HyperEVM Case Study: 84-Second Window Between Approval Sig and Cross-Chain Exit
On-chain trail shows a HyperSwap LP NFT worth ~$12.3K moved, converted to HYPE and bridged to Ethereum in under 84 seconds.
Chain data on Hyperliquid’s HyperEVM shows a full liquidity-position drain — transfer, liquidation, HYPE conversion and cross-chain bridge to Ethereum — executing inside an 84-second window on June 29 at 20:21:51 UTC. Total value lost: roughly $12,300, tied to a single tokenized LP receipt, HyperSwap V3 LP NFT #178549.
Reconstructing the timeline
The exploit’s root cause predates the on-chain trigger by an unspecified interval: the victim signed a wallet approval after interacting with a spoofed site linked from a fake X account near-identically cloned from the genuine HyperSwapX handle, framed as an airdrop claim. That signature granted a third-party address transfer rights over the victim’s tokenized LP position — no further authorization was needed once it was live.
The attacker executed the pre-authorized pull of NFT #178549 at 20:21:51 UTC, then unwound the underlying liquidity, swapped proceeds into HYPE, and bridged full value to Ethereum — all inside the 84-second window that frames the incident. No additional victim interaction occurred at any stage post-approval.
Destination wallet was already flagged
The receiving address, 0x880C95246D7525b84902E6c040818a7C72d3Aa77, carries a Phish/Hack tag (Fake_Phishing3746335) on HyperEVM’s block explorer — meaning trackers had flagged the address before this transfer landed, consistent with reuse across multiple victims rather than a one-off wallet.
HyperSwap runs as an independently operated DEX deployed on Hyperliquid, with no administrative relationship to the Hyperliquid core team — comparable to any third-party app built on a base-layer chain. As a self-custody venue, it carries no centralized backstop: once a malicious approval is signed, execution is automatable and requires zero further consent from the wallet holder, which is the structural feature this incident’s speed exploits.
Market backdrop at time of the drain
HYPE was trading near $71.44 at the time, up 2.90% on a 24-hour volume of roughly $970.6 million, with funding at -0.0029%, tilted toward shorts. Broader sentiment sat at 24/100 — Extreme Fear territory — while Bitcoin dominance held at 69.3% against a total crypto market cap near $1.84 trillion.
Read more: CertiK: Web3 Losses Hit $1.31B in H1 2026, Up 28% Ex-Bybit
Leave a Reply