Blockchain security firm PeckShield flagged a suspicious series of withdrawals from Hypervault Finance, a yield-farming protocol built on the Hyperliquid ecosystem, in which roughly $3.6 million in user deposits were drained and moved through privacy infrastructure. On‑chain data shows the funds were bridged from Hyperliquid/HyperEVM to Ethereum, swapped into ETH, and about 752 ETH was then deposited into the mixer Tornado Cash, a pattern commonly associated with DeFi exit scams and laundering of stolen funds. Following the withdrawals, Hypervault’s website and social media accounts (including X/@hypervaultfi and Discord) were taken offline with no public explanation from the team, intensifying allegations that this was a deliberate rug pull rather than an external exploit. Before the incident, Hypervault had attracted users with high advertised yields and claimed (falsely, according to the firms) that audits were pending from Spearbit, Pashov, and Code4rena, which those auditors later denied, highlighting weak due diligence and transparency around the project. The episode has raised broader concerns for the Hyperliquid ecosystem—where Hypervault operated as a high‑yield vault product—as well as renewed discussion in DeFi about the risks of unaudited, high‑APY protocols and the continued use of Tornado Cash as an obfuscation tool in suspected exit scams.

AI-generated background, compiled from web sources — not editorial content.

More coverage

Explore the topic

More on PeckShieldAlert

#PeckShieldAlert Matcha Meta has reported a security breach involving SwapNet. Users who opted out of "One-Time Approvals" are at risk. So far, ~$16.8M worth of crypto has been drained. Users are urged to revoke all approvals to individual aggregators outside of 0x's One-Time Approval contracts immediately.

#PeckShieldAlert Matcha Meta has reported a security breach involving SwapNet. Users who opted out of "One-Time Approvals" are at risk. So far, ~$16.8M worth of crypto has been drained. Users are urged to revoke all approvals to individual aggregators outside of 0x's One-Time Approval contracts immediately.

𝕏/@PeckShieldAlert ·

Makina got the PeckShieldAlert post no protocol wants to get, exploited for about 1,299 ETH, valued at around $4.13M

Makina got the PeckShieldAlert post no protocol wants to get, exploited for about 1,299 ETH, valued at around $4.13M

𝕏 ·

Yield has suffered a major financial hit totaling $3.73 million. The loss occurred during a Vault operation which involves a token swap from stkGHO to USDC. Due to extreme slippage, 3.84M GHO was exchanged for a mere 112K USDC.

Yield has suffered a major financial hit totaling $3.73 million. The loss occurred during a Vault operation which involves a token swap from stkGHO to USDC. Due to extreme slippage, 3.84M GHO was exchanged for a mere 112K USDC.

𝕏/@PeckShieldAlert ·

A user of VenusProtocol has been drained ~$27M in crypto after falling for a phishing scam. The victim approved a malicious transaction, granting token approval to the attacker's address (0x7fd8...202a) for asset transfer.

A user of VenusProtocol has been drained ~$27M in crypto after falling for a phishing scam. The victim approved a malicious transaction, granting token approval to the attacker's address (0x7fd8...202a) for asset transfer.

𝕏/@PeckShieldAlert ·

PeckShield says August saw 16 major crypto exploits totaling $163M, a 15% jump from July. BTCturk suffered another $50M breach, adding to a $54M hack in 2024 and pushing cumulative losses beyond $100M.

PeckShield says August saw 16 major crypto exploits totaling $163M, a 15% jump from July. BTCturk suffered another $50M breach, adding to a $54M hack in 2024 and pushing cumulative losses beyond $100M.

𝕏/@PeckShieldAlert ·

ArcadiaFi has been hacked , resulting loss of $2.5m

ArcadiaFi has been hacked , resulting loss of $2.5m

𝕏/@PeckShieldAlert ·

Explore the full feed

Comments

Up nextTriple-a hot wallet losses reach $11.8 million as fresh deposits continue to be drained