security: scams to expect, and what hypercopy will never ask you

Copy trading attracts scammers because users expect a bot to talk to them about money. The good news is that hypercopy's design gives an attacker very little to take: the only key hypercopy holds cannot withdraw. The bad news is that a scammer does not need hypercopy's key; they need yours, and they will ask nicely.

the four things hypercopy never asks

1. Your seed phrase or wallet private key. Never, in any flow, for any reason. Hypercopy holds an agent key it generated itself.
2. A signature outside the bot's own flows. The two signatures hypercopy needs (approve agent, approve builder fee) and your transfers appear in the bot, from a button you tapped. Nothing arrives by direct message.
3. A payment, deposit or "unlock fee" to a personal address. Deposits go to addresses the bot shows under 💰 deposit · withdraw, on your own wallet. Nobody asks you to send funds to release a withdrawal, verify an account or claim a reward.
4. A QR code or link sent from elsewhere. The bot's /start message says it: hypercopy only talks to you in this bot. Never scan a QR code or open a link that someone sent you outside it.

how impersonation works

• A fake support account messages you first, often minutes after you post in a public group, offering help. Hypercopy's support is one account, named in the bot's /start message, and it never writes first.
• A fake bot with a similar name. The real bot is @hypercopyapp_bot; check the handle, not the display name or the avatar.
• A fake website asking you to "reconnect your wallet". Hypercopy's site is www.hypercopy.co. A wallet connection request outside the bot or that site is not hypercopy.
• A "sync" or "validation" page that asks you to sign a message. Read what you sign: hyperliquid's approve agent and approve builder fee messages are readable. A blind hash is not one of ours.

checking you are in the right place

• The bot handle is exactly @hypercopyapp_bot.
• The /start message names the single support contact and repeats the rule that it never writes first.
• Your agent appears on hyperliquid's api page under your account, with an expiry within 179 days.
• Your fills on hyperliquid show hypercopy's builder fee.

if something feels wrong

1. Revoke the agent on hyperliquid's api page. Hypercopy can no longer trade for you; your positions stay yours.
2. Move funds if your wallet key may have leaked. An agent key leak cannot move funds; a wallet key leak can.
3. Re-activate in the real bot when you are sure, which issues a fresh agent.
4. Report the impersonator to telegram and tell support through the bot.

what hypercopy does on its side

• one agent key per wallet, encrypted at rest, never reused, valid 179 days;
• builder fee approval capped at the rate you signed;
• reduce-only exits, so a bug cannot flip your position;
• a circuit breaker that pauses a copy after repeated failures;
• no seed phrases, no wallet keys, no withdrawal permissions, ever.

faq

someone claiming to be hypercopy asked me to verify my wallet

It is not hypercopy. Block, report, and if you signed anything, revoke the agent on hyperliquid and check your wallet's approvals.

can the real support ever ask me to sign something?

No. Support can ask for a transaction hash, a coin, a time, or a screenshot of the bot. Never a key, a seed, or a signature.

is the embedded wallet safe?

It is created by the wallet provider under your telegram login; hypercopy's servers never see its key. Protect your telegram account (two-step verification) as you would the wallet itself.