Most of them are probably hacked, but there was recently a Hoopa event in Japan, so japanese Hoopa may be legit. However, Hoopas in other languages are hacked as there have been no Hoopa events outside Japan. However, most hacked Hoopas are perfectly legitimate, with proper stats, moves and Abilities-they just haven't been obtained in a legit way. Volcanion is unreleased as far as we know, so all Volcanion are assumed to be hacked. However, like Hoopa, most hacked Volcanion have legit moves, stats and Abilities. As for obtaining on, you could try to get someone to trade you a event Hoopa, but there isn't much of a problem using a hacked Hoopa, as Hoopa has now been released, and so you could now find a official Hoopa online, so hacked ones can be used as long as they are exactly the same as a legit Hoopa. (no illegal stats, moves or Abilities.) For Volcanion, you can't get one legitimately, and please don't use a hacked one online as people don't like you using hacked Pokemon that haven't been released.
-RedGenesect
