Hyperliquid oil spoofing: $170 million in phantom orders for $119,000 in profits
Bloomberg and Solidus Labs point to $170 million in orders canceled on Hyperliquid Brent in March, for a gain of $119,000. Suspicion of spoofing, without proof. The article Spoofing on Hyperliquid oil: $170 million in…
Coin Encyclopedia Improve your knowledge of cryptos
To understand the matter, you have to start from the order book. It is the public list of pending buy and sell offers in a market, ordered by price. Traders read it all the time. A large wall of sell orders suggests that the price will fall. Conversely, a big buying wall announces an increase.
Spoofing exploits this reading. The manipulator displays large orders that he has no intention of letting be executed. Let's take a simplified example. Brent is trading at $83 and the spoofer places $10 million in sell orders just above the price. The other traders believe in a selling wave and sell in turn, so that the price slides to 81 dollars. The spoofer then purchases discreetly at this low price. Then he cancels his false orders before they are affected. The wall disappears, the price rises and he sells at a profit.
A variant, layering, layers these false orders on several price levels to make the wall more credible. To spot a spoofer, monitoring companies like Solidus Labs look for three main signals. First, an overwhelming share of canceled orders compared to executed orders. Then, large orders withdrawn just before being hit. Finally, transactions in the opposite direction made at the same time by the same account.
The practice has been illegal in the United States since section 747 of the Dodd-Frank Act of 2010. This text prohibits placing an order “with the intention of canceling it before its execution”. In Europe, the regulation on market abuse, known as MAR, also classifies these false orders as price manipulation.
The playing field also deserves a definition. A perpetual contract is a derivative product with no maturity date. It allows you to bet up or down on Brent with leverage, without ever holding oil. On Hyperliquid, these contracts are traded 24 hours a day in an entirely on-chain order book, visible to everyone.
The scenario described by Bloomberg fits this definition. On March 9, one of the two accounts canceled approximately $17 million in sell orders. At the same time, $425,000 of purchases were being made on the other side of the book, or forty times less. In other words, this account was withdrawing approximately $40 in orders for every $1 actually traded. According to Solidus Labs, the Brent perpetual first slipped from 83.06 to 81.42 dollars in around ten seconds. It then climbed to $87.56 in less than a minute. The same trader also accounted for more than 90% of the cancellations in this market. Over three days, the estimated gain reached $119,000.
Method: reports are grouped by the words of their headline and summary; each newsroom counts once; figures are read from the reports as published. Nothing here is written by an AI.
These three days are those of the oil frenzy. On March 9, WTI touched $119.48 before falling to $81.19 in the same session. In addition, the daily volume of Hyperliquid oil contracts exceeded $1 billion at the height of the crisis. In such a nervous book, a few million phantom orders are enough to move the price.
Bloomberg specifies that the identity of the two accounts and their intention have not been established. But intention is the heart of any spoofing case. The CFTC is the American derivatives watchdog. Since its 2013 guidelines, it requires proof that the order was placed with the intention of canceling it before execution. Mere recklessness is not enough. Even in a regulated market, this type of file takes years. As of October 29, no media outlets have reported regulatory action.
The heaviest precedent gives the measure of the risk. In September 2020, JPMorgan agreed to pay $920.2 million to US authorities, according to the CFTC, for hundreds of thousands of fictitious orders placed from 2008 to 2016 on precious metals and Treasurybondfutures. “Spoofing is illegal, pure and simple,” summarized Heath Tarbert, president of the CFTC.
With Bloomberg, Hyperliquid Labs stuck to one sentence. According to the company, each order, each cancellation and each transaction are recorded in a public and immutable register, which can be consulted by everyone in real time. Trade.xyz, the team that deploys oil markets through HIP-3, says its markets are designed to resist manipulation. The team also provides continuous monitoring and alerts. HIP-3 is a framework launched in October 2025. It allows any team that locks in 500,000 HYPE to create their own perpetual markets and set the rules.
The transparency argument cuts both ways. Public data allowed Solidus Labs to reconstruct the sequence without any privileged access. They would also serve as evidence if the CFTC one day decides to act. On the other hand, blockchain simply records and does not sanction anyone. On a regulated market, the operator detects and transmits to the regulator. On Hyperliquid, it is the HIP-3 deployer which itself sets the rules of the market it monitors.
The affair comes after six months of crossfire. CME and ICE, the two major American derivatives exchanges, alerted the CFTC and parliamentarians on May 15, according to Bloomberg. They targeted Hyperliquid oil perpetuals and cited the risk of manipulation, circumvention of sanctions and possible distortion of global oil benchmarks. At the end of May, Jeffrey Sprecher, CEO of ICE, judged the platform “bigger than Nasdaq”. He pointed out in passing that it only has eleven people. The Singapore monetary authority, MAS, in turn placed it on its investor alert list at the end of June. These attacks have so far lacked a concrete case. Solidus Labs provides them with one, even without proof of intent.
Washington is however blowing the heat. On August 19, Donald Trump affirmed at the White House that CFTC Chairman Michael Selig is also “working to bring Hyperliquid to the United States” in a “fully compliant and legal” manner. On August 26, the Hyperliquid Policy Center and trade[XYZ] then requested by letter to the CFTC to authorize regulated perpetuals on WTI, Brent and Henry Hub gas. The alleged spoofing in March therefore falls at the height of the request for approval.
This is not the first time that Hyperliquid's books have been used as a playground. In March 2025, a strategy on the memecoin JELLYJELLY left the HLP vault, the platform's community market maker, with approximately $12 million in unrealized losses according to Lookonchain. Hyperliquid then reported “indications of suspicious market activity,” and its validators voted to withdraw from the market. The Hyper Foundation then compensated the users, except for the reported addresses.
On November 12, 2025, the POPCAT affair even took on the appearance of spoofing. A trader spread $3 million across 19 portfolios to build a large long position. He put up a $20 million buy wall, then withdrew it all at once. The price collapsed, liquidations continued and the HLP vault took in $4.9 million in unrecoverable debt, according to on-chain data analyzed by Lookonchain. It was already the third attack of this type in 2025, after JELLYJELLY and TST in July.
The year 2026 has not been calmer. In April, the HLP vault lost $1.5 million in an attack orchestrated via Fartcoin. At the end of July, an aberrant price from a Korean exchange caused the SK Hynix perpetual to plunge by 17.9% and liquidate $57 million across 960 accounts. Each time, the transparency of the blockchain made it possible to reconstruct the attack after the fact, without preventing it.
Pump.fun announced on October 28 on X the opening of perps in its application. More than 300 Hyperliquid markets become accessible, from cryptos to stocks to commodities. Leverage rises to 50x on the S&P 500, 40x on bitcoin, 25x on ether and 20x on Tesla or Nvidia, according to TokenPost. Positions are opened on an isolated margin, that is to say with a guarantee specific to each position, from a balance in USDC or SOL without going through a bridge. Pump.fun charges 0.05% per transaction on top of protocol fees, and its terms of service exclude the United States and Ontario.
Pumpfun x @HyperliquidX Perps are live on the Pumpfun app! Long or short crypto, stocks & commodities on the biggest onchain perps engine, straight from your USDC balance. No bridging required. Learn more 👇 pic.twitter.com/weHLk8vvKx
Pump.fun has not built anything on the engine side. Solana's memecoins launchpad is limited to one interface. It routes orders to Hyperliquid’s books using builder codes, a mechanism that pays it a share of the fees. HyperCore matches orders and manages liquidations. In other words, the most impulsive public in crypto arrives with leverage on the same oil books that Solidus Labs has sifted through.
Hyperliquid thus combines deployers judges and parties with a retail feed connected live to its oil books. Those who demand market surveillance worthy of the name have their example file, dated March 9. The CFTC has not announced any public decision, neither on the May referral nor on the August authorization request.
Falling down the white rabbit hole in 2017, I went from avid reader to Editor-in-Chief of Journal du Coin. I like to get involved behind the scenes of projects to bring my vision of a decentralized future. A lover of beautiful letters, I coordinate our teams to transform technical complexity into human, precise information without unnecessary jargon. Between entrepreneurship and writing, my mission is clear: popularize tomorrow, but do it today.
The news that matters, summarized in 2 minutes. Monday to Friday, in your inbox.
This site uses Google Analytics to collect anonymous information such as the number of visitors to the site and the most popular pages.