Before you sign
Check the address bar: it must say my.kimba-scanner.com. Kimba never sends a link that takes you straight to a signature. If a message asks you to sign something, close it and start from this site.
A copy of this site could ask you to approve an attacker's agent. An agent cannot withdraw, but it can open trades on your account that move value to someone else. That is why the bot's account should only hold what you have set aside for it.
What you will sign
Login. A text message with this site's address and a statement that it authorizes no transaction.
Disclosure. A text message that starts with “Kimba Copybot: I have read and accept the disclosure”.
ApproveAgent. A request with these fields:
- Primary type: HyperliquidTransaction:ApproveAgent
- AgentAddress: the same address the page shows you
- AgentName: starts with Kimba and ends with valid_until and a number
- HyperliquidChain: Mainnet
MetaMask also shows who is asking, under Request from: it must say my.kimba-scanner.com. Rabby may say “Unknown Signature Type” for this request, which is normal there. The fields above are what you check.
What Kimba never asks
- Your seed phrase or private key.
- A signature to deposit or withdraw funds, or to send them anywhere.
- A token approval or a transaction on any blockchain.
If you see any of these, reject it.
See and revoke your agents
Open app.hyperliquid.xyz/API and connect the same wallet. The page lists every agent approved on the account, and you can remove any of them there.
Every agent approved from this site also triggers a Telegram message with its address. If you get that message and it was not you, revoke the agent straight away, then write to admin@kimba-scanner.com.
Removing the bot's agent stops mirroring, but it does not close open positions: those stay on your account, and you manage them yourself.