HypurrFi Hack

On January 25, 2026, HypurrFi suffered an $84,000 exploit when unaudited helper code designed for streamlining swaps into lending positions was unintentionally included in a release, with the vulnerability isolated to the EulerVaultGateway contract on HyperEVM.

The incident occurred due to an operational error during HypurrFi's recent release process. The team had been internally developing helper code intended to streamline user experience by enabling direct swapping into lending positions through integration with partner protocol Euler Finance, but this code had not yet undergone security audits. During the release deployment, this unaudited helper code was accidentally included in the production environment and made accessible through the user interface.

The vulnerability within the EulerVaultGateway module allowed an exploit that resulted in $84,000 being drained from an affected user. Upon discovering the incident Sunday morning, HypurrFi's team immediately removed the helper code from the UI to prevent further exploitation. The team confirmed the issue was localized specifically to the EulerVaultGateway contract module on HyperEVM and began investigating the full scope of potential exposure.

As a precautionary measure, all users were advised to revoke wallet permissions to the impacted contract address using revoke.cash while the investigation continued.