PaperTrade reported attempts to manipulate the best bid and offer (BBO) prices on Hyperliquid on October 10–11, 2026. These quotes were used to value synthetic trading positions. The project acknowledged the attempts on October 11. The account examined in this analysis withdrew 1,279,106.191184 USDC more than it deposited on the platform.
PaperTrade settled closed positions at the midpoint between the current best bid and offer. At the same time, the downward adjustment to profit, the so-called haircut, was calculated using a fixed reference position size.
Addresses and their roles
All the addresses below are on the HyperEVM network, which uses chain ID 999.
| Network | Address | Established role |
|---|---|---|
| HyperEVM | 0x2025137a136bea7446deba681cbfc7cf1970840e | The trading account examined in this analysis. |
| HyperEVM | 0x6cd5661646289fb6e65ea5c032310fded797d0a2 | The exchange proxy contract that records positions, balances and withdrawals. |
| HyperEVM | 0xa9b4c7b7ca5835652d81e25739c870d49f39cc2e | The proxy contract of PriceOracle, the component that fetches price data. |
| HyperEVM | 0x3997ffc8cbd281d4fc8d0548e505ae2fbbbd985a | The PriceOracle implementation executed in the examined position opening and closing transactions. |
Background
PaperTrade offered leveraged trading in synthetic positions backed by the Martingaler liquidity pool. Opening a position created an internal trading exposure: PaperTrade did not place an equivalent buy or sell order for the real asset on Hyperliquid. When a position was closed, its financial result, the profit or loss (PnL), was settled from the pool's funds.
PriceOracle fetched the current best bid and offer prices on Hyperliquid through a special system mechanism called a precompile at address 0x080e, and then calculated the midpoint of these prices. It was used as the trade execution price. When a profitable position was closed, a threshold band, a profit adjustment for asymmetric price impact and a fee on profitable closes were applied. If there was not enough liquidity for a payout, payments were queued.
So the price came from Hyperliquid's best quotes, while the synthetic position was backed by the PaperTrade pool. The payout amount depended on position size, even though a trade of the corresponding size did not necessarily take place on the market at the midpoint used.
How events unfolded
All the timestamps below are in Coordinated Universal Time (UTC). The four stages describe the opening and closing of the examined account's position, its external trading and its withdrawals.
1. Opening the position
On October 10 at 21:41:36, account 0x2025137a136bea7446deba681cbfc7cf1970840e opened a long ETH position, a bet on Ethereum's price rising, numbered 72098. This took place in transaction 0xe639…f225.
2. Closing the position
Six minutes later, at 21:47:36, the position was closed in transaction 0xb5bc…df42d. The closing record shows an exit price of $2,510.85. Over that time, the price moved in the position's favor by about 17.55 basis points.
The historical call trace shows the sequence Exchange → PriceOracle → the system mechanism for fetching the best BBO quotes 0x080e. This mechanism returned the values 251080 and 251090 in units of $0.01, that is, a bid of $2,510.80 and an ask of $2,510.90. PriceOracle returned 251085, corresponding to the $2,510.85 price recorded when the position was successfully closed. Both BBO quote reads in this transaction show the same values.
The spread between bid and ask was $0.10, about 0.40 basis points. The 17.55 basis points figure reflects the position's return between entry and exit over six minutes, not a deviation from an independent market price. Neither figure on its own proves that the quote was abnormal or deliberately influenced. This example shows how the recorded settlement rules worked. Ordinary leveraged trading remains a sufficient explanation for this particular trade.
This is the stage at which the entry price turns into a payout. Prices are expressed in units of $0.01, so the threshold band, calculated with rounding down to a whole number, is:
The result matches the recorded calculation at the position's close. The values in the table are rounded to six decimal places; intermediate calculations were carried out at full precision.
| Calculation step | Formula | Amount, USDC |
|---|---|---|
| Raw profit after the threshold band | 10,000,000 × m | 17,355.223523 |
| Adjusted profit | Raw profit × coefficient | 13,494.728986 |
| Fee on profitable close | Adjusted profit × 2% | 269.894580 |
| Net profit after fee | Adjusted profit − fee | 13,224.834407 |
With the same prices and parameters, a hypothetical $500K position would have yielded 661.241720 USDC after the fee. The recorded $10M position yielded 20 times as much, while the percentage profit reduction from the price impact adjustment remained the same in both cases, at 22.243992%.
So a $4.40 price move produced a profit of 13,224.834407 USDC on the examined position. In the five seconds before this position was closed, the account made no ETH trades that resulted in an order being filled. This example therefore establishes how the payout was calculated, but does not reveal a corresponding manipulative trade.
A 100x pump, a $75M loan and a blockchain rollback: what happened to Tectonic?Sep 5, 2026Read more
3. External trading and repeated settlements
Between 22:01:00 and 22:03:00, the same account made 597 ETH trades on Hyperliquid: it bought 6,058.1450 ETH and sold 383.0414 ETH. The fuller collected history of the account contains 10,427 ETH trades with a total turnover of about $231.84M.
PaperTrade's history records 337 closed ETH positions, including 296 closed at a profit. The profitable positions covered six notional sizes, from $500K to $10M. The total exposure was built up across several positions.
Of the 296 profitable closes, 62 occurred within one second of an ETH trade made by the same account. In 52 cases, the timing overlap involved only trades in which the account acted as a maker, that is, provided liquidity to the market. In another 10 cases, there were trades in which the account acted as a taker, filling orders already placed. These last ten cases fall within three position-closing transactions within two seconds.
For example, position 69035 was closed at a profit on a short position, a bet on the price falling, at $2,505.85, while taker sales at $2,505.80 were filled close in time. By comparison, the close of position 71121 coincided in time with ten maker purchases.
The reconstructed transaction trace for position 69035 shows quotes of $2,505.80 and $2,505.90, whose midpoint is the recorded $2,505.85. The transaction for position 71121 similarly shows prices of $2,509.70 and $2,509.80, and the oracle returns the midpoint of $2,509.75. So the actual input quotes for these transactions have been established.
Testing for deliberate price influence requires sequential data on quotes across the whole market, on placed and cancelled orders, as well as an independent market price for the same period. A matching timestamp alone is not enough.
4. Withdrawals
During the period examined, five withdrawals from the Exchange matched successful transaction records and USDC credits on the HyperCore network.
| Withdrawal time, UTC | Amount, USDC | HyperEVM transaction |
|---|---|---|
| October 10, 21:13:59 | 17,961.112612 | 0x9979…cd72 |
| October 10, 21:34:09 | 131,739.237844 | 0x9a27…3fbc |
| October 10, 22:06:48 | 1,543,488.792097 | 0x4162…23b0 |
| October 10, 22:13:21 | 735,681.502282 | 0x136e…abd6 |
| October 11, 02:10:35 | 50,336.049203 | 0x0223…ac48 |
| Total withdrawn | 2,479,206.694038 |
Total deposits came to 1,200,100.502854 USDC, including re-deposits of previously withdrawn funds. Subtracting deposits from total withdrawals gives a net outflow from the account of 1,279,106.191184 USDC.
At the same time, total withdrawals include returned initial capital and reused funds.
A BBO midpoint without an independent market price check
The decoded PriceOracle branch rejects zero prices and invalid quotes in which the bid is higher than the ask, and then returns the current midpoint of the two quotes. The code contains no averaging of prices over a period and no independent check for significant deviation from the market price.
These checks confirm that the quotes have a valid format and relationship, but do not assess whether there is enough real liquidity to back a synthetic position of the corresponding size.
The adjustment percentage does not depend on position size
The asymmetric price impact formula uses the fixed parameter referenceNotional, a notional amount taken as the calculation base, instead of the actual position size. So the monetary amount of the payout grows with position size, but the adjustment percentage stays the same.
For all six position sizes, the results of the 296 profitable closes match the documented calculation curve to within 0.000000001 USDC.
PaperTrade's response and the return of funds
In a statement on October 11, PaperTrade acknowledged that attempts had been made overnight to manipulate the best bid and offer prices for BTC and ETH on Hyperliquid. The project explained that these attempts were made possible by open interest limits that were too loose at the platform's launch. It also said it had begun tightening limits directly on-chain and at the level of the relayer, the component that passes on trading requests.
PaperTrade also said that one of the users who made a profit had returned almost all of the earnings through new accounts. The examined account recorded 30 subsequent liquidations that led to losses of 450,000 USDC. These losses are already included in the net outflow calculation.
However, the limit changes and the return of funds through other accounts have not been independently confirmed.
