exploit
Papertrade loses control of its Hyperliquid price feed on launch day; one wallet nets $1.28M
A single wallet booked about $1.28M on Papertrade in its first hours by moving Hyperliquid's ETH midpoint. The 1000x venue says it is tightening open-interest caps.
A trader netted roughly $1.28M in realised profit on Papertrade — the new 1000x perpetuals venue built on HyperEVM — during its first hours of live trading on October 10, by pushing Hyperliquid's own best-bid/offer midpoint around and letting Papertrade's synthetic swap pool pay the difference. The venue confirmed the activity publicly and told users it is tightening open-interest caps "onchain and at the relayer level," per The Block's reconstruction of the wallet's trade log.
What happened
Papertrade went live on HyperEVM at 10:00 ET on Saturday, October 10 — "the anniversary of crypto's monumental crash last year," as Bankless framed it in its pre-launch brief. The venue takes the other side of every trade through a shared USDC liquidity pool nicknamed Martingaler LP, and prices positions at the mid-point of Hyperliquid's live BBO rather than against an internal order book or external market-makers.
Within hours one wallet — identified by The Block as 0x2025137a136bea7446deba681cbfc7cf1970840e — ran a round-trip Hyperliquid-plus-Papertrade sequence multiple times:
- 18:01–18:02 ET. Bought roughly 6,060 ETH on Hyperliquid, pushing the reference price ~0.12% ($~3) higher.
- 18:03 ET. Sold ~5,210 ETH, dropping the reference ~$3.50.
- 19:13 ET. Opened 30 ETH shorts at 660x on Papertrade (~$297M notional), then sold ~6,590 ETH over three minutes on Hyperliquid, dragging the midpoint down to $2,504.40 — and closing short positions against the Papertrade pool on the move.
- 22:31 ET. The last short was liquidated at $2,509.95 for a reported ~$450k loss, trimming total gains but not reversing them.
The wallet's Papertrade portfolio page shows roughly $1.28M in realised profit on $3.18B of notional volume, and withdrew about $2.48M against $1.2M in deposits. The liquidations also minted an estimated 17.6M PAPER to the same wallet — Papertrade's native token is distributed to traders at the moment they realise a loss, so each self-induced liquidation produced emissions on top of the net profit, per Bankless's design walkthrough.
Mechanism — not an exploit, a pricing design
There is no smart-contract bug here. The Hyperliquid oracle precompile fed Papertrade exactly what Hyperliquid's book said, and Papertrade settled against it as advertised. The attack surface is in Papertrade's choice to source its reference from an orderbook the trader can themselves move:
- No internal matcher. Papertrade is 100% LP-sided. The venue cannot route a position against a counter-party whose profit flattens the risk; the pool eats the entire PnL.
- No external oracle blend. Papertrade reads Hyperliquid's BBO midpoint directly through HyperEVM precompiles — no Chainlink or Pyth median, no exchange-weighted index.
- No published open-interest cap at launch. Bankless flagged in May that Papertrade's docs described no OI cap and no manipulation guard beyond queueing liquidations ahead of new positions, in its design overview. Papertrade on Sunday acknowledged launch-period caps were "loose."
- Reflexive emissions. PAPER mints on realised losses up to 100 PAPER per $1 of qualifying losses while the pool is under $2M, declining as the pool grows. A trader who moves the oracle, takes a programmed loss on one leg, and books a larger win on the other does not just extract LP dollars — they also farm the token with the loss leg.
Hyperliquid's own risk documentation says plainly: "if the oracle is compromised or manipulated for an extended period of time, the mark price could be affected and liquidations could occur before the price reverts to its fair value." That text pre-dates Papertrade; it was written about Hyperliquid's own oracle risk. Papertrade imported the risk into a venue that trades at 1000x leverage against a shared pool starting from zero.
Impact on the pool
Papertrade publicly said the Martingaler LP dropped from roughly $5M to $2.4M during the activity on October 10 before recovering. The venue claims the trader returned most of the proceeds through new accounts and that some users reversed manipulated trades in exchange for keeping their earned PAPER; The Block states it could not independently verify either claim, and so neither can we.
What is verifiable from the trade log is that the wallet's own position moved $3.18B of notional against a pool that at peak held ~$5M, which is the ratio to keep in mind when reading Papertrade's claim that the launch-period caps were "loose."
Pattern
Hyperliquid's HLP vault has been the counterparty in each of the venue's prior loss events — JELLY in March 2025, POPCAT in November 2025, FARTCOIN in April 2026, the XPL whale run in August 2025. The Papertrade episode moves the pattern one layer outwards: this time the manipulator did not need Hyperliquid to list a thin asset. The oracle input was the venue's own ETH/USD BBO on a Saturday with light flow, and the pool bleeding out sat on a different protocol with no HLP-style auto-deleverage, no delisting authority, and no validator-vote circuit-breaker.
What to watch
- A published open-interest cap for Papertrade's launch window — numeric, onchain, and tied to the pool's current size. Papertrade said one is coming; the specific parameter is the test.
- Whether Papertrade switches the price feed from Hyperliquid's raw BBO to a blended or TWAP-smoothed source, or keeps the direct precompile. A smoothed input raises the cost of manipulation at the price of worse fills in fast moves.
- Any claw-back mechanism beyond the venue's claim of voluntary returns through new accounts. On an LP-sided venue, there is no counterparty to make whole; the pool either prices manipulation into fees or caps notional per side.
- PAPER's distribution curve going forward: if programmed losses continue to produce outsized token emissions, the token's economics are set by whoever is best at losing on purpose.