TLDR
- Hypervault vanishes after $3.6M drained, funneled via Tornado Cash
- $3.6M exit scam? Hypervault disappears, funds laundered through Tornado
- Hypervault rug pull drains $3.6M, exits with Tornado Cash cover-up
- Users lose $3.6M as Hypervault vanishes, funds mixed via Tornado Cash
- Hypervault collapse: $3.6M stolen, social media erased, Tornado used
Hypervault, a decentralized finance platform, has disappeared after approximately $3.6 million in user assets were withdrawn and funneled through Tornado Cash. The assets were initially bridged from Hyperliquid to Ethereum, swapped into Ether, and nearly 752 ETH was deposited into the privacy tool. The platform’s website, X account, and Discord channel are now offline, prompting suspicions of a planned exit scam.
PeckShield, a blockchain security firm, first detected the unauthorized transactions, which involved bridging assets to Ethereum and converting them into ETH. This action was followed by transfers into Tornado Cash, a service often linked to fund obfuscation. The abrupt takedown of Hypervault’s digital presence added urgency to the alarm raised by analysts and users.
The deleted social media accounts include the X handle @hypervaultfi, while the once-active Hypervault documentation is no longer accessible. Community members, including the user “HypingBull,” had warned earlier about inconsistencies in the team’s audit claims. However, despite external red flags, activity continued on the platform until the final hours.
ETH Movement Suggests Pre-Planned Attack
The stolen assets, totaling around $3.6 million, were swiftly moved from the Hyperliquid network to Ethereum using a bridge service. These funds were then converted into ETH and transferred in batches to Tornado Cash, indicating a calculated attempt to obscure origins. PeckShield confirmed that approximately 752 ETH reached the mixer service.
Such behavior aligns with standard patterns in decentralized finance scams, especially rug pulls where project teams disappear after draining funds. Tornado Cash’s anonymity features make tracing fund destinations nearly impossible, fueling the belief that recovery is unlikely. The sequence of events from withdrawal to coin mixing occurred within hours, showing a coordinated effort.
Despite the suspicious movement, Hyperliquid itself remains operational and unaffected by Hypervault’s collapse.The broader ecosystem now faces scrutiny over its project vetting process. Hypervault’s disappearance has already dented confidence in associated platforms using the HyperEVM framework.
Audit Irregularities and TVL Claims Questioned
Hypervault had marketed itself as an “unmanaged” yield optimization platform offering automated strategies and high annual returns. It advertised compounding vaults, keeper-bot harvesting, and modular strategies across lending and liquidity pools. It claimed yields reached as high as 95% for its native token, HYPE, attracting over 1,100 users.
Community members questioned the developers’ audit statements, which named Spearbit, Pashov, and Code4rena as partners. Upon inquiry, Pashov denied any involvement, and Code4rena listed no active audits for Hypervault. These inconsistencies prompted warnings from users who began withdrawing funds ahead of the shutdown.
According to DefiLlama, Hypervault had about $5.9 million in total value locked before the incident. Some now argue that this figure may have been inflated to lure more participants. The abrupt exit and the lack of communication suggest this could be one of the largest rug pulls seen on HyperEVM this year.
