thehyperliquidbridge[.]com

thehyperliquidbridge.com was registered on May 13, 2025, and is actively impersonating HyperLiquid, a leading decentralized exchange, to deceive users into connecting wallets or transacting on malicious contracts. The domain leverages a legitimate SSL certificate issued by Let’s Encrypt, which increases credibility and lowers user suspicion. Technical indicators reveal the domain resolves to IP 216.230.86.1 and is hosted through NAMECHEAP INC, a common registrar used by threat actors for quick domain churn. VirusTotal currently shows zero detections out of 95 engines, indicating this is a newly deployed threat with no signature coverage as of discovery. The domain’s age and lack of detection suggest it may be a zero-day campaign targeting Hyperliquid users, likely aiming to siphon funds via fake swap interfaces or wallet drainers. Given the zero detection rate and fresh registration, the threat is classified as evolving and under active investigation. Users who visited thehyperliquidbridge.com should immediately revoke any connected wallet permissions via wallet settings or a reputable block explorer, clear browser cache and cookies, and avoid interacting with any linked contracts or forms. Enable transaction simulation where available and monitor wallet activity closely. Report the domain to Hyperliquid’s official support if any unauthorized transactions occur. Do not reuse passwords or wallet seeds on unknown sites.