How to Recognize and Avoid Fake Hyperliquid Referral Sites

Multiple, independently documented fake Hyperliquid sites exist right now, using lookalike domains, sponsored search ads, and fake support messages to get you to connect a wallet or sign a malicious transaction. This isn’t a hypothetical risk, it’s a cataloged, ongoing pattern.

This guide closes out TradeOnDEX’s Hyperliquid how-to series within Perpetual Futures by consolidating the phishing-safety points touched on throughout the series into one dedicated reference.

Disclosure: TradeOnDEX may earn a commission from links to Hyperliquid on this page, at no extra cost to you. Full details at the end of this article.

The documented scam patterns, specifically

Security researchers have cataloged several distinct fake-Hyperliquid campaigns, not just generic warnings:

• Fake “rewards program” pages that mimic the official site and function as wallet drainers, stealing assets from any wallet that connects and signs.
• Fake “fee refund” pages promising to refund gas or trading fees, designed to get a malicious transaction signed instead.
• Lookalike domains, such as substituting a letter to create something like “hyperliguid.xyz” (an “i” for an “l”) or an entirely different domain like “hyperliquid.life,” styled to closely resemble the real app.
• Fake airdrop announcements, using the promise of free tokens to prompt a wallet connection or signature.
• Impersonated “support” accounts on Telegram, Discord, or X, messaging users directly, then guiding them to “verify your wallet” or “reset permissions”, actions that typically mean signing something malicious.
• Malicious Google search ads placed above the genuine site in search results, exploiting the fact that a sponsored ad slot doesn’t guarantee legitimacy.

How to check before you connect or sign anything

1. Type the URL yourself, or use your own bookmark, app.hyperliquid.xyz, rather than clicking a link from a search ad, social post, or direct message.
2. Read the full domain carefully, not just the visible link text. Lookalike domains are specifically designed to pass a quick glance.
3. Treat any unsolicited DM claiming to be “Hyperliquid support” as suspicious by default. Legitimate support does not proactively message you to “verify” or “fix” your wallet.
4. Be skeptical of urgency or reward framing, “claim before it expires,” “get your refund now,” “limited airdrop”, these are consistent hallmarks across the documented scam campaigns, not coincidental phrasing.
5. Never share your seed phrase, private key, or password with any website, support agent, or “verification” tool, no matter how official it looks.

Risk: why this specific scam category is worth extra caution

A convincing visual copy of a real site tells you nothing about its legitimacy. Several documented fake sites were reported as closely resembling the real app’s design, visual polish is not a signal of authenticity, and treating it as one is exactly what makes these campaigns effective.

Sponsored search results are not vetted for legitimacy by the fact of being an ad. A malicious site appearing above the genuine result in search rankings, via paid placement, has been a documented pattern specifically targeting Hyperliquid users. Don’t treat ad position as trust.

A single successful malicious signature can be irreversible. Unlike a typical phishing scam that might ask for a password you can later change, a malicious wallet signature can authorize an immediate, irreversible transfer of assets, there’s often no recovery path once it’s signed.

Being “verified” or “official-looking” on a social platform doesn’t confirm legitimacy. Impersonated support accounts on Telegram, Discord, and X have been part of documented campaigns, a blue checkmark, professional bio, or plausible username doesn’t rule out impersonation.

Quick reference: legitimate vs. suspicious signals

See it for yourself

Bookmark app.hyperliquid.xyz directly after verifying it once through a source you trust, and use that bookmark going forward instead of searching for it each time. If you believe you’ve interacted with a scam, Hyperliquid’s own support documentation has a dedicated section for reporting it.

Frequently asked questions

How can I tell a fake Hyperliquid domain from the real one?

Read the full URL character by character rather than skimming it, documented fake domains have used subtle letter substitutions or entirely different domains styled to look similar. When in doubt, use a bookmark you created yourself rather than a fresh search or link.

Would Hyperliquid support ever message me directly to “fix” my wallet?

No, legitimate support does not proactively reach out via DM asking you to verify, reset, or fix your wallet. Treat any such message as suspicious by default.

Is it safe to click a sponsored/ad link to Hyperliquid in search results?

Not automatically, malicious ads impersonating Hyperliquid have been documented. Verify the actual URL carefully, or navigate via a bookmark instead.

What should I do if I think I’ve already signed a malicious transaction?

Act quickly: move any remaining assets in that wallet to a new, secure wallet if possible, and consult Hyperliquid’s official support documentation for further guidance, but recognize that a completed malicious transfer is often not reversible.

Affiliate disclosure

TradeOnDEX may earn a commission if you sign up or trade through a link on this page, at no extra cost to you. Hyperliquid’s own affiliate/referral terms are still being confirmed for this site, so links here are direct and untracked for now. This article is educational security information, not a guarantee against scams, and is not financial advice. See our disclaimer for the full risk warning.