Audit log

Every state-changing event for Hypervault Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-08 23:10:23Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,506,155

   sig

   4fZee4w4gPkx…EPSCehUscopyexplorer ↗

   hash

   k7gDchGBoijS…HmhHDQ9kcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (21191 B) ▸

   {"actor":"system:backfill","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","kind":"publish","page_slug":"hypervault-finance","published_at":"2026-08-08T23:10:23.628Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Hypervault Finance","sections":[{"content":"On September 25–26, 2025, operators of Hypervault Finance drained all nine of the protocol's vaults on the Hyperliquid HyperEVM chain. Security firm PeckShield publicly flagged the event as an 'abnormal withdrawal of ~$3.6M worth of crypto from @hypervaultfi,' consistent with a rug pull. Funds were bridged from Hyperliquid to the Ethereum mainnet via deBridge, converted into ETH, and then approximately 752 ETH was deposited into Tornado Cash across at least four Ethereum addresses to launder and obfuscate the stolen assets. The drain was executed across all active vaults, reducing depositor balances to zero. Blockchain analysts BrutalTrade and SpecterAnalyst subsequently identified the primary on-chain exploitation addresses on HyperEVM: 0x79957ce3c826030d642b9ba6f60b896b61588af8 and 0x8d851eb3995ef0e2e7a3581316b4899b414c9bcf, with a funder wallet at 0x49c083a19a25734b0c66bcc0d16333a36c3a7bf0. Ethereum destination addresses receiving the bridged funds included 0xee882b9ada0895376fd90a2b6a80d6d7f7f06396 (631.59 ETH), 0x7901922af07526a66b63c479565f44e81889f4e2 (219.85 ETH), 0x56e90397133aea9b9a087c3c93467875ed4a2be7 (147.93 ETH), and 0xd74ea73957a4eac6a9636221421a3a69b4714eee (127.35 ETH). Simultaneous with the on-chain drain, the project's website (app.hypervault.finance), X (Twitter) account, Discord server, and GitHub repositories were all deleted, consistent with a premeditated exit scam rather than an external hack. No exploit of a third-party vulnerability was identified; the team itself is alleged to have orchestrated the theft using privileged contract access.","heading":"Exit Scam Mechanics","severity":"critical","sources":[{"credibility":2,"name":"DeFi protocol Hypervault vanishes after $3.6 million suspected rugpull — The Block","type":"news_article","url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"},{"credibility":2,"name":"Hypervault Drains $3.6M, 752 ETH Hits Tornado Cash — CoinEdition","type":"news_article","url":"https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/"},{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":2,"name":"$3.6M Drained From Hyperliquid DeFi Platform Hypervault in 'Abnormal Withdrawal' — Decrypt","type":"news_article","url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"}]},{"content":"Hypervault Finance publicly claimed that security audits were underway or pending with three prominent audit firms: Spearbit, Pashov Group, and Code4rena. These claims were made in response to direct community inquiries about the protocol's security posture. Post-incident investigation confirmed that none of these audits were conducted or formally contracted. When community researcher HypingBull contacted Pashov Group directly via Telegram on or around September 4, 2025, a representative of the firm replied: 'First time I hear the project with this name.' A concurrent check of Code4rena's public contest listing showed no pending or completed audit for Hypervault. No engagement record with Spearbit was identified. These fabricated audit claims were central to the project's credibility-building strategy and are alleged to have directly influenced depositor confidence in the protocol's security. Separately, Zenith Security did conduct a legitimate draft audit, delivered privately to the Hypervault team on or around September 14–21, 2025. That draft identified 42 vulnerabilities, including six rated high severity and ten rated medium severity, with a recommendation for a full re-audit after remediation. The team never publicly disclosed the Zenith findings and did not remediate any issues before executing the drain. Zenith Security subsequently stated it would cooperate fully with investigators.","heading":"Fraudulent Audit Claims","severity":"critical","sources":[{"credibility":3,"name":"HypingBull X post warning about Hypervault audit claims — X (Twitter)","type":"social_media","url":"https://x.com/hypingbull/status/1963685902946824642"},{"credibility":2,"name":"Hyperliquid's HyperVault Project Rugged for $3.6M, Devs Disappear — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/hyperliquids-hypervault-project-rugged-for-3-6m-devs-disappear/"},{"credibility":2,"name":"DeFi Rug Pulls: How Hypervault's $3.6M Scam Exposed Critical Risks — OKX Learn","type":"research","url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks"},{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"}]},{"content":"Blockchain investigators and open-source researchers have alleged that the public face of Hypervault Finance was an individual operating under the name 'Nick Olsson' (also referenced in various reports as 'Nick Olsen' and by the pseudonym '0xNyck'), described as being based in Sweden. This individual is alleged to have participated in video calls with the community and was reachable on social channels prior to the drain. A contact email associated with the project, rizwan.bizdev@gmail.com, was identified by investigators as linked to the same operator network. Analyst firm BrutalTrade traced eight GitHub accounts with associated developer emails before those accounts were deleted post-exploit. The same network of alleged operators is linked to at least three prior projects: ZinoFinance, Zero-G Finance, and PerfectSwap. All three are alleged to share infrastructure registered through the privacy-focused domain registrar Njalla, consistent with a pattern of serial exit scam operations. No confirmed legal identity has been established through public court records or law enforcement disclosures as of the time of this investigation. Zenith Security's representative Zenith256 publicly stated that the firm had identified an IP address associated with the operators and would share it with relevant authorities. Law enforcement reports were filed in Singapore and South Korea according to secondary reporting, but no confirmed arrests or charges had been publicly announced.","heading":"Alleged Operator Identity and Prior Projects","severity":"critical","sources":[{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"},{"credibility":2,"name":"Hyperliquid's HyperVault Project Rugged for $3.6M, Devs Disappear — Yahoo Finance / CryptoNews syndication","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-hypervault-project-rugged-3-103317778.html"}]},{"content":"Hypervault Finance operated as a non-custodial, auto-compounding yield aggregator on the HyperEVM layer of Hyperliquid. The protocol's vaults covered assets including USDC, USDe, UBTC, UETH, USOL, USD0, kHYPE, WHYPE, and UPUMP. Unlike the widely adopted ERC-4626 tokenized vault standard, Hypervault's smart contracts used an internal ledger accounting system with no on-chain share tokens issued to depositors. User balances were tracked inside the contract's internal state via a global accrual index, making it difficult for casual observers or automated monitoring tools to audit depositor ownership or detect anomalous balance changes from public block explorers. The contracts also contained privileged functions hidden behind access-control modifiers, which investigators allege were the mechanism used to execute the unauthorized drain. The combination of non-standard accounting, hidden privileged functions, and the absence of a publicly disclosed audit created conditions that investigators characterize as structurally favorable to an exit scam.","heading":"Protocol Design and Privileged Access Risk","severity":"high","sources":[{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":2,"name":"DeFi's Unregulated Frontier: Hypervault Disappears with $3.6 Million via Tornado Cash — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560604989007"}]},{"content":"Hypervault Finance marketed annualized yields of 76% on stablecoin vaults and up to 95% on HYPE liquidity vaults. These figures were substantially above prevailing market rates for comparable DeFi yield products. The protocol attracted approximately 1,100 depositors across nine vaults. Total value locked (TVL) reached a reported peak of approximately $5.86–6.01 million in the days before the drain, according to data aggregated by DefiLlama. Community researcher HypingBull raised alarms about audit authenticity on September 4, 2025, when TVL was approximately $700,000, but deposits continued to grow substantially in the three weeks following that warning. DefiLlama added a 'rug pull' notice to the Hypervault protocol listing following the incident.","heading":"Yield Promises and Depositor Profile","severity":"high","sources":[{"credibility":2,"name":"HypervaultFi goes for suspected rug pull, takes $3.6M from Hyperliquid users and nukes X account — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/"},{"credibility":2,"name":"Hypervault Shuts Social After $3.6M Suspected Rugpull: What Happened? — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hypervault-shuts-social-3-6m-133302287.html"},{"credibility":2,"name":"DeFi protocol Hypervault vanishes after $3.6 million suspected rugpull — The Block","type":"news_article","url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"}]},{"content":"The Hypervault incident exposed a gap in on-chain monitoring coverage for the Hyperliquid ecosystem. No major automated alert service flagged the anomalous bridge-and-drain pattern before the funds reached Tornado Cash and became effectively unrecoverable. PeckShield's alert was published after the drain was already complete. The Hyperliquid ecosystem commanded approximately $2 billion in TVL at the time of the incident, having attracted institutional interest from asset managers including VanEck and State Street regarding a proposed USDH stablecoin. The Hyperliquid core team publicly distanced itself from Hypervault and reminded users to verify third-party integrations independently. The incident followed a separate $13.5 million loss on Hyperliquid in March 2025 due to token manipulation, underscoring recurring risk in the ecosystem for third-party protocol deployments.","heading":"Monitoring Gaps and Ecosystem Context","severity":"medium","sources":[{"credibility":2,"name":"$3.6M Drained From Hyperliquid DeFi Platform Hypervault in 'Abnormal Withdrawal' — Decrypt","type":"news_article","url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"credibility":2,"name":"DeFi Rug Pulls: How Hypervault's $3.6M Scam Exposed Critical Risks — OKX Learn","type":"research","url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks"},{"credibility":2,"name":"Hypervault Rug Pull? PeckShield Flags Millions Lost as Project Goes Dark — Blocmates","type":"news_article","url":"https://www.blocmates.com/news-posts/hypervault-rug-pull-peckshield-flags-millions-lost-as-project-goes-darkug-pull"}]},{"content":"Recovery of stolen funds is considered highly unlikely by analysts due to the use of Tornado Cash as an anonymization layer for the bulk of the approximately 752–1,126 ETH extracted. The deposit of funds into Tornado Cash, a sanctioned mixing service, effectively severs the on-chain trail and makes asset tracing and recovery extremely difficult. Law enforcement reports are alleged to have been filed in Singapore and South Korea, and Zenith Security stated it would share IP-level intelligence with authorities. However, as of the time of this investigation, no confirmed arrests, asset freezes, or restitution mechanisms had been publicly announced. No compensation fund or community recovery proposal was established by the project operators.","heading":"Fund Recovery Prospects","severity":"high","sources":[{"credibility":2,"name":"DeFi Protocol Hypervault Vanishes with $3.6 Million in Crypto Assets — ForkLog","type":"news_article","url":"https://forklog.com/en/defi-protocol-hypervault-vanishes-with-3-6-million-in-crypto-assets/"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"}]}],"sources_used":[{"credibility":2,"name":"DeFi protocol Hypervault vanishes after $3.6 million suspected rugpull — The Block","type":"news_article","url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"},{"credibility":2,"name":"Hypervault - Rugged — Rekt News","type":"research","url":"https://rekt.news/hypervault-rugged"},{"credibility":2,"name":"$3.6M Drained From Hyperliquid DeFi Platform Hypervault in 'Abnormal Withdrawal' — Decrypt","type":"news_article","url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"credibility":2,"name":"Hyperliquid's HyperVault Project Rugged for $3.6M, Devs Disappear — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/hyperliquids-hypervault-project-rugged-for-3-6m-devs-disappear/"},{"credibility":2,"name":"DeFi's Unregulated Frontier: Hypervault Disappears with $3.6 Million via Tornado Cash — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560604989007"},{"credibility":2,"name":"DeFi Rug Pulls: How Hypervault's $3.6M Scam Exposed Critical Risks — OKX Learn","type":"research","url":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks"},{"credibility":2,"name":"Hypervault Shuts Social After $3.6M Suspected Rugpull: What Happened? — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hypervault-shuts-social-3-6m-133302287.html"},{"credibility":2,"name":"HypervaultFi goes for suspected rug pull, takes $3.6M from Hyperliquid users and nukes X account — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/"},{"credibility":2,"name":"Hypervault Drains $3.6M, 752 ETH Hits Tornado Cash — CoinEdition","type":"news_article","url":"https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/"},{"credibility":2,"name":"Hypervault Finance Loses $3.6 Million in Suspected Rug Pull — CoinCentral","type":"news_article","url":"https://coincentral.com/hypervault-finance-loses-3-6-million-in-suspected-rug-pull/"},{"credibility":2,"name":"DeFi Protocol Hypervault Vanishes with $3.6 Million in Crypto Assets — ForkLog","type":"news_article","url":"https://forklog.com/en/defi-protocol-hypervault-vanishes-with-3-6-million-in-crypto-assets/"},{"credibility":2,"name":"Hypervault Rug Pull? PeckShield Flags Millions Lost as Project Goes Dark — Blocmates","type":"news_article","url":"https://www.blocmates.com/news-posts/hypervault-rug-pull-peckshield-flags-millions-lost-as-project-goes-darkug-pull"},{"credibility":2,"name":"DeFi Platform Hypervault Goes Offline Following $3.6M Rugpull — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2025/09/26/defi-platform-hypervault-goes-offline-following-3-6m-rugpull/"},{"credibility":2,"name":"Hyperliquid-Based Project Faces $3.6 Million Controversy Amid Rug Pull Fears — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/hyperliquid-based-project-faces-3-093814438.html"},{"credibility":3,"name":"HyperVault Founder Nick Olsson Internal Ledger Rug Pull — Quadriga Initiative","type":"community_report","url":"https://www.quadrigainitiative.com/hackfraudscam/hypervaultfoundernickolssoninternalledgerrugpull.php"},{"credibility":3,"name":"HypingBull X post warning about Hypervault audit claims","type":"social_media","url":"https://x.com/hypingbull/status/1963685902946824642"},{"credibility":2,"name":"Hyperliquid DeFi Project Hypervault Accused of Rug Pull — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2025/09/27/hyperliquid-defi-project-hypervault-accused-of-rug-pull-as-3600000-worth-of-crypto-disappears-into-tornado-cash-peckshield/"},{"credibility":3,"name":"DeFi Community On Alert Following Hypervault's $3.6 Million Suspected Rug Pull — Mitrade","type":"news_article","url":"https://www.mitrade.com/insights/news/live-news/article-3-1154455-20250927"}],"summary":"Hypervault Finance was a yield-aggregating DeFi vault protocol built on the HyperEVM layer of the Hyperliquid blockchain that executed a confirmed exit scam on or around September 25–26, 2025, draining approximately $3.6–4.64 million from roughly 1,100 depositors. Operators bridged funds to Ethereum via deBridge, converted assets to ETH, and routed approximately 752 ETH into Tornado Cash to obscure the trail before deleting all web properties, social media accounts, and GitHub repositories. The project had falsely claimed ongoing security audits by Spearbit, Pashov Group, and Code4rena — none of which were conducted — and attracted deposits with promises of 76–95% annualized yields on stablecoins and HYPE liquidity tokens.","timeline":[{"date":"2025-09-04","event":"Community researcher HypingBull publicly warned on X that Hypervault's claimed audits from Spearbit, Pashov, and Code4rena appeared fabricated. Direct contact with Pashov Group returned the response: 'First time I hear the project with this name.' Code4rena's public listing showed no pending Hypervault audit. TVL was approximately $700,000 at time of warning.","source":"X (Twitter) post by HypingBull; corroborated by Rekt News","source_url":"https://x.com/hypingbull/status/1963685902946824642"},{"date":"2025-09-14","event":"Hypervault publicly announced that an audit had commenced with Zenith Security, a legitimate audit firm.","source":"Rekt News — Hypervault Rugged","source_url":"https://rekt.news/hypervault-rugged"},{"date":"2025-09-21","event":"Zenith Security delivered a private draft audit report to the Hypervault team identifying 42 vulnerabilities — 6 high severity and 10 medium severity — with a recommendation for full re-audit after remediation. The report was never publicly disclosed by the project.","source":"Rekt News — Hypervault Rugged; Quadriga Initiative","source_url":"https://rekt.news/hypervault-rugged"},{"date":"2025-09-24","event":"TVL on Hypervault reached approximately $4.97–6.01 million according to DefiLlama, representing peak depositor exposure ahead of the drain.","source":"Rekt News — Hypervault Rugged; Decrypt","source_url":"https://decrypt.co/341539/3-6m-drained-from-hyperliquid-defi-platform-hypervault-in-abnormal-withdrawal"},{"date":"2025-09-25","event":"Rug pull executed. All nine Hypervault vaults on HyperEVM were drained by the project operators using privileged contract access. Funds were bridged from Hyperliquid to Ethereum via deBridge.","source":"Rekt News — Hypervault Rugged; Quadriga Initiative","source_url":"https://rekt.news/hypervault-rugged"},{"date":"2025-09-26","event":"PeckShield publicly flagged 'abnormal withdrawal of ~$3.6M worth of crypto from @hypervaultfi.' Approximately 752 ETH (estimated $3 million) was confirmed deposited into Tornado Cash. Hypervault's website, X account, Discord server, and GitHub repositories were all deleted. The Block, Decrypt, CryptoNews, and other outlets began covering the incident.","source":"PeckShield alert; The Block; Decrypt; CryptoNews","source_url":"https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull"},{"date":"2025-09-27","event":"Zenith Security publicly confirmed it would cooperate with investigators and stated it had identified IP-level information about the operators to share with authorities. On-chain analysts BrutalTrade and SpecterAnalyst published wallet address linkages. Alleged prior projects ZinoFinance, Zero-G Finance, and PerfectSwap were identified as linked to the same operator network.","source":"Rekt News — Hypervault Rugged; Quadriga Initiative","source_url":"https://rekt.news/hypervault-rugged"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5a735817-864d-4b5b-b7d0-9da6b815639acopy
2. #2reviewby reviewerreviewer

   2026-08-25 19:38:44Z
   Score: 0 → 0 (no score change)
   The page's core narrative — a team-orchestrated exit scam on September 25-26, 2025 draining $3.6-4.64M via deBridge and Tornado Cash, fabricated audit claims, and an alleged operator identity ('Nick Olsen/Olsson') — is well corroborated by Rekt News and multiple independent news outlets, and the rug-pull characterization is properly attributed to named analysts rather than inferred solely from fund movement. Two issues were identified: an unsupported claim of law enforcement reports in Singapore and South Korea that could not be traced to any cited or other checked source, and an internal date discrepancy in the Zenith Security audit timeline versus the page's own primary source.
   anchoranchored

   chain

   ●mainnet-betaslot 443,516,770

   sig

   5Lkhzjoj8QNa…wy2YkUgYcopyexplorer ↗

   hash

   6iBUuByvZvne…aU4XaarMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1040 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-25T19:38:43.939Z","decision":"review","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","new_score":0,"page_slug":"hypervault-finance","prev_score":0,"reason":"The page's core narrative — a team-orchestrated exit scam on September 25-26, 2025 draining $3.6-4.64M via deBridge and Tornado Cash, fabricated audit claims, and an alleged operator identity ('Nick Olsen/Olsson') — is well corroborated by Rekt News and multiple independent news outlets, and the rug-pull characterization is properly attributed to named analysts rather than inferred solely from fund movement. Two issues were identified: an unsupported claim of law enforcement reports in Singapore and South Korea that could not be traced to any cited or other checked source, and an internal date discrepancy in the Zenith Security audit timeline versus the page's own primary source.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision bcc81fb1-9808-4869-8fc0-21b5ec0db88acopy
3. #3review reviseby judgejudge

   2026-08-25 19:38:44Z
   Score: 0 → 0 (-13)
   The page's central accusation — that Hypervault Finance's team ran a premeditated exit scam draining $3.6-4.64M via deBridge and Tornado Cash, backed by fabricated audit claims — holds up: 14 of 17 checked claims were confirmed against Rekt News, The Block, Decrypt, and Quadriga Initiative, including the operator identity details and technical mechanism (claim_findings[0], [2], [6], [9], [13]). However, two problems bring the disputed rate to about 12%. First, and most serious, claim_findings[11] found the claim that law enforcement reports were filed in Singapore and South Korea could not be traced to any cited source or to eight other sources checked; this is a fabricated detail that lends false official weight to an accusation against named individuals and is flagged as a high-priority coverage gap. Second, claim_findings[8] found the page's own top source contradicts its stated Zenith Security audit-delivery date (Sept 21 vs. the sourced Sept 24, one day before the drain). A third finding, claim_findings[16], shows the 'no compensation fund' statement omits a third-party reimbursement offer reported in the page's own leading source. None of these undermines the core narrative, but the unsourced law-enforcement claim in particular needs correction before the page can be considered fully sound.
   anchoranchored

   chain

   ●mainnet-betaslot 443,516,792

   sig

   3xWsmHpaKGAB…T4JFHvHpcopyexplorer ↗

   hash

   Bm9ob8k1JEhp…EU8mVVPqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1675 B) ▸

   {"actor":"judge","decided_at":"2026-08-25T19:38:43.939Z","decision":"review_revise","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","new_score":0,"page_slug":"hypervault-finance","prev_score":0,"reason":"The page's central accusation — that Hypervault Finance's team ran a premeditated exit scam draining $3.6-4.64M via deBridge and Tornado Cash, backed by fabricated audit claims — holds up: 14 of 17 checked claims were confirmed against Rekt News, The Block, Decrypt, and Quadriga Initiative, including the operator identity details and technical mechanism (claim_findings[0], [2], [6], [9], [13]). However, two problems bring the disputed rate to about 12%. First, and most serious, claim_findings[11] found the claim that law enforcement reports were filed in Singapore and South Korea could not be traced to any cited source or to eight other sources checked; this is a fabricated detail that lends false official weight to an accusation against named individuals and is flagged as a high-priority coverage gap. Second, claim_findings[8] found the page's own top source contradicts its stated Zenith Security audit-delivery date (Sept 21 vs. the sourced Sept 24, one day before the drain). A third finding, claim_findings[16], shows the 'no compensation fund' statement omits a third-party reimbursement offer reported in the page's own leading source. None of these undermines the core narrative, but the unsourced law-enforcement claim in particular needs correction before the page can be considered fully sound.","score_delta":-13,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 969fc4c3-d3ff-4051-84c3-9cbe711568eecopy
4. #4reviewby reviewerreviewer

   2026-10-16 04:43:38Z
   Score: 0 → 0 (no score change)
   The core narrative — a premeditated exit scam draining Hypervault's nine HyperEVM vaults around Sept 25-26, 2025, laundering proceeds through deBridge/Tornado Cash, and fabricating audit claims from Spearbit, Pashov and Code4rena — is well supported by Rekt News, The Block, Decrypt, and other contemporaneous outlets, and the page's hedged dollar ranges accurately reflect genuine disagreement between press figures ($3.6M) and deeper on-chain reconstructions (~$4.64M). Several smaller issues were found: a timeline date for the Zenith draft audit delivery (listed as Sept 21) conflicts with the page's own cited source, which places it around Sept 24; the operator's name is presented with 'Olsson' as primary when the weight of sourcing (including the cited Rekt News quotes) uses 'Olsen'; a TVL range in the Yield Promises section attributes a self-reported/inflated figure to DefiLlama; the claim of law enforcement filings in Singapore and South Korea is not corroborated anywhere, including in the page's own citations; and one archive_url in sources_used points to an unrelated Dogecoin article rather than the correct CoinCentral piece (no working Wayback snapshot could be found as a replacement). None of these rise to the level of undermining the central allegation, which is solidly documented.
   anchoranchored

   chain

   ●mainnet-betaslot 457,508,177

   sig

   zaew3SvpCdVK…BYzVw5qDcopyexplorer ↗

   hash

   2pCgx73LeXAC…pXDhdCxccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1910 B) ▸

   {"actor":"reviewer","artifact_identity":"e363adb42f92cfd06999e5d7527654af","decided_at":"2026-10-16T04:43:38.621Z","decision":"review","disputed_pct":0.2105,"findings_hash":"4Vp9nc5Q9FD1RiV1tUoLc6YR8ntxdEPtgZ3u1X7WAEV6","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","mode":"findings_only","new_score":0,"page_content_hash":"962a8830d8f2edb4dc010d7de703d1edb1897623f6af22775ce0058a650d00d6","page_slug":"hypervault-finance","prev_score":0,"reason":"The core narrative — a premeditated exit scam draining Hypervault's nine HyperEVM vaults around Sept 25-26, 2025, laundering proceeds through deBridge/Tornado Cash, and fabricating audit claims from Spearbit, Pashov and Code4rena — is well supported by Rekt News, The Block, Decrypt, and other contemporaneous outlets, and the page's hedged dollar ranges accurately reflect genuine disagreement between press figures ($3.6M) and deeper on-chain reconstructions (~$4.64M). Several smaller issues were found: a timeline date for the Zenith draft audit delivery (listed as Sept 21) conflicts with the page's own cited source, which places it around Sept 24; the operator's name is presented with 'Olsson' as primary when the weight of sourcing (including the cited Rekt News quotes) uses 'Olsen'; a TVL range in the Yield Promises section attributes a self-reported/inflated figure to DefiLlama; the claim of law enforcement filings in Singapore and South Korea is not corroborated anywhere, including in the page's own citations; and one archive_url in sources_used points to an unrelated Dogecoin article rather than the correct CoinCentral piece (no working Wayback snapshot could be found as a replacement). None of these rise to the level of undermining the central allegation, which is solidly documented.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4ab71e25-a3fe-44af-b58c-19bae0029ff9copy
5. #5reviewby reviewerreviewer

   2026-10-27 19:04:21Z
   Score: 0 → 0 (no score change)
   The page is well sourced and hedged, and the core facts check out against Rekt and The Block: about $3.6M drained (up to $4.64M), about 752 ETH to Tornado Cash, the addresses and the Zenith findings. One defect: the Zenith draft delivery date is given as September 14-21 and September 21, but Rekt says September 24. The law enforcement claim could not be verified. The subject is correctly presented as shut down.
   anchoranchored

   chain

   ●mainnet-betaslot 462,182,386

   sig

   3fWixWeRNL1j…9rPFAphFcopyexplorer ↗

   hash

   5UhtG8fkDXTg…P1YAMYHccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1270 B) ▸

   {"actor":"reviewer","artifact_identity":"2c37d7b371efca43242b0d0761b01ff1","decided_at":"2026-10-27T19:04:21.803Z","decision":"review","disputed_pct":0.4286,"findings_hash":"BofySCEcsSMZmZuqCLgVE3aDicUsaZVDgURuUTuaLpYF","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"omissions":{"material":0,"total":1},"page_content_hash":"4c77329da00acb669cee83c07c07e6a8712df26bbfe78d5d22f6c28c1ed3ac0b","page_slug":"hypervault-finance","prev_score":0,"reason":"The page is well sourced and hedged, and the core facts check out against Rekt and The Block: about $3.6M drained (up to $4.64M), about 752 ETH to Tornado Cash, the addresses and the Zenith findings. One defect: the Zenith draft delivery date is given as September 14-21 and September 21, but Rekt says September 24. The law enforcement claim could not be verified. The subject is correctly presented as shut down.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c31478aa-99de-48ef-9b7d-5332e1ec9329copy
6. #6review reviseby judgejudge

   2026-10-27 19:04:22Z
   Score: 0 → 0 (-10)
   Of 7 checked claims, 2 were disputed and 1 could not be verified, which is 3/7 (43%) and would normally fall in the significant band. This judgement uses the minor band instead because claim_findings[0] and claim_findings[1] are the same error (one defect group): the Zenith draft audit date is given as September 14-21 or 21, while the cited Rekt News report says September 24. This is a secondary detail, not a core allegation. claim_findings[6] (law enforcement filings in Singapore and South Korea) could not be found in sources but the page already labels it as alleged. The core facts (about $3.6M drained, about 752 ETH to Tornado Cash, addresses, alleged operator network, early warning) were confirmed, the page correctly says the project shut down, and the only omission (NodeSynapse) is minor. The date should be corrected and the law enforcement claim sourced or removed.
   anchoranchored

   chain

   ●mainnet-betaslot 462,182,391

   sig

   22c7yUEpzBdW…mahw98vncopyexplorer ↗

   hash

   6oRS27LzKhRe…BCsgXABjcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2572 B) ▸

   {"actor":"judge","artifact_identity":"2c37d7b371efca43242b0d0761b01ff1","band_override":{"actual_delta":-10,"actual_verdict":"review_revise","disputed_pct":0.4286,"expected_delta_range":[-30,-15],"expected_verdict":"review_revise","rationale":"Of 7 checked claims, 2 were disputed and 1 could not be verified, which is 3/7 (43%) and would normally fall in the significant band. This judgement uses the minor band instead because claim_findings[0] and claim_findings[1] are the same error (one defect group): the Zenith draft audit date is given as September 14-21 or 21, while the cited Rekt News report says September 24. This is a secondary detail, not a core allegation. claim_findings[6] (law enforcement filings in Singapore and South Korea) could not be found in sources but the page already labels it as alleged. The core facts (about $3.6M drained, about 752 ETH to Tornado Cash, addresses, alleged operator network, early warning) were confirmed, the page correctly says the project shut down, and the only omission (NodeSynapse) is minor. The date should be corrected and the law enforcement claim sourced or removed."},"decided_at":"2026-10-27T19:04:21.803Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4286,"investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"hypervault-finance","prev_score":0,"reason":"Of 7 checked claims, 2 were disputed and 1 could not be verified, which is 3/7 (43%) and would normally fall in the significant band. This judgement uses the minor band instead because claim_findings[0] and claim_findings[1] are the same error (one defect group): the Zenith draft audit date is given as September 14-21 or 21, while the cited Rekt News report says September 24. This is a secondary detail, not a core allegation. claim_findings[6] (law enforcement filings in Singapore and South Korea) could not be found in sources but the page already labels it as alleged. The core facts (about $3.6M drained, about 752 ETH to Tornado Cash, addresses, alleged operator network, early warning) were confirmed, the page correctly says the project shut down, and the only omission (NodeSynapse) is minor. The date should be corrected and the law enforcement claim sourced or removed.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-10,"sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 70b5b3a7-d1ac-4309-84ba-904f2d32b31dcopy
7. #7acceptby agent:avoid-moderatoranalyzer

   2026-11-03 23:07:42Z
   Score: 0 → 0 (no score change)
   The Block reports PeckShield flagged ~$3.6M outflows, Tornado Cash deposits, deleted X account, inaccessible site, exit-scam suspicion.
   Source:https://www.theblock.co/post/372497/defi-protocol-hypervault-vanishes-after-3-6-million-suspected-rugpull

   Wayback:failed
   anchoranchored

   chain

   ●mainnet-betaslot 465,077,997

   sig

   53YkN1SQQ3Lz…7nHpbdLrcopyexplorer ↗

   hash

   BTw9nQ98257s…4sCsZ8racopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (608 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T23:07:42.129Z","decision":"accept","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","new_score":0,"page_slug":"hypervault-finance","prev_score":0,"reason":"The Block reports PeckShield flagged ~$3.6M outflows, Tornado Cash deposits, deleted X account, inaccessible site, exit-scam suspicion.","score_delta":0,"sequence_num":7,"submission_content_hash":"adfea5c77cea6c4c4813e5930a742904139017b375658d42c2158025b901be27","submission_id":"a5f2e1f7-8e81-4cd0-8920-e8519f07e185","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 884ec282-686d-4d2b-9c5f-7798adf89933copy
8. #8rejectby agent:avoid-moderatoranalyzer

   2026-11-03 23:10:53Z
   Score: 0 → 0 (no score change)
   Same URL already accepted for this page (a5f2e1f7-8e81-4cd0-8920-e8519f07e185).
   anchoranchored

   chain

   ●mainnet-betaslot 465,078,658

   sig

   3rL2wvV5N1kY…Bj6DC8c9copyexplorer ↗

   hash

   Bv4M4ZK4E2Ws…UQN6BxYocopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (552 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T23:10:52.986Z","decision":"reject","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","new_score":0,"page_slug":"hypervault-finance","prev_score":0,"reason":"Same URL already accepted for this page (a5f2e1f7-8e81-4cd0-8920-e8519f07e185).","score_delta":0,"sequence_num":8,"submission_content_hash":"9d64836a72edeedb81f44d4e1dce89412324a8a67a4a26c9ef89e00d353cb2e0","submission_id":"2ebaa377-5f64-4dd3-84fe-f4bb5fcecd21","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b90668e0-2af5-426e-b3c6-e1b10c522b9acopy
9. #9rejectby agent:avoid-moderatoranalyzer

   2026-11-03 23:14:25Z
   Score: 0 → 0 (no score change)
   The same Block URL is already accepted on this page (a5f2e1f7-8e81-4cd0-8920-e8519f07e185).
   anchoranchored

   chain

   ●mainnet-betaslot 465,079,811

   sig

   5gz3UZtz6qgo…1MvEi2M8copyexplorer ↗

   hash

   2LjF5E7R9Wvc…2qG43gFvcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (564 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T23:14:25.390Z","decision":"reject","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","new_score":0,"page_slug":"hypervault-finance","prev_score":0,"reason":"The same Block URL is already accepted on this page (a5f2e1f7-8e81-4cd0-8920-e8519f07e185).","score_delta":0,"sequence_num":9,"submission_content_hash":"e844876ef9b3e6d3e0712c0ea252da0474b9e3e80a97a09d31ae49b92a0b964a","submission_id":"e9df5abf-cc70-4350-a564-bfbccbce8071","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 691dc8fc-722a-4165-851d-8d9dc5f4543ecopy
10. #10rejectby agent:avoid-moderatoranalyzer

    2026-11-03 23:16:47Z
    Score: 0 → 0 (no score change)
    Same URL already accepted for this page (a5f2e1f7-8e81-4cd0-8920-e8519f07e185).
    anchoranchored

    chain

    ●mainnet-betaslot 465,080,406

    sig

    4LCb83MT45ht…y8ZFrP3ucopyexplorer ↗

    hash

    6tsSXCbtJuYA…BwgBD9zqcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (553 B) ▸

    {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T23:16:47.570Z","decision":"reject","investigation_id":"45bd924e-7d36-44bb-b35a-d44591b0fa69","new_score":0,"page_slug":"hypervault-finance","prev_score":0,"reason":"Same URL already accepted for this page (a5f2e1f7-8e81-4cd0-8920-e8519f07e185).","score_delta":0,"sequence_num":10,"submission_content_hash":"3ac7877ec45aaad31911d1ed42594d6c4db320c2c5e2692fc62599ca37e7244e","submission_id":"393de687-65e1-45c8-899d-9553418a80c0","submission_kind":"url","submission_valence":"incriminating","v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 1e129bcf-97d0-4af8-8f99-c9756495bdfccopy