Hypervault’s official website is currently inaccessible, and its X account has been deleted, further indicating a potential exit scam.
Hyperdrive, a DeFi yield strategy protocol built on the Hyperliquid ecosystem, has confirmed that two user wallet positions in its Treasury Market got compromised in a digital heist that led to an estimated $700,000 in losses.
In what is being publicized as a precautionary measure, Hyperdrive has taken to X to reveal it has paused all money markets across the platform while it continues its investigations. In the meantime, the team has emphasized that there is no vulnerability in the thBILL asset itself, and the issue does not impact the $HYPED token.
According to posts on X, the exploit is being linked to a flaw in Hyperdrive’s operator permission system. Users had reportedly designated the protocol’s Router as an operator, allowing it broad access to call any whitelisted contract — including the Market contract.
Attackers took advantage of this by invoking the Router to put out arbitrary calls. This gave them access that they used to manipulate and ultimately drain the affected positions.
The incident comes not long after the $3.6 million rug pull by HyperVault, yet another Hyperliquid-based yield protocol, which happened on September 26, 2025.
The irony of the attacks is not lost on crypto natives who are watching keenly and have pointed out how there seems to be an ongoing campaign targeting the Hyperliquid ecosystem.
This year alone, the space has endured a string of security issues, including earlier exploits like the March JELLYJELLY manipulation and the August XPL attack. The attacks have hit community sentiment, somewhat “dampening” Hyperliquid’s hype.
On September 26, blockchain security firm PeckShield flagged unusual outflows of about $3.6 million from the decentralized finance platform Hypervault, being bridged from Hyperliquid to Ethereum.
After bridging, the funds were swapped into ETH, and approximately 752 ETH, worth almost $3 million, was deposited into Tornado Cash, a classic sign of crypto rug pulls.
According to Hypervault’s website and documentation, it is responsible for the promotion of “unmanaged” auto-compounding vaults, keeper-bot harvests, and strategy adapters that route assets to lending, looping, and concentrated liquidity venues on HyperEVM.
It generated revenue by deploying user deposits across external venues via modular strategies.
The project’s X account has now been deleted, and the official website remains inaccessible, raising suspicions of an exit scam.
On X, there is still a lot of confusion and speculation from whales and regular users who are dealing with losses and inquiring about any possibility of recovery.
