← HypurrFi Domain Hijack (April 2026)reviewed 2026-09-06 · 35 claims checked
Fact-check findings
What an automated fact-checker found when it re-read HypurrFi Domain Hijack (April 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
5 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in section: Incident Overview
“HypurrFi founder androolloyd posted an urgent warning on X stating 'DO NOT USE the Hypurr.fi domain; it is compromised.'”
reviewerHypurrFi founder androolloyd posted on X: 'DO NOT USE the Hypurr.fi domain; it is compromised.'The substance (a warning to avoid the domain) is accurate, but the text inside quotation marks does not match the original tweet or any secondary source's transcription of it.Proposed correction (not yet applied)HypurrFi founder androolloyd posted an urgent warning on X stating 'Do NOT USE THE HYPURR .FI domain it is compromised.' - #5[disputed][awaiting moderator]in section: Incident Overview
“At the time of the incident the protocol had approximately $30 million in TVL per reporting by Live Bitcoin News citing DefiLlama data, though DefiLlama's own tracker recorded a combined TVL reaching substantially higher figures at peak (approximately $180 million as of later in 2026, per DefiLlama).”
reviewerAt the time of the incident, HypurrFi had approximately $30 million in TVL per Live Bitcoin News citing DefiLlama data.The $30M figure at the time of the incident is confirmed. The parenthetical about a higher, later-2026 TVL peak is factually backwards: DefiLlama's actual data shows the ~$180-216M range was reached in mid-to-late 2025, before the hijack, after which TVL fell continuously through 2026 (consistent with the later wind-down), not risen.Proposed correction (not yet applied)At the time of the incident the protocol had approximately $30 million in TVL per reporting by Live Bitcoin News citing DefiLlama data; DefiLlama's own historical tracker shows the protocol's combined TVL had already peaked at roughly $216 million in July 2025, well before the incident, and had been declining steadily through 2026. - #21[disputed][awaiting moderator]in section: Protocol Background and Team
“It launched on mainnet in early 2025, reportedly reaching initial supply caps of $4.42 million within one hour.”
reviewerHypurrFi launched on mainnet in early 2025, reportedly reaching initial supply caps of $4.42 million within one hour.The $4.42 million/one-hour statistic is well documented but for HyperLend, a distinct, competing HyperEVM lending protocol, not for HypurrFi. This appears to be a source conflation; the cited Impossible Finance blog post does not contain this figure.Proposed correction (not yet applied)It launched on mainnet in early 2025. - #26[disputed][awaiting moderator]in the timeline
“HypurrFi launches on Hyperliquid EVM mainnet, reaching initial supply caps of approximately $4.42 million within one hour.”
reviewerHypurrFi launches on Hyperliquid EVM mainnet, reaching initial supply caps of approximately $4.42 million within one hour.Same underlying source conflation as the identical claim in sections[5].content — the $4.42M/one-hour figure belongs to HyperLend, not HypurrFi, and the cited Impossible Finance blog post does not support it.Proposed correction (not yet applied)HypurrFi launches on Hyperliquid EVM mainnet. - #31[disputed][awaiting moderator]in the timeline
“Web3SecNews publishes field report characterizing the Neutrl, HypurrFi, CoW Swap, and Steakhouse/cow.fi incidents as a coordinated campaign with common social engineering methodology at the registrar level.”
reviewerWeb3SecNews publishes a field report on April 15, 2026 characterizing the Neutrl, HypurrFi, CoW Swap, and Steakhouse/cow.fi incidents as a coordinated campaign.Steakhouse Financial and CoW Swap (cow.fi) are two separate protocols with separate hijacks against separate registrars; the timeline entry's 'Steakhouse/cow.fi' formatting incorrectly implies they are linked or the same, when the cited report lists them as four independent incidents.Proposed correction (not yet applied)Web3SecNews publishes field report characterizing the Neutrl, HypurrFi, CoW Swap, and Steakhouse incidents as a coordinated campaign with common social engineering methodology at the registrar level.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #20[unverifiable][awaiting moderator]in section: Protocol Background and Team
“HypurrFi was a bootstrapped (non-VC-funded) DeFi lending and borrowing protocol native to Hyperliquid's EVM layer (HyperEVM).”
reviewerHypurrFi was a bootstrapped (non-VC-funded) DeFi lending and borrowing protocol.No cited or independently found source directly states HypurrFi was VC-free/bootstrapped; general commentary about the broader Hyperliquid ecosystem's self-funded ethos is not a substitute for a direct confirmation specific to HypurrFi.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #7[partially supported][awaiting moderator]in section: Attack Vector and Technical Analysis
“The team's official statement read: 'The hypurr.fi domain was compromised this afternoon in what we believe to be a social engineering attack on the registrar. Based on our understanding and investigation, the HypurrFi protocol and team infrastructure has NOT been compromised.'”
reviewerThe team's official statement: 'The hypurr.fi domain was compromised this afternoon in what we believe to be a social engineering attack on the registrar... has NOT been compromised.'The substance of the statement is corroborated by multiple outlets, but I could not verify this exact wording against a primary source (e.g., the original team X post or Discord announcement), so it is presented with unverified verbatim precision. - #17[partially supported][awaiting moderator]in section: Six-Week DeFi Frontend Attack Cluster (March–April 2026)
“The .fi TLD's centralized registration infrastructure appears to have been a particular point of weakness across multiple incidents.”
reviewerThe .fi TLD's centralized registration infrastructure appears to have been a particular point of weakness across multiple incidents.Two of the four named incidents (cow.fi, hypurr.fi) are .fi domains, but eth.limo (a .limo domain via EasyDNS) and Steakhouse's incident (registrar OVHcloud, per independent reporting) are not .fi-specific, so the claim somewhat overstates how central the .fi TLD specifically was versus registrar-level social engineering generally across TLDs. - #22[partially supported][awaiting moderator]in section: Protocol Background and Team
“The team was led by androolloyd (Andrew Lloyd), identified in multiple sources as co-founder and CEO; Andy served as Head of Growth.”
reviewerThe team was led by androolloyd (Andrew Lloyd), identified in multiple sources as co-founder and CEO; Andy served as Head of Growth.Role split (androolloyd as co-founder/CEO, Andy as Head of Growth) is corroborated, but the specific real-name mapping to 'Andrew Lloyd' is not consistently corroborated — at least one source pairs the same handles with different surnames, which the page's own hedge ('inferable... but full biographical background was not publicly documented') already partly acknowledges.citedx.com/androolloyd
confirmed
26 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On April 3, 2026, the frontend domain hypurr.fi of HypurrFi — a DeFi lending protocol on Hyperliquid EVM — was hijacked via a social engineering attack targeting the domain registrar Openprovider. No user funds were confirmed drained and the protocol's smart contracts remained intact throughout; the team migrated frontend operations to hypurrfi.com and subsequently recovered control of the original domain.”
reviewerOn April 3, 2026, hypurr.fi was hijacked via a social engineering attack on registrar Openprovider; no funds confirmed drained; team migrated to hypurrfi.com and later recovered the domain.Core narrative is well corroborated across multiple independent outlets and is consistent with the registrar's own product blog naming Openprovider in connection with the incident. - #2[confirmed][no action needed]in section: Incident Overview
“On April 3, 2026, HypurrFi detected unauthorized DNS changes to its primary domain hypurr.fi. The team attributed the compromise to a social engineering attack targeting the domain registrar, identified in subsequent reporting as Openprovider.”
reviewerHypurrFi detected unauthorized DNS changes on April 3, 2026 attributed to social engineering at registrar Openprovider.Date and registrar attribution are corroborated by The Block and consistent secondary coverage. - #4[confirmed][no action needed]in section: Incident Overview
“HypurrFi is a non-custodial DeFi lending and borrowing protocol operating on Hyperliquid's EVM layer (HyperEVM), launched on mainnet in early 2025.”
reviewerHypurrFi is a non-custodial DeFi lending and borrowing protocol on HyperEVM, launched on mainnet in early 2025.Directionally accurate; DefiLlama API TVL history begins Feb 24, 2025, consistent with 'early 2025'. - #6[confirmed][no action needed]in section: Attack Vector and Technical Analysis
“The compromise was achieved at the registrar layer rather than through any vulnerability in HypurrFi's smart contracts or internal systems. An attacker gained unauthorized control of domain DNS records at Openprovider — the registrar holding the hypurr.fi domain — through social engineering”
reviewerThe compromise was at the registrar layer, not a smart-contract vulnerability; an attacker used social engineering to gain DNS control at Openprovider.Consistent with widespread reporting; registrar-layer, not contract-layer, compromise is the well-established framing of this incident. - #8[confirmed][no action needed]in section: Attack Vector and Technical Analysis
“No drainer contract or phishing site served to users was publicly confirmed during this incident, in contrast to the contemporaneous CoW Swap hijack where losses of approximately $1.2 million were confirmed.”
reviewerThe compromised domain was flagged and blocked across several major crypto wallets during the transition; no drainer/phishing site was publicly confirmed for HypurrFi, in contrast to CoW Swap's confirmed ~$1.2M loss.Consistent with reporting on both incidents; no source found confirming any drained funds for HypurrFi specifically. - #9[confirmed][no action needed]in section: Attack Vector and Technical Analysis
“DNS propagation delays meant that even after domain control was restored by the team, the domain may have temporarily resolved to attacker-controlled infrastructure for some users for up to 24 hours.”
reviewerDNS propagation delays meant the domain could resolve to attacker infrastructure for up to 24 hours even after recovery.Matches the cited social-media source's characterization of the propagation delay. - #10[confirmed][no action needed]in section: Impact Assessment and Fault Attribution
“The fault lies with registrar-level authentication practices that allowed a social engineering attacker to gain DNS control.”
reviewerHypurrFi is properly characterized as the victim; fault lies with registrar-level authentication practices, not HypurrFi's protocol code.This is an editorial/interpretive framing rather than a discrete factual claim, but it is consistent with how all consulted sources describe the incident's root cause. - #11[confirmed][no action needed]in section: Impact Assessment and Fault Attribution
“This contrasts with the CoW Swap frontend hijack on April 14, 2026, where attackers served a phishing interface that drained approximately $1.2 million in user assets.”
reviewerThis contrasts with the CoW Swap frontend hijack on April 14, 2026, where attackers drained approximately $1.2 million in user assets.Independently corroborated by multiple outlets covering CoW Swap's post-mortem. - #12[confirmed][no action needed]in section: Impact Assessment and Fault Attribution
“The DarkWebInformer account on X confirmed the team was able to regain control of the affected domain via the registrar, with DNS propagation expected to take up to 24 hours.”
reviewerThe DarkWebInformer account on X confirmed the team regained control of the domain via the registrar, with DNS propagation expected to take up to 24 hours.Matches the cited source closely. - #13[confirmed][no action needed]in section: Six-Week DeFi Frontend Attack Cluster (March–April 2026)
“Neutrl, a DeFi protocol, experienced a suspected DNS frontend hijack on March 19, 2026, leading the team to pause smart contracts as a precaution; the team worked with security firm 0xGroomLake to investigate and advised users to revoke all Permit2 approvals.”
reviewerNeutrl experienced a suspected DNS frontend hijack on March 19, 2026, paused smart contracts, worked with 0xGroomLake, and advised revoking Permit2 approvals.Fully corroborated by the cited source. - #14[confirmed][no action needed]in section: Six-Week DeFi Frontend Attack Cluster (March–April 2026)
“CoW Swap, a major Ethereum DEX aggregator, had its cow.fi domain hijacked on April 14, 2026, via social engineering against registrar Gandi SAS — attackers allegedly submitted falsified identification documents to Finland's Traficom (.fi TLD registry); this attack resulted in confirmed user losses of approximately $1.2 million drained over a 4.5-hour window.”
reviewerCoW Swap's cow.fi domain was hijacked on April 14, 2026 via social engineering against registrar Gandi SAS, involving falsified ID documents submitted to Traficom, draining ~$1.2 million over a 4.5-hour window.Registrar (Gandi SAS), registry (Traficom), loss figure (~$1.2M), and 4.5-hour window are all independently corroborated. - #15[confirmed][no action needed]in section: Six-Week DeFi Frontend Attack Cluster (March–April 2026)
“Additionally, eth.limo suffered a social engineering DNS hijack via registrar EasyDNS in the same period.”
reviewereth.limo suffered a social engineering DNS hijack via registrar EasyDNS in the same period.Date (April 17-18, 2026) fits within the claimed six-week cluster window. - #16[confirmed][no action needed]in section: Six-Week DeFi Frontend Attack Cluster (March–April 2026)
“Security researchers writing for Web3SecNews characterized the pattern as an organized campaign with a common methodology: social engineering at registrars to obtain domain control, executed in under 30 minutes from request to compromise, with fresh TLS certificate issuance as a detectable signal.”
reviewerWeb3SecNews characterized the pattern as an organized campaign, with social engineering at registrars executed in under 30 minutes, and fresh TLS certificate issuance as a detectable signal.Closely matches the cited source's own framing and specific technical details. - #18[confirmed][no action needed]in section: Protocol Wind-Down (May 2026)
“On May 15, 2026, HypurrFi announced a planned wind-down of its operations, unrelated to the April domain hijack. The team described the decision as 'strategic instead of reactive,' framing it as a deliberate transition after having played a role in bootstrapping lending on HyperEVM since the protocol's 2025 launch. Euler Finance assumed maintenance and operation of the Euler contract stack (known as Mewler) on Hyperliquid EVM, while Clearstar Labs continued managing Prime, Yield, and Earn vaults.”
reviewerOn May 15, 2026, HypurrFi announced a planned wind-down of operations, unrelated to the April domain hijack; Euler Finance assumed Mewler maintenance; Clearstar Labs continued managing Prime, Yield, and Earn vaults.Fully corroborated across two independent outlets. - #19[confirmed][no action needed]in section: Protocol Wind-Down (May 2026)
“Support access for users was available through May 28, 2026, with legacy markets set to close by July 15, 2026.”
reviewerSupport access for users was available through May 28, 2026, with legacy markets set to close by July 15, 2026.Matches independently fetched wind-down coverage. - #23[confirmed][no action needed]in section: Protocol Background and Team
“HypurrFi maintained a partnership with Euler Finance to deploy the Euler contract stack (Mewler) on HyperEVM.”
reviewerHypurrFi maintained a partnership with Euler Finance to deploy the Euler contract stack (Mewler) on HyperEVM.Consistent with wind-down reporting describing a 'clean handoff' of an existing Euler-based stack. - #24[confirmed][no action needed]in section: Protocol Background and Team
“Note: HypurrFi (the lending protocol) is distinct from the hypurr-nfts NFT collection, which also operates in the Hyperliquid ecosystem.”
reviewerHypurrFi (the lending protocol) is distinct from the hypurr-nfts NFT collection, which also operates in the Hyperliquid ecosystem.The disambiguation note is accurate and useful; the NFT collection and lending protocol are confirmed as separate projects. - #25[confirmed][no action needed]in section: User Safety and Recommended Actions
“The team confirmed that official social media channels (X, Telegram, Discord) remained under team control and that communications through those channels could be trusted.”
reviewerDuring the incident window, users were advised to avoid hypurr.fi, use hypurrfi.com/app.hypurrfi.com, and revoke suspicious token approvals via tools like revoke.cash; official social channels remained under team control.Widely corroborated framing; standard and consistent with how similar incidents (Neutrl) were also handled. - #27[confirmed][no action needed]in the timeline
“Neutrl DeFi protocol experiences a suspected DNS frontend hijack; team pauses smart contracts and initiates investigation with security firm 0xGroomLake. First incident in the documented six-week DeFi registrar attack cluster.”
reviewerNeutrl DeFi protocol experiences a suspected DNS frontend hijack on March 19, 2026; pauses smart contracts; investigates with 0xGroomLake. First incident in the six-week cluster.Matches cited source. Note: an independently discovered Steakhouse Financial domain hijack (registrar OVHcloud) reportedly occurred around March 30, 2026 — between this entry and the HypurrFi entry — and is not represented as its own timeline entry (see coverage_gaps). - #28[confirmed][no action needed]in the timeline
“HypurrFi detects unauthorized DNS changes to hypurr.fi attributed to social engineering at registrar Openprovider. Founder androolloyd posts urgent warning on X. Team migrates frontend to hypurrfi.com.”
reviewerHypurrFi detects unauthorized DNS changes on April 3, 2026, attributed to social engineering at Openprovider; founder posts warning; team migrates to hypurrfi.com.Corroborated; consistent with sections[0] finding above. - #29[confirmed][no action needed]in the timeline
“HypurrFi team confirms recovery of hypurr.fi domain control via registrar; DNS propagation expected to take up to 24 hours. No user funds confirmed drained. Incident widely covered in crypto press.”
reviewerHypurrFi team confirms recovery of domain control on April 4, 2026; DNS propagation up to 24 hours; no funds confirmed drained.NullTX itself returned a 403 on direct fetch (likely bot protection, not necessarily link rot) but the same facts are corroborated by the DarkWebInformer post and other secondary coverage found via search. - #30[confirmed][no action needed]in the timeline
“CoW Swap's cow.fi domain is hijacked via social engineering against registrar Gandi SAS (allegedly involving falsified identity documents submitted to Traficom, Finland's .fi TLD registry). Phishing frontend drains approximately $1.2 million in user assets over 4.5 hours. Third major incident in the DeFi registrar attack cluster.”
reviewerCoW Swap's cow.fi is hijacked April 14, 2026 via Gandi SAS/Traficom social engineering; ~$1.2M drained over 4.5 hours; third major incident in the cluster.Fully corroborated. - #32[confirmed][no action needed]in the timeline
“CoW DAO passes CIP-86 to begin compensation for victims of the April 14 cow.fi hijack, with claims deadline of May 14.”
reviewerCoW DAO passes CIP-86 on May 12, 2026 to begin compensation for cow.fi hijack victims, with a claims deadline of May 14.Precisely matches the cited source. - #33[confirmed][no action needed]in the timeline
“HypurrFi announces planned wind-down of operations. Euler Finance assumes maintenance of Mewler contract stack on HyperEVM. Team states the decision is 'strategic instead of reactive' and explicitly not related to the April domain compromise.”
reviewerHypurrFi announces planned wind-down on May 15, 2026; Euler Finance assumes Mewler maintenance; decision described as 'strategic instead of reactive' and not related to the April domain compromise.Corroborated, though note the announcement date (May 15 per the page) versus the cited article's publish date (May 16) is a one-day gap consistent with next-day news coverage of a same-day/prior-day announcement — not flagged as an error. - #34[confirmed][no action needed]in the timeline
“HypurrFi Discord support access ends May 28, 2026 per wind-down timeline.”
reviewerHypurrFi Discord support access ends May 28, 2026 per wind-down timeline.Consistent with the wind-down announcement's stated schedule. - #35[confirmed][no action needed]in the timeline
“Scheduled closure of HypurrFi legacy markets per wind-down plan.”
reviewerScheduled closure of HypurrFi legacy markets on July 15, 2026 per wind-down plan.Matches independently fetched source verbatim in substance.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.