- A counterfeit Hyperliquid app appeared on Google Play, flagged by ZachXBT.
- Impostor apps mimic branding to steal seed phrases or trick malicious approvals.
- Google Play’s vetting was reportedly bypassed, showing store listings aren’t foolproof.
- Verify via official links, check the developer, and never share your recovery phrase.
A widely followed on-chain investigator, ZachXBT, has raised an alarm about a fake Hyperliquid app on Google Play that was presented as if it were the real trading platform. The listing, which imitated official branding, has renewed concerns about crypto-themed impersonation in mainstream app stores.
The warning describes how these lookalike apps target traders and investors by nudging them to install the software and hand over sensitive information or connect wallets. According to ZachXBT, the fraudulent listings got past Google’s usual defenses, a reminder that official storefronts can still host risky downloads.
How the impersonation works
The counterfeit builds mirror Hyperliquid’s logo, color palette, and interface to build trust and lower skepticism. After installation, they may try to request a 12- or 24-word recovery phrase, prompt deceptive “wallet connect” approvals, or ask for intrusive permissions that have nothing to do with normal app behavior.
As part of the alert, ZachXBT highlighted a blockchain address allegedly tied to theft activity: 0x8c12C21C394D9174c3b1a086A97d2C5523ABb8F5. Individual variants may differ in tactics, but the outcome is similar: siphoning credentials and routing funds to operators.
Researchers note there was no clear indication that Google flagged the listings quickly, suggesting that the store’s automated vetting can be outmaneuvered by re-skinning apps and rotating developer accounts.
Why this keeps happening on official app stores
Attackers routinely upload clones of recognizable crypto brands to harvest keys or trick users into granting token approvals. Security teams, including Cyble’s CRIL unit, have previously documented dozens of malicious Play Store apps piggybacking on names such as Hyperliquid, SushiSwap, and PancakeSwap—demonstrating the scale of the impersonation problem.
Because users equate store placement with legitimacy, a polished listing can look trustworthy at first glance. In reality, store presence is not proof of authenticity; verification should come directly from the project’s official website, documentation, and community channels.
How to stay safe before you download
Before installing anything that claims to work with Hyperliquid, always navigate from the project’s official site and confirm the exact package name, developer identity, and any endorsed distribution links.
- Check the developer name matches what’s listed on the official website; watch for misspellings, punctuation tricks, or brand-new publisher pages.
- Scrutinize download count and reviews; sparse installs, repetitive wording, or generic five-star ratings are common red flags.
- Review permissions and behaviors. No legitimate app will ever ask for your seed phrase, and wallets shouldn’t need SMS, contacts, or overlay permissions.
- Use hardware wallets where possible, sign only what you understand, and revoke dubious allowances via reputable block explorers or wallet dashboards.
If you suspect you installed an impostor, disconnect it immediately, rotate keys, move assets to fresh addresses, and consider filing a report so the listing can be reviewed and removed.
Community alerts and ongoing monitoring
Community watchdogs like ZachXBT provide an early-warning system for fast-moving threats, but collective reporting by users helps surface new impostors before they spread widely.
Stay tuned to Hyperliquid’s official channels for any notice about supported clients or integrations, and treat unfamiliar apps and links with strong skepticism—especially if they pressure you to act quickly or reveal recovery data.
The appearance of a counterfeit Hyperliquid app on Google Play highlights how mainstream platforms can still host convincing impostors; staying safe hinges on verifying sources, guarding recovery phrases, and pausing to validate every permission or approval request before you tap “allow.”
