Audit log

Every state-changing event for Hypurr NFTs: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 15:18:33Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,795,150

   sig

   2Nw3T6y3a8xV…kUmUaQF7copyexplorer ↗

   hash

   Cp93hNkzLCgh…B9k9EWLocopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6866 B) ▸

   {"actor":"system:backfill","investigation_id":"a11c7577-4338-477d-8f85-f61ec2de41f6","kind":"publish","page_slug":"hypurr-nfts","published_at":"2026-05-19T15:18:33.589Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Hypurr NFTs","sections":[{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]},{"content":"","heading":"","severity":"medium","sources":[]}],"sources_used":[{"credibility":2,"name":"ZachXBT Flags $400K Exploit: Hypurr NFTs Drained From Compromised HyperEVM Wallets - Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/zachxbt-flags-400k-exploit-hypurr-093215277.html"},{"credibility":2,"name":"ZachXBT Flags $400K Exploit: Hypurr NFTs Drained From Compromised HyperEVM Wallets - CCN","type":"news_article","url":"https://www.ccn.com/news/technology/zachxbthypurr-400k-exploit-hyperliquid/"},{"credibility":2,"name":"Hyperliquid's Hypurr NFTs Hit $76K Floor Price, But Hacker Steals 8 for $400K Profit - CryptoNews","type":"news_article","url":"https://cryptonews.com/news/hyperliquids-hypurr-nfts-hit-76k-floor-price-but-hacker-steals-8-for-400k-profit/"},{"credibility":2,"name":"Hypurr NFT Fetches $467K After Airdrop As $400K Hack Hits Hyperliquid - InsideBitcoins","type":"news_article","url":"https://insidebitcoins.com/news/hypurr-nft-fetches-467k-after-airdrop-as-400k-hack-hits-hyperliquid"},{"credibility":2,"name":"Hyperliquid's Hypurr NFT airdrop backfires – $400K hack sparks jitters - AMBCrypto","type":"news_article","url":"https://ambcrypto.com/hyperliquids-hypurr-nft-airdrop-backfires-400k-hack-sparks-jitters/"},{"credibility":2,"name":"Hyperliquid's Hypurr NFTs Settle at $55,000 Floor Amid Ecosystem Expansion - The Defiant","type":"news_article","url":"https://thedefiant.io/news/nfts-and-web3/hyperliquid-s-hypurr-nfts-settle-at-usd55-000-floor-amid-ecosystem-expansion"},{"credibility":3,"name":"Hypurr NFTs, the biggest NFT airdrop of 2025 - Airdrop Alert","type":"news_article","url":"https://airdropalert.com/blogs/hypurr-nfts-the-biggest-nft-airdrop/"},{"credibility":1,"name":"Hyper Foundation on X: Hypurr NFTs deployed on HyperEVM","type":"official","url":"https://x.com/HyperFND/status/1972329725080313970"},{"credibility":1,"name":"HyperLiquid Delists JELLY After Vault Squeezed in $13M Tussle - CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/03/26/hyperliquid-delists-jellyjelly-after-vault-squeezed-in-usd13m-tussle"},{"credibility":2,"name":"Hyperdrive Exploit Drains US$782K in Third Major Hyperliquid Security Breach - CryptoNews Australia","type":"news_article","url":"https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/"},{"credibility":3,"name":"Hyperliquid Faces Security Crisis: $700K Stolen in Hyperdrive Hack and $3.6M in HyperVault Exploit - AInvest","type":"news_article","url":"https://www.ainvest.com/news/hyperliquid-faces-security-crisis-700-000-stolen-hyperdrive-hack-3-6m-hypervault-exploit-2509/"},{"credibility":2,"name":"Hyperliquid ($HYPE) Airdrop Scam - PCRisk","type":"research","url":"https://www.pcrisk.com/removal-guides/29899-hyperliquid-hype-airdrop-scam"},{"credibility":2,"name":"Hyperliquid's Hypurr NFTs Hit Record Floor, But Exploit Nets Hacker $400K - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/hyperliquids-hypurr-nfts-hit-record-floor-but-exploit-nets-hacker-400k/"}],"summary":"Hypurr NFTs are a 4,600-piece cat-themed NFT collection airdropped by the Hyper Foundation on September 28, 2025, to early Hyperliquid users who participated in the November 2024 Genesis Event. On the day of launch, blockchain investigator ZachXBT flagged the theft of eight Hypurr NFTs from compromised HyperEVM wallets, yielding approximately $400,000 in profit for the attacker. The collection itself is a legitimate product of the Hyper Foundation, but the incident exposed wallet security vulnerabilities in the HyperEVM ecosystem and coincided with a broader pattern of exploits across Hyperliquid-based protocols in late September 2025.","timeline":[{"date":"2024-11-01","event":"Hyperliquid Genesis Event launches, marking the HYPE token launch. Eligible users opt in to receive a future Hypurr NFT airdrop. HyperEVM not yet live.","source":"","source_url":"https://x.com/HyperFND/status/1972329725080313970"},{"date":"2025-02-01","event":"HyperEVM launches as the general programmability layer for Hyperliquid, enabling NFT and smart contract deployment.","source":"","source_url":"https://x.com/HyperFND/status/1972329725080313970"},{"date":"2025-03-26","event":"JELLYJELLY token manipulation on Hyperliquid causes up to $13.5 million in losses to HLP vault before validators delist the asset, raising centralization concerns.","source":"","source_url":"https://www.coindesk.com/markets/2025/03/26/hyperliquid-delists-jellyjelly-after-vault-squeezed-in-usd13m-tussle"},{"date":"2025-09-27","event":"Hyperdrive, a lending protocol on Hyperliquid, is exploited for approximately $782,000 via a router contract vulnerability allowing arbitrary calls, confirmed by CertiK.","source":"","source_url":"https://cryptonews.com.au/news/hyperdrive-exploit-drains-us782k-in-third-major-hyperliquid-security-breach-131037/"},{"date":"2025-09-28","event":"Hyper Foundation airdrops 4,600 Hypurr NFTs on HyperEVM to Genesis Event participants. Collection generates over $62 million in trading volume within 24 hours. Floor price exceeds $76,000.","source":"","source_url":"https://airdropalert.com/blogs/hypurr-nfts-the-biggest-nft-airdrop/"},{"date":"2025-09-28","event":"ZachXBT publishes Telegram post identifying attacker address 0x72785d42874e965086829ea789a703fe1a5238df as having drained 8 Hypurr NFTs from compromised HyperEVM wallets belonging to Genesis Event participants, profiting approximately $400,000.","source":"","source_url":"https://finance.yahoo.com/news/zachxbt-flags-400k-exploit-hypurr-093215277.html"},{"date":"2025-09-28","event":"HyperVault, a Hyperliquid-based protocol, allegedly exit scams for approximately $3.6 million, with funds laundered through Tornado Cash.","source":"","source_url":"https://www.ainvest.com/news/hyperliquid-faces-security-crisis-700-000-stolen-hyperdrive-hack-3-6m-hypervault-exploit-2509/"},{"date":"2025-10-01","event":"Hypurr NFT floor price settles at approximately $55,000 amid ongoing ecosystem security concerns. Collection remains actively traded on OpenSea.","source":"","source_url":"https://thedefiant.io/news/nfts-and-web3/hyperliquid-s-hypurr-nfts-settle-at-usd55-000-floor-amid-ecosystem-expansion"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f4a3164f-508f-48d5-acdd-72287260a5dacopy
2. #2reviewby reviewerreviewer

   2026-08-19 16:40:05Z
   Score: 42 → 42 (no score change)
   The page's core claims — the legitimate 4,600-piece Hyper Foundation airdrop and the ZachXBT-flagged $400K theft of 8 NFTs from compromised individual wallets — are well corroborated across multiple independent outlets and are accurately hedged (the page correctly frames the collection as a victim/context, not a perpetrator, and hedges the HyperVault item as 'allegedly'). No unhedged allegations or contradicted claims were found. Weaknesses are ones of precision and completeness rather than falsity: several dates in the timeline (HyperVault Sept 26 vs. Sept 28 stated; floor-price settlement Sept 29 vs. Oct 1 stated) are slightly off from the cited sources, one dollar figure ($62M 24h volume) rests on a single lower-credibility source the reviewer could not access, and the page's body `sections` are entirely empty, leaving only the summary and timeline to carry the page's substance.
   anchoranchored

   chain

   ●mainnet-betaslot 443,509,460

   sig

   4gwF8k2QWxdq…fjzYNqkvcopyexplorer ↗

   hash

   AG3Gxfur7poo…NDTSSKuPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1241 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-19T16:40:05.696Z","decision":"review","investigation_id":"a11c7577-4338-477d-8f85-f61ec2de41f6","new_score":42,"page_slug":"hypurr-nfts","prev_score":42,"reason":"The page's core claims — the legitimate 4,600-piece Hyper Foundation airdrop and the ZachXBT-flagged $400K theft of 8 NFTs from compromised individual wallets — are well corroborated across multiple independent outlets and are accurately hedged (the page correctly frames the collection as a victim/context, not a perpetrator, and hedges the HyperVault item as 'allegedly'). No unhedged allegations or contradicted claims were found. Weaknesses are ones of precision and completeness rather than falsity: several dates in the timeline (HyperVault Sept 26 vs. Sept 28 stated; floor-price settlement Sept 29 vs. Oct 1 stated) are slightly off from the cited sources, one dollar figure ($62M 24h volume) rests on a single lower-credibility source the reviewer could not access, and the page's body `sections` are entirely empty, leaving only the summary and timeline to carry the page's substance.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e60d5704-0418-4498-bb93-05e492235e0fcopy
3. #3review approve with notesby judgejudge

   2026-08-19 16:40:05Z
   Score: 42 → 74 (+32)
   This is a calibration review: the page's facts hold up (0 of 11 claims disputed; the two weaker verdicts are minor date/precision issues, not material errors), so the content itself is approved with notes. The score, however, is miscalibrated. Per calibration_assessment and the rubric's own attribution test, the only incident actually tied to Hypurr NFTs / the Hyper Foundation is a third-party wallet-phishing theft against individual Genesis Event recipients (claim_findings[1]-[2], [8]); the cited reporting explicitly attributes the compromise to victim-side wallet security failures, not to any flaw, negligence, or misconduct by the Foundation (claim_findings[2], sources_consulted notes on thedefiant.io). The three other timeline incidents (JELLYJELLY, Hyperdrive, HyperVault) concern separate Hyperliquid-ecosystem protocols and were correctly flagged by the reviewer as ecosystem context that should not be conflated with the entity under review (coverage_gaps[3]). A current score of 42/WARNING implies entity-attributable risk that the evidence does not support; a third-party-attributed incident against an otherwise legitimately delivered, actively-traded product maps to the low end of VERIFIED, not WARNING. Notes: (Populate the empty page `sections` with narrative content — currently only summary and timeline carry substance.) (Correct the HyperVault timeline date to Sept 26, 2025 per the independently corroborating source (page currently states Sept 28).) (Correct the floor-price-settlement timeline date to align with the cited article's own Sept 29 dateline (page currently states Oct 1).) (Replace or supplement the low-credibility (tier 3) sole source for the $62M/24h trading-volume figure with a verifiable secondary source.) (Explicitly label the JELLYJELLY, Hyperdrive, and HyperVault timeline entries as ecosystem context distinct from Hypurr NFTs / Hyper Foundation to avoid guilt-by-association.) (Add coverage of any post-incident developments (recovery, attacker identification/sanctions, wallet-security changes) given the page's freshest substantive reporting is nearly a year stale relative to the current date.)
   anchoranchored

   chain

   ●mainnet-betaslot 443,509,536

   sig

   51LffDioggTC…MTxkdiAFcopyexplorer ↗

   hash

   9i7ke8yPsZnM…vaMMiKu4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2517 B) ▸

   {"actor":"judge","decided_at":"2026-08-19T16:40:05.696Z","decision":"review_approve_with_notes","investigation_id":"a11c7577-4338-477d-8f85-f61ec2de41f6","new_score":74,"page_slug":"hypurr-nfts","prev_score":42,"reason":"This is a calibration review: the page's facts hold up (0 of 11 claims disputed; the two weaker verdicts are minor date/precision issues, not material errors), so the content itself is approved with notes. The score, however, is miscalibrated. Per calibration_assessment and the rubric's own attribution test, the only incident actually tied to Hypurr NFTs / the Hyper Foundation is a third-party wallet-phishing theft against individual Genesis Event recipients (claim_findings[1]-[2], [8]); the cited reporting explicitly attributes the compromise to victim-side wallet security failures, not to any flaw, negligence, or misconduct by the Foundation (claim_findings[2], sources_consulted notes on thedefiant.io). The three other timeline incidents (JELLYJELLY, Hyperdrive, HyperVault) concern separate Hyperliquid-ecosystem protocols and were correctly flagged by the reviewer as ecosystem context that should not be conflated with the entity under review (coverage_gaps[3]). A current score of 42/WARNING implies entity-attributable risk that the evidence does not support; a third-party-attributed incident against an otherwise legitimately delivered, actively-traded product maps to the low end of VERIFIED, not WARNING. Notes: (Populate the empty page `sections` with narrative content — currently only summary and timeline carry substance.) (Correct the HyperVault timeline date to Sept 26, 2025 per the independently corroborating source (page currently states Sept 28).) (Correct the floor-price-settlement timeline date to align with the cited article's own Sept 29 dateline (page currently states Oct 1).) (Replace or supplement the low-credibility (tier 3) sole source for the $62M/24h trading-volume figure with a verifiable secondary source.) (Explicitly label the JELLYJELLY, Hyperdrive, and HyperVault timeline entries as ecosystem context distinct from Hypurr NFTs / Hyper Foundation to avoid guilt-by-association.) (Add coverage of any post-incident developments (recovery, attacker identification/sanctions, wallet-security changes) given the page's freshest substantive reporting is nearly a year stale relative to the current date.)","score_delta":32,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4b20fdd9-3569-4341-b8fe-5ef22436bba6copy
4. #4reviewby reviewerreviewer

   2026-08-26 11:10:10Z
   Score: 74 → 74 (no score change)
   The page's core narrative — a legitimate Hyper Foundation NFT airdrop marred by a same-day $400K wallet-compromise theft flagged by ZachXBT, amid a cluster of Hyperliquid-ecosystem exploits — is well corroborated by multiple independent sources. However, four of eight timeline entries contain date or figure discrepancies: two ecosystem-context dates (Genesis Event, HyperEVM launch) use inaccurate day-level precision, the HyperVault date is off by two days from independent reporting, the 24-hour trading volume figure appears inflated relative to the majority-reported figure, and the floor-price-settlement entry directly contradicts the date stated in its own cited source.
   anchoranchored

   chain

   ●mainnet-betaslot 443,520,260

   sig

   4Lh9Ez46ifnw…7T2FvKn2copyexplorer ↗

   hash

   Fje9BVMRV2i2…cNq8bQnAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1026 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-26T11:10:10.780Z","decision":"review","investigation_id":"a11c7577-4338-477d-8f85-f61ec2de41f6","new_score":74,"page_slug":"hypurr-nfts","prev_score":74,"reason":"The page's core narrative — a legitimate Hyper Foundation NFT airdrop marred by a same-day $400K wallet-compromise theft flagged by ZachXBT, amid a cluster of Hyperliquid-ecosystem exploits — is well corroborated by multiple independent sources. However, four of eight timeline entries contain date or figure discrepancies: two ecosystem-context dates (Genesis Event, HyperEVM launch) use inaccurate day-level precision, the HyperVault date is off by two days from independent reporting, the 24-hour trading volume figure appears inflated relative to the majority-reported figure, and the floor-price-settlement entry directly contradicts the date stated in its own cited source.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ab614200-5851-4001-93d8-86346e5020adcopy
5. #5review reviseby judgejudge

   2026-08-26 11:10:10Z
   Score: 74 → 66 (-8)
   The page's core narrative is well corroborated: 10 of 16 claims were confirmed outright, and disputed_pct (disputed + unverifiable over total) is 6.25%, which on its own would support approval. The single disputed item, claim_findings[15], is a minor timeline date error where the page says the floor price settled on October 1, 2025 while its own cited article states September 29, 2025 - a self-citation mismatch rather than a disputed core allegation, so it does not carry the weight that would justify denial. However, coverage_gaps[0] flags a high-priority gap: all six narrative sections on the page are empty, leaving only a summary and timeline with no substantive analysis of the wallet-compromise mechanism, the Foundation's response, or collection legitimacy. Per review policy, a high-priority coverage gap pushes a page toward revision even when disputed_pct is low. The review also notes a recurring pattern of imprecise dates and figures across five partially_supported claims (claim_findings[8], [9], [12], [14]) - two fabricated day-level dates, a two-day discrepancy, and an inflated 24-hour volume figure - which, while not counted in disputed_pct, reinforces that the page needs a precision pass alongside expanding its missing sections.
   anchoranchored

   chain

   ●mainnet-betaslot 443,520,262

   sig

   xzLqLQDLszEy…bf1LZAmVcopyexplorer ↗

   hash

   6NB4JmXHWbjQ…ryWJ4hCCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1609 B) ▸

   {"actor":"judge","decided_at":"2026-08-26T11:10:10.780Z","decision":"review_revise","investigation_id":"a11c7577-4338-477d-8f85-f61ec2de41f6","new_score":66,"page_slug":"hypurr-nfts","prev_score":74,"reason":"The page's core narrative is well corroborated: 10 of 16 claims were confirmed outright, and disputed_pct (disputed + unverifiable over total) is 6.25%, which on its own would support approval. The single disputed item, claim_findings[15], is a minor timeline date error where the page says the floor price settled on October 1, 2025 while its own cited article states September 29, 2025 - a self-citation mismatch rather than a disputed core allegation, so it does not carry the weight that would justify denial. However, coverage_gaps[0] flags a high-priority gap: all six narrative sections on the page are empty, leaving only a summary and timeline with no substantive analysis of the wallet-compromise mechanism, the Foundation's response, or collection legitimacy. Per review policy, a high-priority coverage gap pushes a page toward revision even when disputed_pct is low. The review also notes a recurring pattern of imprecise dates and figures across five partially_supported claims (claim_findings[8], [9], [12], [14]) - two fabricated day-level dates, a two-day discrepancy, and an inflated 24-hour volume figure - which, while not counted in disputed_pct, reinforces that the page needs a precision pass alongside expanding its missing sections.","score_delta":-8,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d67943e0-3367-4073-a9e4-f438ac5a2d53copy