Apr 2025 - Hyperliquid Season 2 Final Phase Twitter/X Compromised

UNKNOWN

APRIL 2025

GLOBAL

HYPERLIQUID

DESCRIPTION OF EVENTS

Hyperliquid is a decentralized exchange (DEX) that focuses on perpetual futures trading and aims to offer the speed and efficiency of centralized platforms while maintaining the transparency and security of decentralized systems. Unlike traditional DEXs that rely on automated market makers (AMMs), Hyperliquid utilizes a fully on-chain order book, providing precise price discovery and mitigating some of the manipulation risks seen in off-chain or hybrid models. The exchange is built on its own custom Layer-1 blockchain, which leverages the HyperBFT consensus mechanism—a derivative of HotStuff and LibraBFT—allowing it to process up to 100,000 orders per second with near-instant finality.

One of Hyperliquid’s key appeals is its zero gas fee model, which significantly reduces trading costs. Traders pay minimal maker (0.01%) and taker (0.035%) fees, making it attractive for high-frequency trading strategies. The platform supports leveraged trading of up to 50x on over 130 digital assets, including major cryptocurrencies like Bitcoin, Ethereum, and Solana. Users can choose between isolated and cross-margin modes, offering flexibility in risk management.

Hyperliquid also introduces a Vault system, which allows users to create or join community-driven liquidity pools and earn a portion of the platform’s trading fees. Furthermore, the platform includes features such as copy trading, enabling users to automatically mirror the strategies of top-performing traders, which may appeal to less experienced users looking to benefit from expert strategies. It is also compatible with the Ethereum Virtual Machine (EVM) via its HyperEVM integration, allowing developers to build and deploy smart contracts that interact seamlessly with Ethereum-based assets.

Hyperliquid's Twitter/X account was compromised.

the phishing post was technically convincing because it fit neatly into Hyperliquid’s real operational patterns, making it a reasonable-seeming update that many users could have believed without second-guessing—especially in a time-sensitive, FOMO-driven context like an airdrop claim.

The malicious post on Hyperliquid’s X account mimicked a realistic and well-timed update related to the platform’s Season 2 airdrop and HYPE token distribution. It referenced real components of the Hyperliquid ecosystem—such as the HyperEVM, HYPE allocations, and Season 2 farming deadlines—in language consistent with Hyperliquid’s past communications. The message announced a final phase of Season 2, a deadline to accept terms by May 2 at 11:59 AM UTC, and a claim date of May 3, all of which are plausible details within the airdrop and DeFi incentive context.

Technically, this kind of phishing attack is effective because Hyperliquid is known for operating without KYC and for using on-chain mechanisms for token allocations, vault participation, and rewards—making a web-based “allocation checker” or wallet-signing flow believable. Users familiar with other DeFi projects (like Blur, Friend.tech, or Arbitrum) would reasonably expect to confirm allocations or claim tokens by interacting with a dApp or site.

To craft this attack, the phishers likely did detailed research on Hyperliquid’s previous announcements, protocol mechanics, and community culture. They replicated stylistic cues such as capitalized phrases (“The Final Phase”, “HYPE Allocation Checker”), the project’s cadence around season deadlines, and real DeFi terminology. It suggests they followed community discourse and platform updates closely, possibly even scraping or monitoring Hyperliquid’s Discord and past tweets to time the message convincingly and blend into the natural cycle of platform events.

The exact amount of losses is unknown.

The community reacted swiftly and unanimously to the suspected hack of Hyperliquid’s official X (formerly Twitter) account, warning others not to trust any posts or links. Prominent users and community pages like @CryptoCondom, @Hyperliquid_KR, and many others confirmed the breach, urging followers to avoid interaction and raise awareness by retweeting. Multiple users reported that the linked site showed errors or was flagged as malicious by tools like Coinbase Wallet. While some expressed confusion or frustration, the dominant sentiment was caution, with widespread alerts that the protocol itself remains unaffected and that the issue is isolated to the social media account.

Hyperliquid appears to have recovered there account and ignored the events. There doesn't appear to be any major announcement about the Twitter/X account breach.

It is unclear if any users lost funds in this case.

Hyperliquid appears to have secured their account. It is unclear who is behind the Twitter/X hack and whether there are losses in this case to recover.

Explore This Case Further On Our Wiki

Hyperliquid is a decentralized exchange built on its own high-speed Layer-1 blockchain, offering gasless, on-chain perpetual futures trading with an order book model and support for up to 50x leverage across over 130 assets. In early May, its X (Twitter) account was compromised, and attackers posted a convincing phishing message disguised as a legitimate update about Season 2 HYPE token claims—referencing real ecosystem elements like the HyperEVM and farming deadlines. While the post mimicked official communications, suggesting the attackers had researched the project, most users appear to have been aware that the posts were not legitimate. While the platform itself remained secure and the community responded quickly with warnings, Hyperliquid made no major public statement acknowledging the breach, and it remains unclear whether any users lost funds or who was behind the attack.

QUADRIGA INITIATIVE

CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM

A COMMUNITY-BASED, NOT-FOR-PROFIT

UNKNOWN

APRIL 2025

GLOBAL

HYPERLIQUID

DESCRIPTION OF EVENTS

More case studies

QuantMaster Employee Blames
Smart Contract Drain On AI

Tron DAO Fake Token Twitter/X
Account Compromised

UNKNOWN

APRIL 2025

GLOBAL

HYPERLIQUID

DESCRIPTION OF EVENTS

More case studies

QuantMaster Employee BlamesSmart Contract Drain On AI

Tron DAO Fake Token Twitter/XAccount Compromised

QuantMaster Employee Blames
Smart Contract Drain On AI

Tron DAO Fake Token Twitter/X
Account Compromised