Audit log

Every state-changing event for HyperVault: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-27 18:53:49Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,560,482

   sig

   3ja6bduttEM5…7uyWYUoecopyexplorer ↗

   hash

   2XCNGsy7hoXV…rJPQJWyScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4553 B) ▸

   {"actor":"system:backfill","investigation_id":"369d1a75-50de-4cc7-80c4-ef3abebac1b1","kind":"publish","page_slug":"hypervault","published_at":"2026-05-27T18:53:49.401Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"HyperVault","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/hypervault","type":"other","url":""},{"credibility":3,"name":"https://www.okx.com/en-us/learn/hypervault-rug-pull-defi-scam","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/hyperliquid-hypervault-rug-pull/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/hypervault","type":"other","url":""},{"credibility":3,"name":"https://bitcoinist.com/defi-alert-hypervaults-3-6-million-rug-pull/amp/","type":"other","url":""},{"credibility":3,"name":"https://coinedition.com/hypervault-drains-3-6m-752-eth-hits-tornado-cash/","type":"other","url":""},{"credibility":3,"name":"https://www.coinspeaker.com/hypervault-rug-pull-3-6m/amp/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/hypervault-raises-rug-pull-fears-after-3-6m-vanishes/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://bitcoinist.com/defi-alert-hypervaults-3-6-million-rug-pull/amp/","type":"other","url":""},{"credibility":3,"name":"https://coincentral.com/hypervault-vanishes-3-6m-drained-in-suspected-rug-pull/","type":"other","url":""},{"credibility":3,"name":"https://www.okx.com/en-us/learn/defi-rug-pulls-hypervault-scam-risks","type":"other","url":""},{"credibility":3,"name":"https://x.com/hypingbull/status/1963685902946824642","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/hypingbull/status/1963685902946824642","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/hyperliquid-hypervault-rug-pull/","type":"other","url":""},{"credibility":3,"name":"https://www.coinspeaker.com/hypervault-rug-pull-3-6m/amp/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptopolitan.com/hypervaultfi-suspected-rug-pull-takes-3-6m/","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/news/feed/00e88-hypervaultfi-suspected-rug-pull-takes-3-6m","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/hyperliquid-hypervault-rug-pull/","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/news/detail/12560604989007","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""}]}],"sources_used":[],"summary":"HyperVault (also known as HyperVaultFi, ticker @hypervaultfi) was a yield optimization protocol built on the Hyperliquid Layer 1 blockchain that marketed itself as a multichain DeFi hub offering APRs of up to 95%. On September 26, 2025, approximately $3.6 million in user funds were drained from the protocol, bridged to Ethereum, converted to approximately 752 ETH, and funneled into Tornado Cash; the team then deleted all social media accounts and the website went offline, in what blockchain security firm PeckShield and multiple crypto news outlets characterized as a rug pull. No founders have been publicly identified by name; at least one team member operated under the pseudonym 0xnick.","timeline":[{"date":"2025-09-04","event":"Community member HypingBull posts warning on X flagging HyperVault's fabricated audit claims (Spearbit, Pashov, Code4rena) and urging immediate withdrawals; TVL at approximately $700,000 at this point.","source":""},{"date":"2025-09-26","event":"PeckShield flags an abnormal withdrawal of approximately $3.6 million from HyperVault. Funds are bridged from Hyperliquid to Ethereum, converted to approximately 752 ETH, and deposited into Tornado Cash.","source":""},{"date":"2025-09-26","event":"HyperVault deletes X account @hypervaultfi, takes website offline, and shuts down Discord server. Protocol TVL drops to $0.","source":""},{"date":"2025-09-26","event":"Multiple crypto security and news outlets including The Block, CoinSpeaker, CryptoNews, Bitcoinist, and Bitget report the suspected rug pull. Over 1,100 depositors affected.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4ca60905-a3e6-4ac9-8985-0562df7d7107copy