Hyperliquid Season 2 Final Phase Twitter/X Compromised

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Hyperliquid Logo/Homepage

Hyperliquid is a decentralized exchange built on its own high-speed Layer-1 blockchain, offering gasless, on-chain perpetual futures trading with an order book model and support for up to 50x leverage across over 130 assets. In early May, its X (Twitter) account was compromised, and attackers posted a convincing phishing message disguised as a legitimate update about Season 2 HYPE token claims—referencing real ecosystem elements like the HyperEVM and farming deadlines. While the post mimicked official communications, suggesting the attackers had researched the project, most users appear to have been aware that the posts were not legitimate. While the platform itself remained secure and the community responded quickly with warnings, Hyperliquid made no major public statement acknowledging the breach, and it remains unclear whether any users lost funds or who was behind the attack.

About Hyperliquid

Hyperliquid is a decentralized exchange (DEX) that focuses on perpetual futures trading and aims to offer the speed and efficiency of centralized platforms while maintaining the transparency and security of decentralized systems. Unlike traditional DEXs that rely on automated market makers (AMMs), Hyperliquid utilizes a fully on-chain order book, providing precise price discovery and mitigating some of the manipulation risks seen in off-chain or hybrid models. The exchange is built on its own custom Layer-1 blockchain, which leverages the HyperBFT consensus mechanism—a derivative of HotStuff and LibraBFT—allowing it to process up to 100,000 orders per second with near-instant finality.

One of Hyperliquid’s key appeals is its zero gas fee model, which significantly reduces trading costs. Traders pay minimal maker (0.01%) and taker (0.035%) fees, making it attractive for high-frequency trading strategies. The platform supports leveraged trading of up to 50x on over 130 digital assets, including major cryptocurrencies like Bitcoin, Ethereum, and Solana. Users can choose between isolated and cross-margin modes, offering flexibility in risk management.

Hyperliquid also introduces a Vault system, which allows users to create or join community-driven liquidity pools and earn a portion of the platform’s trading fees. Furthermore, the platform includes features such as copy trading, enabling users to automatically mirror the strategies of top-performing traders, which may appeal to less experienced users looking to benefit from expert strategies. It is also compatible with the Ethereum Virtual Machine (EVM) via its HyperEVM integration, allowing developers to build and deploy smart contracts that interact seamlessly with Ethereum-based assets.

About Season 2 Allocations

According to Hyperliquid's, Twitter/X:

"The Final Phase of Season 2 has arrived.

After Months of Breaking new Milestones with The HyperEVM, The Season 2 Farming Deadline has commenced.

With S2 Claims Set to go Live on Saturday May 3rd, The HYPE Allocation Checker is now open."

"Users have Until May 2nd at (11:59 AM UTC) to Agree to the Season 2 Terms & Conditions and Confirm their HYPE Allocations.

Check Your Allocation:"

The Reality

Hyperliquid's Twitter/X account was compromised.

What Happened

Hyperliquid announced that the final phase of Season 2 had begun on Twitter/X, with users required to confirm their HYPE allocations and agree to terms by May 2 (11:59 AM UTC), ahead of claims going live on May 3.

Key Event Timeline - Hyperliquid Season 2 Final Phase Twitter/X Compromised

Date	Event	Description
April 30th, 2025 6:36:00 PM MDT	First Reply To Posted Tweet	The first response to the official tweet says "What??????" from Munchkie.hl. Based on other analysis, this is the best estimate of the time of posting.
April 30th, 2025 6:39:00 PM MDT	Tweet Screenshots Captured	Twitter user Rarma shares screenshots of the tweet and warns that the account seems to be hacked.
April 30th, 2025 6:46:00 PM MDT	PANewsLab Article Posted	PANews reports that Hyperliquid's Twitter/X account is suspected to have been "stolen" on May 1st.
April 30th, 2025 6:46:00 PM MDT	Coinbase Wallet Warning Page	A screenshot shows that Coinbase Wallet indicates a dangerous site on hyperliquidx.foundation.
April 30th, 2025 6:49:00 PM MDT	Website Appears Offline Now	The malicious website appears to return a 404 error when visited by users at this point in time. The error shows "404 - Nothing matches the given URI".

Technical Details

the phishing post was technically convincing because it fit neatly into Hyperliquid’s real operational patterns, making it a reasonable-seeming update that many users could have believed without second-guessing—especially in a time-sensitive, FOMO-driven context like an airdrop claim.

The malicious post on Hyperliquid’s X account mimicked a realistic and well-timed update related to the platform’s Season 2 airdrop and HYPE token distribution. It referenced real components of the Hyperliquid ecosystem—such as the HyperEVM, HYPE allocations, and Season 2 farming deadlines—in language consistent with Hyperliquid’s past communications. The message announced a final phase of Season 2, a deadline to accept terms by May 2 at 11:59 AM UTC, and a claim date of May 3, all of which are plausible details within the airdrop and DeFi incentive context.

Technically, this kind of phishing attack is effective because Hyperliquid is known for operating without KYC and for using on-chain mechanisms for token allocations, vault participation, and rewards—making a web-based “allocation checker” or wallet-signing flow believable. Users familiar with other DeFi projects (like Blur, Friend.tech, or Arbitrum) would reasonably expect to confirm allocations or claim tokens by interacting with a dApp or site.

To craft this attack, the phishers likely did detailed research on Hyperliquid’s previous announcements, protocol mechanics, and community culture. They replicated stylistic cues such as capitalized phrases (“The Final Phase”, “HYPE Allocation Checker”), the project’s cadence around season deadlines, and real DeFi terminology. It suggests they followed community discourse and platform updates closely, possibly even scraping or monitoring Hyperliquid’s Discord and past tweets to time the message convincingly and blend into the natural cycle of platform events.

Total Amount Lost

The exact amount of losses is unknown.

The total amount lost is unknown.

Immediate Reactions

The community reacted swiftly and unanimously to the suspected hack of Hyperliquid’s official X (formerly Twitter) account, warning others not to trust any posts or links. Prominent users and community pages like @CryptoCondom, @Hyperliquid_KR, and many others confirmed the breach, urging followers to avoid interaction and raise awareness by retweeting. Multiple users reported that the linked site showed errors or was flagged as malicious by tools like Coinbase Wallet. While some expressed confusion or frustration, the dominant sentiment was caution, with widespread alerts that the protocol itself remains unaffected and that the issue is isolated to the social media account.

Ultimate Outcome

Hyperliquid appears to have recovered there account and ignored the events. There doesn't appear to be any major announcement about the Twitter/X account breach.

Total Amount Recovered

It is unclear if any users lost funds in this case.

There do not appear to have been any funds recovered in this case.

Ongoing Developments

Hyperliquid appears to have secured their account. It is unclear who is behind the Twitter/X hack and whether there are losses in this case to recover.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.