HypurrFi Domain Hijack (April 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·31oSqg…KZMkSummary
On April 3, 2026, the frontend domain hypurr.fi of HypurrFi — a DeFi lending protocol on Hyperliquid EVM — was hijacked via a social engineering attack targeting the domain registrar Openprovider. No user funds were confirmed drained and the protocol's smart contracts remained intact throughout; the team migrated frontend operations to hypurrfi.com and subsequently recovered control of the original domain. The incident is part of a documented six-week cluster of DeFi registrar-level frontend attacks in March–April 2026 targeting Neutrl, HypurrFi, and CoW Swap.
Connected Entities
6 entities · 60 linked investigations- Euler Finance→mentioned with→Ethereum(80%)
- Hyperliquid→mentioned with→Ethereum(70%)
- HypurrFi Domain Hijack (April 2026)→mentioned with→CoW Swap (CoW Protocol)(80%)
- HypurrFi Domain Hijack (April 2026)→mentioned with→Euler Finance(80%)
- HypurrFi Domain Hijack (April 2026)→mentioned with→Neutrl(80%)
- HypurrFi Domain Hijack (April 2026)→mentioned with→Ethereum(70%)
- HypurrFi Domain Hijack (April 2026)→mentioned with→Hyperliquid(80%)
- CoW Swap (CoW Protocol)→mentioned with→Ethereum(65%)
Timeline(10 events)
March 2025
HypurrFi launches on Hyperliquid EVM mainnet, reaching initial supply caps of approximately $4.42 million within one hour.
Impossible Finance Blog19 March 2026
Neutrl DeFi protocol experiences a suspected DNS frontend hijack; team pauses smart contracts and initiates investigation with security firm 0xGroomLake. First incident in the documented six-week DeFi registrar attack cluster.
Crypto Times3 April 2026
HypurrFi detects unauthorized DNS changes to hypurr.fi attributed to social engineering at registrar Openprovider. Founder androolloyd posts urgent warning on X. Team migrates frontend to hypurrfi.com.
The Block, Crypto Times4 April 2026
HypurrFi team confirms recovery of hypurr.fi domain control via registrar; DNS propagation expected to take up to 24 hours. No user funds confirmed drained. Incident widely covered in crypto press.
NullTX, DarkWebInformer (X)14 April 2026
CoW Swap's cow.fi domain is hijacked via social engineering against registrar Gandi SAS (allegedly involving falsified identity documents submitted to Traficom, Finland's .fi TLD registry). Phishing frontend drains approximately $1.2 million in user assets over 4.5 hours. Third major incident in the DeFi registrar attack cluster.
CoinDesk, BingX Flash News15 April 2026
Web3SecNews publishes field report characterizing the Neutrl, HypurrFi, CoW Swap, and Steakhouse/cow.fi incidents as a coordinated campaign with common social engineering methodology at the registrar level.
Web3SecNews (Substack)12 May 2026
CoW DAO passes CIP-86 to begin compensation for victims of the April 14 cow.fi hijack, with claims deadline of May 14.
Crypto Times15 May 2026
HypurrFi announces planned wind-down of operations. Euler Finance assumes maintenance of Mewler contract stack on HyperEVM. Team states the decision is 'strategic instead of reactive' and explicitly not related to the April domain compromise.
Crypto TimesDecision Log
- slot 445504881 · hash 6VEFW9FAJLrAdmkiM7FzUSkTz8eGZsGJztxeB5vtdMs8
- slot 424382937 · hash PCGjDcaZ9WuzaPpPCJ8FQzB3hV1z1TQNbPYdcVgQuxF
- slot 424382935 · hash AfJpWtTp9nbrBZdZQEvuX9VvoP9iBK5jqsN8McQpxeP7
- slot 423881782 · hash yKJGzxKsDWxCKEcPLrZe9EHtHQuNG32jiggA4SvDPip
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 17 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/2/2026, 8:26:10 PM
last updated: 6/2/2026, 8:26:10 PM
4 viewsavoid.net — verified advice for a post-truth world