Two accounts on the on-chain derivatives platform Hyperliquid were linked to an alleged spoofing pattern in Brent crude contracts between March 8 and March 10, generating roughly $119,000 in net profit after fees, according to market-monitoring firm Solidus Labs and publicly visible blockchain records.
Solidus Labs said the accounts produced more than $170 million in abnormal orders during the three-day period. For every $1 of orders that actually executed, roughly $30 of orders on the opposite side were canceled, the firm calculated. That imbalance is consistent with a strategy designed to influence how other traders read available market liquidity rather than to transact through the displayed orders.
On-chain data identifies a primary wallet, 0xc926...98d3, and a sub-account, 0x2577...4897. Their activity aligns with the timing and approximately $119,000 profit figure identified by Solidus Labs. The public record shows order placement, cancellation, amendments and fills, allowing outside analysts to reconstruct the sequence in greater detail than is generally possible on conventional trading venues.
Sell walls appeared as Brent moved lower
The alleged activity unfolded as the price of Brent crude contracts on Hyperliquid fell from about $83.06 to $81.42 before rebounding. During that move, the primary address repeatedly placed sell orders worth around $200,000 above the market price, then quickly canceled, refreshed and reposted them.
Such orders can create the appearance of substantial selling pressure. A trader looking only at the visible order book might conclude that a large seller is prepared to unload contracts at several nearby price levels, potentially encouraging other participants to sell or withdraw bids.
The on-chain record shows the primary address taking the other side of the market during the sharp decline. In the 15 seconds surrounding the drop, the address bought approximately $458,000 in crude contracts, according to transaction and order data cited in the supplied materials.
The sub-account followed a related but somewhat different pattern. It distributed orders across several price levels, placing sell orders above the market and buy orders below it, then adjusting them as prices changed. During the downturn, the sub-account bought roughly $18,000 in crude contracts.
The two accounts combined conduct created a pattern in which large displayed orders could have shaped the market's visible depth while purchases were executed at lower prices. The allegation rests on the sequence and repetition of the orders rather than on any single cancellation, since rapid order cancellation can occur for legitimate reasons in active markets.
Why intent remains central to a spoofing case
Spoofing generally refers to placing orders with the intention of canceling them before execution in order to mislead other market participants about demand or supply. The practice is prohibited in U.S. futures markets, where enforcement cases typically turn on evidence that traders did not genuinely intend their visible orders to trade.
That distinction matters in interpreting Hyperliquid's data. Large orders, canceled orders and fast revisions do not independently prove manipulation. Traders may legitimately pull orders after prices move, risk limits change or new information reaches the market. A spoofing finding generally requires a broader pattern showing that displayed liquidity consistently served as a temporary signal while the trader pursued fills in the opposite direction.
Solidus Labs reported 30-to-1 cancellation-to-execution ratio provides one measure of that pattern. The firm also characterized the more than $170 million in order activity as abnormal. Together with the purchases made during the price decline, the data presents a case for close scrutiny of whether the large visible orders were meant to be executed.
No regulatory ruling, enforcement action or admission by the accounts operators was included in the supplied information. The activity should therefore be treated as an allegation based on order-book behavior and on-chain reconstruction, rather than as a legally established instance of spoofing.
Public ledgers expose order-level behavior
Hyperliquid's architecture gives analysts an unusually direct view of market conduct. Its order submissions, cancellations and fills are publicly traceable, allowing external observers to connect activity to specific wallet addresses and sub-accounts.
Most centralized exchanges show traders an aggregated order book but do not publicly attach each order to a user identifier. That can make it difficult for outside researchers to determine whether a large sell wall was placed by one account, whether it was repeatedly canceled, or whether the same party bought contracts after helping to create downward pressure.
On Hyperliquid, the ledger leaves a durable trail. Analysts can measure how long a large order remained open, whether it was filled, how quickly it was withdrawn, and whether the address traded on the opposite side around the same time. The transparency does not establish a trader's intent by itself, but it substantially lowers the cost of detecting patterns that would otherwise remain inside a venue's private surveillance systems.
This scrutiny is increasingly relevant as liquidity grows. Total open interest across the specific on-chain markets referenced in the supplied materials exceeded $3.2 billion by the end of June 2026. Deeper markets can attract more sophisticated trading strategies, including tactics that exploit split-second changes in displayed liquidity and the reactions of leveraged participants.
Visible depth is not always executable liquidity
The episode offers a practical warning for traders using leveraged perpetual contracts or other fast-moving derivatives: a large order sitting in the book may disappear before it ever trades. Visible depth can provide useful information, but it is not the same as committed liquidity.
A sudden wall of sell orders may reflect a genuine desire to sell, but it can also be quickly removed after influencing sentiment or prompting other participants to adjust their positions. The same risk applies to large buy walls that appear to support a market before vanishing.
Traders can reduce exposure to these dynamics by watching the relationship between executed volume and canceled volume, rather than treating displayed size as a standalone signal. Repeatedly appearing and disappearing orders, particularly when they sit near prices where a trader is accumulating an opposite-side position, deserve more caution than stable liquidity that remains available through market moves.
The Hyperliquid case shows that transparent on-chain markets can make alleged order-book manipulation easier to inspect after the fact. Whether that visibility deters future misconduct will depend on how platform operators, independent monitors and traders use the evidence left behind by every order, cancellation and fill.
Want to understand abusive order tactics like spoofing? Learn how iceberg orders work in crypto trading today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
