Security

Buys and sells of the six leveraged tokens go through USDC liquidity pools on HyperEVM (pool fee 0.3–1%, paid to the pool's liquidity providers; the exact fee is shown in each quote). If a pool is too thin for an order, the site falls back to minting or redeeming through the vaults below. Cross-chain orders also use bridge or swap contracts; rHYPURR uses a separate pool route. Transactions are signed from your wallet. Check addresses before you sign.

Vault contracts (HyperEVM)

Who runs what

Same owner. Hyper Tokens routes orders and never holds funds. Ensemble runs the vaults.

Data sources

Prices from Hyperliquid. price per token and TVL read from the vault contracts on HyperEVM. Bridges: Relay, with LI.FI as a fallback.

Who holds the keys

Ensemble vaults are on-chain smart contracts: your deposit, shares, price per token and trades are handled by contracts on HyperEVM/HyperCore, and routine rebalancing can be triggered by anyone. You still have to trust the admin. The admin address (0x2c3c66ce5ed0f72595f12c39f97355c3b9eda4d1) is a Fordefi MPC wallet, per Ensemble: the key is split across multiple parties, so it appears on-chain as a single address. It can change settings, pause or cap deposits and withdrawals, and upgrade the vault code. There is no on-chain timelock. Checked on-chain on Oct 21, 2026: EIP-1967 admin slot of each vault, each ProxyAdmin's owner(), the vaults' owner() (VaultAdmin) and its owner, and the CircuitBreaker's owner. On-chain, the admin address has no contract code (it is not a Safe). That it is a Fordefi MPC wallet with the key split across parties is Ensemble's statement; MPC key-sharing happens off-chain and can't be verified on-chain.

Report a problem

Found a bug or a suspicious copy of this site? Do not sign anything. The only official address is hypertokens.io.

Security issues, including vault and smart-contract issues: message @hypertokensio on X. See also security.txt.