Hypervault Finance
Summary
Hypervault Finance was a yield-aggregating DeFi vault protocol built on the HyperEVM layer of the Hyperliquid blockchain that executed a confirmed exit scam on or around September 25–26, 2025, draining approximately $3.6–4.64 million from roughly 1,100 depositors. Operators bridged funds to Ethereum via deBridge, converted assets to ETH, and routed approximately 752 ETH into Tornado Cash to obscure the trail before deleting all web properties, social media accounts, and GitHub repositories. The project had falsely claimed ongoing security audits by Spearbit, Pashov Group, and Code4rena — none of which were conducted — and attracted deposits with promises of 76–95% annualized yields on stablecoins and HYPE liquidity tokens.
Connected Entities
1 entities · 10 linked investigationsTimeline(7 events)
2025-09-04
Community researcher HypingBull publicly warned on X that Hypervault's claimed audits from Spearbit, Pashov, and Code4rena appeared fabricated. Direct contact with Pashov Group returned the response: 'First time I hear the project with this name.' Code4rena's public listing showed no pending Hypervault audit. TVL was approximately $700,000 at time of warning.
X (Twitter) post by HypingBull; corroborated by Rekt News2025-09-14
Hypervault publicly announced that an audit had commenced with Zenith Security, a legitimate audit firm.
Rekt News — Hypervault Rugged2025-09-21
Zenith Security delivered a private draft audit report to the Hypervault team identifying 42 vulnerabilities — 6 high severity and 10 medium severity — with a recommendation for full re-audit after remediation. The report was never publicly disclosed by the project.
Rekt News — Hypervault Rugged; Quadriga Initiative2025-09-24
TVL on Hypervault reached approximately $4.97–6.01 million according to DefiLlama, representing peak depositor exposure ahead of the drain.
Rekt News — Hypervault Rugged; Decrypt2025-09-25
Rug pull executed. All nine Hypervault vaults on HyperEVM were drained by the project operators using privileged contract access. Funds were bridged from Hyperliquid to Ethereum via deBridge.
Rekt News — Hypervault Rugged; Quadriga Initiative2025-09-26
PeckShield publicly flagged 'abnormal withdrawal of ~$3.6M worth of crypto from @hypervaultfi.' Approximately 752 ETH (estimated $3 million) was confirmed deposited into Tornado Cash. Hypervault's website, X account, Discord server, and GitHub repositories were all deleted. The Block, Decrypt, CryptoNews, and other outlets began covering the incident.
PeckShield alert; The Block; Decrypt; CryptoNews2025-09-27
Zenith Security publicly confirmed it would cooperate with investigators and stated it had identified IP-level information about the operators to share with authorities. On-chain analysts BrutalTrade and SpecterAnalyst published wallet address linkages. Alleged prior projects ZinoFinance, Zero-G Finance, and PerfectSwap were identified as linked to the same operator network.
Rekt News — Hypervault Rugged; Quadriga InitiativeDecision Log
- #1publish⛓ pending8/8/2026, 11:10:23 PMhash: k7gDchGBoijSi6BKCh1o6NDUzDf7eMXPZzoHmhHDQ9k
11 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/8/2026, 11:10:15 PM
last updated: 8/9/2026, 2:56:34 AM
avoid.net — verified advice for a post-truth world