Audit log

Every state-changing event for Hypervault Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-08 23:10:23Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   k7gDchGBoijS…HmhHDQ9kcopysha256 → base58

   verifying row…

   canonical bytes (21191 B) ▸

   {"actor":"system:backfill","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","kind":"publish","page_slug":"hypervault-finance","published_at":"2026-08-08T23:10:23.628Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Hypervault Finance","sections":[{"content":"On September 25–26, 2025, operators of Hypervault Finance drained all nine of the protocol's vaults on the Hyperliquid HyperEVM chain. Security firm PeckShield publicly flagged the event as an 'abnormal withdrawal of ~$3.6M worth of crypto from @hypervaultfi,' consistent with a rug pull. Funds were bridged from Hyperliquid to the Ethereum mainnet via deBridge, converted into ETH, and then approximately 752 ETH was deposited into Tornado Cash across at least four Ethereum addresses to launder and obfuscate the stolen assets. The drain was executed across all active vaults, reducing depositor balances to zero. Blockchain analysts BrutalTrade and SpecterAnalyst subsequently identified the primary on-chain exploitation addresses on HyperEVM: 0x79957ce3c826030d642b9ba6f60b896b61588af8 and 0x8d851eb3995ef0e2e7a3581316b4899b414c9bcf, with a funder wallet at 0x49c083a19a25734b0c66bcc0d16333a36c3a7bf0. Ethereum destination addresses receiving the bridged funds included 0xee882b9ada0895376fd90a2b6a80d6d7f7f06396 (631.59 ETH), 0x7901922af07526a66b63c479565f44e81889f4e2 (219.85 ETH), 0x56e90397133aea9b9a087c3c93467875ed4a2be7 (147.93 ETH), and 0xd74ea73957a4eac6a9636221421a3a69b4714eee (127.35 ETH). Simultaneous with the on-chain drain, the project's website (app.hypervault.finance), X (Twitter) account, Discord server, and GitHub repositories were all deleted, consistent with a premeditated exit scam rather than an external hack. No exploit of a third-party vulnerability was identified; the team itself is alleged to have orchestrated the theft using privileged contract access.","heading":"Exit Scam Mechanics","severity":"critical","sources":[{"credibility":2,"name":"DeFi protocol Hypervault vanishes after $3.6 million suspected rugpull — The Block","type":"news_article","url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"},{"credibility":2,"name":"Hypervault Drains $3.6M, 752 ETH Hits Tornado Cash — CoinEdition","type":"news_article","url":"https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/"},{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":2,"name":"$3.6M Drained From Hyperliquid DeFi Platform Hypervault in 'Abnormal Withdrawal' — Decrypt","type":"news_article","url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"}]},{"content":"Hypervault Finance publicly claimed that security audits were underway or pending with three prominent audit firms: Spearbit, Pashov Group, and Code4rena. These claims were made in response to direct community inquiries about the protocol's security posture. Post-incident investigation confirmed that none of these audits were conducted or formally contracted. When community researcher HypingBull contacted Pashov Group directly via Telegram on or around September 4, 2025, a representative of the firm replied: 'First time I hear the project with this name.' A concurrent check of Code4rena's public contest listing showed no pending or completed audit for Hypervault. No engagement record with Spearbit was identified. These fabricated audit claims were central to the project's credibility-building strategy and are alleged to have directly influenced depositor confidence in the protocol's security. Separately, Zenith Security did conduct a legitimate draft audit, delivered privately to the Hypervault team on or around September 14–21, 2025. That draft identified 42 vulnerabilities, including six rated high severity and ten rated medium severity, with a recommendation for a full re-audit after remediation. The team never publicly disclosed the Zenith findings and did not remediate any issues before executing the drain. Zenith Security subsequently stated it would cooperate fully with investigators.","heading":"Fraudulent Audit Claims","severity":"critical","sources":[{"credibility":3,"name":"HypingBull X post warning about Hypervault audit claims — X (Twitter)","type":"social_media","url":"https://x.com/hypingbull/status/1963685902946824642"},{"credibility":2,"name":"Hyperliquid's HyperVault Project Rugged for $3.6M, Devs Disappear — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/hyperliquids-hypervault-project-rugged-for-3-6m-devs-disappear/"},{"credibility":2,"name":"DeFi Rug Pulls: How Hypervault's $3.6M Scam Exposed Critical Risks — OKX Learn","type":"research","url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks"},{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"}]},{"content":"Blockchain investigators and open-source researchers have alleged that the public face of Hypervault Finance was an individual operating under the name 'Nick Olsson' (also referenced in various reports as 'Nick Olsen' and by the pseudonym '0xNyck'), described as being based in Sweden. This individual is alleged to have participated in video calls with the community and was reachable on social channels prior to the drain. A contact email associated with the project, rizwan.bizdev@gmail.com, was identified by investigators as linked to the same operator network. Analyst firm BrutalTrade traced eight GitHub accounts with associated developer emails before those accounts were deleted post-exploit. The same network of alleged operators is linked to at least three prior projects: ZinoFinance, Zero-G Finance, and PerfectSwap. All three are alleged to share infrastructure registered through the privacy-focused domain registrar Njalla, consistent with a pattern of serial exit scam operations. No confirmed legal identity has been established through public court records or law enforcement disclosures as of the time of this investigation. Zenith Security's representative Zenith256 publicly stated that the firm had identified an IP address associated with the operators and would share it with relevant authorities. Law enforcement reports were filed in Singapore and South Korea according to secondary reporting, but no confirmed arrests or charges had been publicly announced.","heading":"Alleged Operator Identity and Prior Projects","severity":"critical","sources":[{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"},{"credibility":2,"name":"Hyperliquid's HyperVault Project Rugged for $3.6M, Devs Disappear — Yahoo Finance / CryptoNews syndication","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-hypervault-project-rugged-3-103317778.html"}]},{"content":"Hypervault Finance operated as a non-custodial, auto-compounding yield aggregator on the HyperEVM layer of Hyperliquid. The protocol's vaults covered assets including USDC, USDe, UBTC, UETH, USOL, USD0, kHYPE, WHYPE, and UPUMP. Unlike the widely adopted ERC-4626 tokenized vault standard, Hypervault's smart contracts used an internal ledger accounting system with no on-chain share tokens issued to depositors. User balances were tracked inside the contract's internal state via a global accrual index, making it difficult for casual observers or automated monitoring tools to audit depositor ownership or detect anomalous balance changes from public block explorers. The contracts also contained privileged functions hidden behind access-control modifiers, which investigators allege were the mechanism used to execute the unauthorized drain. The combination of non-standard accounting, hidden privileged functions, and the absence of a publicly disclosed audit created conditions that investigators characterize as structurally favorable to an exit scam.","heading":"Protocol Design and Privileged Access Risk","severity":"high","sources":[{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":2,"name":"DeFi's Unregulated Frontier: Hypervault Disappears with $3.6 Million via Tornado Cash — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560604989007"}]},{"content":"Hypervault Finance marketed annualized yields of 76% on stablecoin vaults and up to 95% on HYPE liquidity vaults. These figures were substantially above prevailing market rates for comparable DeFi yield products. The protocol attracted approximately 1,100 depositors across nine vaults. Total value locked (TVL) reached a reported peak of approximately $5.86–6.01 million in the days before the drain, according to data aggregated by DefiLlama. Community researcher HypingBull raised alarms about audit authenticity on September 4, 2025, when TVL was approximately $700,000, but deposits continued to grow substantially in the three weeks following that warning. DefiLlama added a 'rug pull' notice to the Hypervault protocol listing following the incident.","heading":"Yield Promises and Depositor Profile","severity":"high","sources":[{"credibility":2,"name":"HypervaultFi goes for suspected rug pull, takes $3.6M from Hyperliquid users and nukes X account — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/"},{"credibility":2,"name":"Hypervault Shuts Social After $3.6M Suspected Rugpull: What Happened? — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hypervault-shuts-social-3-6m-133302287.html"},{"credibility":2,"name":"DeFi protocol Hypervault vanishes after $3.6 million suspected rugpull — The Block","type":"news_article","url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"}]},{"content":"The Hypervault incident exposed a gap in on-chain monitoring coverage for the Hyperliquid ecosystem. No major automated alert service flagged the anomalous bridge-and-drain pattern before the funds reached Tornado Cash and became effectively unrecoverable. PeckShield's alert was published after the drain was already complete. The Hyperliquid ecosystem commanded approximately $2 billion in TVL at the time of the incident, having attracted institutional interest from asset managers including VanEck and State Street regarding a proposed USDH stablecoin. The Hyperliquid core team publicly distanced itself from Hypervault and reminded users to verify third-party integrations independently. The incident followed a separate $13.5 million loss on Hyperliquid in March 2025 due to token manipulation, underscoring recurring risk in the ecosystem for third-party protocol deployments.","heading":"Monitoring Gaps and Ecosystem Context","severity":"medium","sources":[{"credibility":2,"name":"$3.6M Drained From Hyperliquid DeFi Platform Hypervault in 'Abnormal Withdrawal' — Decrypt","type":"news_article","url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"credibility":2,"name":"DeFi Rug Pulls: How Hypervault's $3.6M Scam Exposed Critical Risks — OKX Learn","type":"research","url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks"},{"credibility":2,"name":"Hypervault Rug Pull? PeckShield Flags Millions Lost as Project Goes Dark — Blocmates","type":"news_article","url":"https://www.blocmates.com/news-posts/hypervault-rug-pull-peckshield-flags-millions-lost-as-project-goes-darkug-pull"}]},{"content":"Recovery of stolen funds is considered highly unlikely by analysts due to the use of Tornado Cash as an anonymization layer for the bulk of the approximately 752–1,126 ETH extracted. The deposit of funds into Tornado Cash, a sanctioned mixing service, effectively severs the on-chain trail and makes asset tracing and recovery extremely difficult. Law enforcement reports are alleged to have been filed in Singapore and South Korea, and Zenith Security stated it would share IP-level intelligence with authorities. However, as of the time of this investigation, no confirmed arrests, asset freezes, or restitution mechanisms had been publicly announced. No compensation fund or community recovery proposal was established by the project operators.","heading":"Fund Recovery Prospects","severity":"high","sources":[{"credibility":2,"name":"DeFi Protocol Hypervault Vanishes with $3.6 Million in Crypto Assets — ForkLog","type":"news_article","url":"https://forklog.com/en/defi-protocol-hypervault-vanishes-with-3-6-million-in-crypto-assets/"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"}]}],"sources_used":[{"credibility":2,"name":"DeFi protocol Hypervault vanishes after $3.6 million suspected rugpull — The Block","type":"news_article","url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"},{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":2,"name":"$3.6M Drained From Hyperliquid DeFi Platform Hypervault in 'Abnormal Withdrawal' — Decrypt","type":"news_article","url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"credibility":2,"name":"Hyperliquid's HyperVault Project Rugged for $3.6M, Devs Disappear — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/hyperliquids-hypervault-project-rugged-for-3-6m-devs-disappear/"},{"credibility":2,"name":"DeFi's Unregulated Frontier: Hypervault Disappears with $3.6 Million via Tornado Cash — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560604989007"},{"credibility":2,"name":"DeFi Rug Pulls: How Hypervault's $3.6M Scam Exposed Critical Risks — OKX Learn","type":"research","url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks"},{"credibility":2,"name":"Hypervault Shuts Social After $3.6M Suspected Rugpull: What Happened? — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hypervault-shuts-social-3-6m-133302287.html"},{"credibility":2,"name":"HypervaultFi goes for suspected rug pull, takes $3.6M from Hyperliquid users and nukes X account — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/"},{"credibility":2,"name":"Hypervault Drains $3.6M, 752 ETH Hits Tornado Cash — CoinEdition","type":"news_article","url":"https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/"},{"credibility":2,"name":"Hypervault Finance Loses $3.6 Million in Suspected Rug Pull — CoinCentral","type":"news_article","url":"https://coincentral.com/hypervault-finance-loses-3-6-million-in-suspected-rug-pull/"},{"credibility":2,"name":"DeFi Protocol Hypervault Vanishes with $3.6 Million in Crypto Assets — ForkLog","type":"news_article","url":"https://forklog.com/en/defi-protocol-hypervault-vanishes-with-3-6-million-in-crypto-assets/"},{"credibility":2,"name":"Hypervault Rug Pull? PeckShield Flags Millions Lost as Project Goes Dark — Blocmates","type":"news_article","url":"https://www.blocmates.com/news-posts/hypervault-rug-pull-peckshield-flags-millions-lost-as-project-goes-darkug-pull"},{"credibility":2,"name":"DeFi Platform Hypervault Goes Offline Following $3.6M Rugpull — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2025/09/26/defi-platform-hypervault-goes-offline-following-3-6m-rugpull/"},{"credibility":2,"name":"Hyperliquid-Based Project Faces $3.6 Million Controversy Amid Rug Pull Fears — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-based-project-faces-3-093814438.html"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"},{"credibility":3,"name":"HypingBull X post warning about Hypervault audit claims","type":"social_media","url":"https://x.com/hypingbull/status/1963685902946824642"},{"credibility":2,"name":"Hyperliquid DeFi Project Hypervault Accused of Rug Pull — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2025/09/27/hyperliquid-defi-project-hypervault-accused-of-rug-pull-as-3600000-worth-of-crypto-disappears-into-tornado-cash-peckshield/"},{"credibility":3,"name":"DeFi Community On Alert Following Hypervault's $3.6 Million Suspected Rug Pull — Mitrade","type":"news_article","url":"https://www.mitrade.com/insights/news/live-news/article-3-1154455-20250927"}],"summary":"Hypervault Finance was a yield-aggregating DeFi vault protocol built on the HyperEVM layer of the Hyperliquid blockchain that executed a confirmed exit scam on or around September 25–26, 2025, draining approximately $3.6–4.64 million from roughly 1,100 depositors. Operators bridged funds to Ethereum via deBridge, converted assets to ETH, and routed approximately 752 ETH into Tornado Cash to obscure the trail before deleting all web properties, social media accounts, and GitHub repositories. The project had falsely claimed ongoing security audits by Spearbit, Pashov Group, and Code4rena — none of which were conducted — and attracted deposits with promises of 76–95% annualized yields on stablecoins and HYPE liquidity tokens.","timeline":[{"date":"2025-09-04","event":"Community researcher HypingBull publicly warned on X that Hypervault's claimed audits from Spearbit, Pashov, and Code4rena appeared fabricated. Direct contact with Pashov Group returned the response: 'First time I hear the project with this name.' Code4rena's public listing showed no pending Hypervault audit. TVL was approximately $700,000 at time of warning.","source":"X (Twitter) post by HypingBull; corroborated by Rekt News","source_url":"https://x.com/hypingbull/status/1963685902946824642"},{"date":"2025-09-14","event":"Hypervault publicly announced that an audit had commenced with Zenith Security, a legitimate audit firm.","source":"Rekt News — Hypervault Rugged","source_url":"https://rekt.news/hypervault-rugged"},{"date":"2025-09-21","event":"Zenith Security delivered a private draft audit report to the Hypervault team identifying 42 vulnerabilities — 6 high severity and 10 medium severity — with a recommendation for full re-audit after remediation. The report was never publicly disclosed by the project.","source":"Rekt News — Hypervault Rugged; Quadriga Initiative","source_url":"https://rekt.news/hypervault-rugged"},{"date":"2025-09-24","event":"TVL on Hypervault reached approximately $4.97–6.01 million according to DefiLlama, representing peak depositor exposure ahead of the drain.","source":"Rekt News — Hypervault Rugged; Decrypt","source_url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"date":"2025-09-25","event":"Rug pull executed. All nine Hypervault vaults on HyperEVM were drained by the project operators using privileged contract access. Funds were bridged from Hyperliquid to Ethereum via deBridge.","source":"Rekt News — Hypervault Rugged; Quadriga Initiative","source_url":"https://rekt.news/hypervault-rugged"},{"date":"2025-09-26","event":"PeckShield publicly flagged 'abnormal withdrawal of ~$3.6M worth of crypto from @hypervaultfi.' Approximately 752 ETH (estimated $3 million) was confirmed deposited into Tornado Cash. Hypervault's website, X account, Discord server, and GitHub repositories were all deleted. The Block, Decrypt, CryptoNews, and other outlets began covering the incident.","source":"PeckShield alert; The Block; Decrypt; CryptoNews","source_url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"},{"date":"2025-09-27","event":"Zenith Security publicly confirmed it would cooperate with investigators and stated it had identified IP-level information about the operators to share with authorities. On-chain analysts BrutalTrade and SpecterAnalyst published wallet address linkages. Alleged prior projects ZinoFinance, Zero-G Finance, and PerfectSwap were identified as linked to the same operator network.","source":"Rekt News — Hypervault Rugged; Quadriga Initiative","source_url":"https://rekt.news/hypervault-rugged"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5a735817-864d-4b5b-b7d0-9da6b815639acopy