3 Days of Arbitrage Worth $110K: Is the Hyperliquid Spoofing Case Really Unfair?
- Core Viewpoint: Bloomberg reported that two accounts on Hyperliquid allegedly profited approximately $119,000 over three days through suspected spoofing (fraudulent order placement) in crude oil trading. However, this behavior is a long-standing and widespread issue on centralized exchanges and should not be packaged as a unique flaw of on-chain platforms.
- Key Elements:
- Solidus Labs monitoring showed that from March 8 to 10, two accounts submitted over $170 million in anomalous orders, with approximately $30 in orders canceled for every $1 actually executed, yielding profits of about $119,000.
- On-chain tracking identified the main account 0xc926…98d3 and sub-account 0x2577…4897. The main account repeatedly placed sell orders of approximately $200,000 above the market and quickly canceled them, while buying approximately $458,000 in contracts within 15 seconds before and after a sharp drop.
- The spoofing technique involves: large sell orders pressuring market sentiment, while hidden real buy orders accumulate on the other side; after execution, the sell orders are withdrawn, exploiting traders' judgments about order book depth.
- The U.S. futures market has explicitly prohibited such behavior, and CEXs like Kraken have long monitored and publicly explained similar manipulation tactics. A spoofing case also appeared on Kraken this month.
- Hyperliquid's order, cancellation, and execution data are publicly verifiable, enabling external researchers to reconstruct account behavior, whereas CEXs only display aggregated order book depth, making it difficult to trace the entities behind orders.
- The article argues that the monitoring and data disclosure of all platforms should be scrutinized equally, rather than attributing a long-standing problem as a unique flaw of Hyperliquid simply because on-chain data is more transparent.
Someone placed a large crude oil sell order on Hyperliquid, seemingly preparing to dump, yet was simultaneously buying on the other side. Once the trades were done, those sell orders were pulled.
This is the crude oil trading controversy recently reported by Bloomberg.
Market surveillance firm Solidus Labs found that between March 8 and 10 this year, two accounts submitted over $170 million in anomalous orders, profiting about $119,000 over three days. During that period, for every $1 actually executed, roughly $30 in orders on the other side were cancelled.
Solidus described this behavior as bearing the characteristics of spoofing. Spoofing, or fraudulent order placement: putting up large orders to influence others while hiding the trades you actually want to make on the other side.
Spoofing is certainly illegal, but framing it as a problem unique to Hyperliquid is somewhat unfair.
Address Behavior
Following the on-chain records, a set of accounts highly consistent with the report can be identified: the main account 0xc926…98d3, and its sub-account 0x2577…4897. Across these three days of crude oil trading, the two together earned about $119,000 after fees.
At the time, the Brent price fell from about $83.06 to $81.42, then quickly rebounded. The main account repeatedly placed sell orders of about $200,000 above the price, and as soon as they were placed, pulled them, updated the quotes, and placed them again. What anyone watching the market saw was a large crude oil sell order always waiting above.
At the same time, this account was also buying. In the 15 seconds around the sharp drop, the main account actually bought about $458,000 worth of crude oil contracts.
The sub-account spread orders across multiple price levels: sell orders above, buy orders below, continuously adjusting as the price moved. It also bought about $18,000 worth of contracts during this sharp drop.
In other words, while the large sell orders repeatedly appeared, this group of accounts was buying at the same time. This behavior clearly fits the characteristics of spoofing.
Main account candlestick chart and single-address order heatmap
Sub-account candlestick chart and single-address order heatmap
Fraudulent Orders
Suppose you're preparing to buy crude oil and see a sell order appear above the price that is far larger than anyone else's. What would you think?
It's easy to feel that a big player is rushing to sell and the price will probably fall further. Those who were going to buy decide to wait; those already holding worry about a bigger drop and simply sell first.
If that large sell order was meant to make everyone react this way, the person placing it has achieved their goal. They have the buy orders they actually want filled sitting below, waiting for others to voluntarily sell contracts to them; once they've bought enough, they pull the large sell orders above.
The sell orders pressure the market; the buy orders take the goods for them.
The reverse works the same way. Someone who wants to sell can first place a large buy order to make others feel there's capital supporting the price below. Some people then raise their bids and chase the market to enter, and the seller takes the opportunity to sell, then pulls that large buy order.
Spoofing exploits the fact that people judge from the order book what others want to buy or sell. Ordinary traders watch large orders, and automated trading programs also adjust quotes based on bid/ask depth. A sufficiently conspicuous order can make many people react at once.
The U.S. futures market has explicitly banned this behavior; the key legal focus is "placing an order with the intent to cancel it before execution in order to mislead the market."
A Longstanding Problem on CEXs
Discussion of spoofing appeared on centralized trading platforms long ago.
Kraken, in its official explanation of market manipulation, directly uses "placing large sell orders to suppress the price, buying low, then cancelling the sell orders" to describe the tactic. It also specifically monitors another practice: spreading orders across several adjacent price levels to make one side of the book appear unusually thick, creating the impression that a lot of money is buying or selling.
Over two consecutive weekends this month, these fraudulent orders appeared on Kraken. They created a sense that someone was continuously buying, helping push the price up.
For those who believe "a big buy wall is support," this is where the risk lies: you decide to buy based on that order, but the person who placed it can pull it at any time. You've already been filled; they've just changed their quote.
Trading platforms include this behavior in their surveillance, and traders constantly discuss how to identify it. Against this backdrop, packaging spoofing as a newly emerged problem on on-chain trading platforms is hard to make convincing.
Sometimes the asset the manipulator actually wants to sell isn't even in the same market.
On weekends with poor liquidity, large funds often use spoofing orders in BTC to make BTC's price rise slowly, thereby using algorithms to pump altcoins and help themselves exit.
The Transparent Platform Becomes the Target
Hyperliquid has one difference from centralized trading platforms in this matter: orders, cancellations, and executions are all publicly recorded.
The reason we can find this group of accounts and see where they placed orders, when they cancelled, and how much they ultimately bought is precisely because this data can be checked by outside researchers.
On a centralized trading platform, what ordinary people see is usually only the aggregated order book depth. A buy wall is pulled—who placed it? The sell orders on the other side of the price—are they from the same person? It's hard for outside observers to connect these questions.
Discovering anomalous trading, of course, should be investigated. Platforms should also monitor and handle manipulative behavior. But since CEXs face the same kind of risk, they should be subject to the same scrutiny.
Focusing only on Hyperliquid and describing an old problem that spans multiple trading platforms as its unique flaw is like drawing the target around the arrow after it lands.
The real question is how much data each trading platform is willing to disclose, and what they do after discovering anomalies. Claiming that whoever's data is easier to check is therefore the biggest problem is not a persuasive conclusion.
