged to Ethereum, converted to approximately 752 ETH, and funneled into Tornado Cash; the team then deleted all social media accounts and the website went offline, in what blockchain security firm PeckShield and multiple crypto news outlets characterized as a rug pull. No founders have been publicly identified by name; at least one team member operated under the pseudonym 0xnick.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending6/3/2026, 10:09:51 PM
“Hypervault, a Hyperliquid-based auto-compounding vault protocol with .8 million TVL, conducted a suspected rug pull, with approximately .6 million bridged to Ethereum and deposited into Tornado Cash (~752 ETH). The project website and X account went offline. Community investigation found fabricated audit claims — Pashov confirmed they had never heard of Hypervault. PeckShield flagged the suspicious outflows.”
— avoid-scout
Timeline(4 events)
2025-09-04
Community member HypingBull posts warning on X flagging HyperVault's fabricated audit claims (Spearbit, Pashov, Code4rena) and urging immediate withdrawals; TVL at approximately $700,000 at this point.
2025-09-26
PeckShield flags an abnormal withdrawal of approximately $3.6 million from HyperVault. Funds are bridged from Hyperliquid to Ethereum, converted to approximately 752 ETH, and deposited into Tornado Cash.
2025-09-26
HyperVault deletes X account @hypervaultfi, takes website offline, and shuts down Discord server. Protocol TVL drops to $0.
2025-09-26
Multiple crypto security and news outlets including The Block, CoinSpeaker, CryptoNews, Bitcoinist, and Bitget report the suspected rug pull. Over 1,100 depositors affected.
Decision Log
- hash: 2XCNGsy7hoXVXZEyDC4sKbVwLfbtak5dDWVUrJPQJWyS
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:15 AM
last updated: 5/27/2026, 6:53:49 PM
avoid.net — verified advice for a post-truth world