HyperSwap phishing scam steals US$12,300 in seconds

• A phishing scam stole about US$12,300 from a HyperSwap liquidity provider after a fraudulent wallet approval.
• The attacker transferred the victim's liquidity position, converted the funds into HYPE and bridged them to Ethereum within two minutes.
• The incident highlights the risks of wallet approval phishing rather than a security failure in the HyperSwap or Hyperliquid protocols.

A liquidity provider on Hyperliquid (CRYPTO:HYPE) lost about US$12,300 after approving a fraudulent wallet transaction that allowed an attacker to seize a tokenised HyperSwap liquidity position within 84 seconds.

The victim reportedly followed a fake airdrop link on X that impersonated HyperSwap's official account and unknowingly authorised a third-party wallet to transfer NFT #178549, which represented the underlying liquidity position.

On-chain records show the attacker transferred the NFT at 20:21:51 UTC on 29 June, withdrew the underlying assets, converted them into HYPE and bridged the funds to Ethereum (CRYPTO:ETH) in less than two minutes, while the receiving wallet had already been flagged for phishing activity.

The incident demonstrates how approval phishing can allow attackers to drain self-custodied assets without requiring additional signatures, and as neither HyperSwap nor Hyperliquid is publicly listed there is no share price available.

HyperSwap is a decentralised exchange built on the Hyperliquid blockchain, while users retain direct control of their assets through self-custodied wallets rather than a centralised platform.

The case illustrates the growing use of approval phishing in crypto, where attackers rely on deceptive wallet permissions instead of exploiting vulnerabilities in blockchain protocols or decentralised applications.

At the time of reporting, Hyperliquid price was $71.09.