Hipshot — Hyperliquid Cluster Attribution
How We Identified Them
The input was a flat CSV of 209 Hyperliquid-linked wallet addresses, pre-tagged with Hypurr NFT ownership. No names, no handles — just addresses and one boolean. Three sequential lookups produced the identity layer.
Step 1 — Hypurr NFT as a priority filter
The Hypurr NFT collection (4,600 NFTs) was distributed exclusively to early HyperEVM supporters. Floor price settled at $55–69K at launch, implying holders are serious participants — not casual wallets. 30 of 209 addresses hold one. These were the first cohort to investigate because Hypurr holders tend to be public-facing: they paid for access and are incentivised to signal it.
Step 2 — ENS reverse lookup on all 209 addresses
ENS reverse records map an Ethereum address back to a human-readable name. We queried api.ensideas.com/ens/resolve/{address} for each of the 209 addresses. 13 returned names. ENS records also optionally store social handles — Twitter, Telegram, GitHub — though in this cluster none had those fields set. The names themselves are often sufficient: machibigbrother.eth, rjgrant.eth, and dirtycat.eth are all searchable handles.
Step 3 — Farcaster bulk address lookup
Farcaster requires wallet verification to create an account — every Farcaster profile is linked to one or more verified ETH addresses. The Neynar API exposes a bulk-by-address endpoint that maps up to 100 addresses per call to Farcaster profiles. Running all 209 addresses returned 6 matches with full profile data: username, display name, bio, follower count, and — critically — verified_accounts, which lists linked Twitter/X handles where the user has cross-verified.
What the three steps cost
ENS reverse lookup: free, ~0.15s per address, no API key. Farcaster bulk lookup: free tier via Neynar docs key, 100 addresses per call, two calls for 209 addresses. Total wall-clock time: under 90 seconds for the full cluster. This is a fully reproducible pipeline on any address list.
Confirmed Identities
Six wallets resolved to public identities. Four via Farcaster profile match, one via Farcaster + verified Twitter cross-link, one via ENS + Farcaster.
| Address | ENS | Identity | Handle | How identified | Hypurr |
|---|---|---|---|---|---|
| 0x3280…3469 | — | Trevor McFedries | @trevor · @whatdotcd | Farcaster bulk lookup — FWB + Brud founder | ● |
| 0x7915…c07b6 | — | whitesocks | @whitesocks256 | Farcaster verified_accounts → Twitter link · Monad / Ritual / thru dev | ● |
| 0x020c…5872 | machibigbrother.eth | Machi Big Brother | @machibigbrother1 | ENS reverse lookup + Farcaster profile match | — |
| 0xb4a9…f1f7 | — | Max E | @rugmaxi | Farcaster bulk lookup | ● |
| 0xdd7a…8830 | rjgrant.eth | RJ Grant | @baznocap | ENS + Farcaster — building Nodefy.xyz | — |
| 0x36fb…f86 | — | Peter Jennings | @peterjennings | Farcaster bulk lookup — markets + crypto | — |
ENS-named, identity unresolved
13 addresses have ENS names but no Farcaster match and no Twitter record set in their ENS profile. These handles are the next lookup targets — search directly on X/Twitter and Telegram.
| Address | ENS name | Hypurr | Explorer |
|---|---|---|---|
| 0x8607…8d5 | wanyekest69.eth | ● | ES → |
| 0xa183…482 | 🍜🍜🍜🍜🍜.eth | ● | ES → |
| 0xbe4e…75e | binanceokex.eth | ● | ES → |
| 0x0e0b…57e | dirtycat.eth | ● | ES → |
| 0x6859…1e | bergspyder.eth | — | ES → |
| 0x5bcb…800 | cocteau.eth | — | ES → |
| 0x1523…b6c | condorloco.eth | — | ES → |
| 0x3b88…4a7 | hapdog.eth | — | ES → |
| 0x418a…888 | 58bro.eth | — | ES → |
| 0x0ddf…902 | pension-usdt.eth | — | ES → |
| 0xc672…7ab | sellhalfandhold….eth | — | ES → |
On-Chain Graph Analysis
Transaction history pulled from Blockscout for all 7 identified wallets (500 txns each, ETH mainnet). No direct wallet-to-wallet transfers were found between the 7 addresses in this sample — they're co-participants in the same ecosystem, not a coordinated multi-wallet operation. What links them is shared contracts.
Blue edges = all wallets bridged via Across Protocol (→ Hyperliquid). Gray edges = shared DEX/NFT/token contracts. No direct ETH transfers between nodes found in 500-tx sample.
Shared Contract Breakdown
| Contract | Type | Sub | Trev | Machi | wsox | rugx | RJ | Pete | Signal |
|---|---|---|---|---|---|---|---|---|---|
| 0x5c7b…ced35c5 | bridge | ● | ● | ● | ● | — | — | — | Across Protocol → Hyperliquid |
| 0xa0b8…606eb48 | token | — | ● | ● | ● | — | ● | ● | USDC |
| 0xdac1…831ec7 | token | ● | ● | ● | ● | — | ● | ● | USDT |
| 0x3fc9…b7fad | dex | — | ● | — | ● | ● | ● | ● | Uniswap Universal Router |
| 0x0000…1eb395 | nft | — | — | ● | ● | — | ● | — | OpenSea Seaport v1.5 |
| 0x6982…311933 | token | — | ● | — | — | ● | — | ● | PEPE token — same memecoin cycle |
| 0xb2ec…410cea5 | defi | — | ● | ● | ● | ● | — | — | ERC1967Proxy (unidentified) |
| 0x0000…887ac | nft | — | ● | ● | — | ● | — | — | Blur NFT marketplace |
Inbound: subject received ETH from 0x9642b23ed1e01d… — an EOA (no ENS), consistent with a MEXC hot wallet.
What the graph doesn't capture yet
This analysis is Ethereum mainnet only, last 500 txns per wallet. Two layers are missing: (1) older history beyond the 500-tx window, which may contain direct inter-wallet transfers; (2) the HyperEVM-layer graph — shared pool deposits, co-LPs, vault co-depositors, and perp position timing on Hyperliquid itself, none of which is indexed by Ethereum explorers.
Cluster Explorer
All 209 wallets. Filter by Hypurr NFT ownership, ENS presence, or confirmed identity. Copy individual addresses, rows, or the full filtered set.
| Address | ENS | Identity / Handle | Hypurr | Links |
|---|
Identity data sourced from ENS reverse lookup (ensideas.com) and Farcaster bulk address lookup (Neynar API). Hypurr NFT status from source dataset. Individual address investigation archived separately. For informational and research purposes only.