Hyperliquid wallets profit from Brent spoofing pattern

Two Hyperliquid accounts generated roughly $119,000 in Brent crude trading profit over three days in March after submitting and swiftly withdrawing unusually large orders that resembled spoofing, according to blockchain market-surveillance firm Solidus Labs.

Solidus Labs said the activity occurred from March 8 through March 10 and involved more than $170 million in abnormal orders. The firm found that about $30 in orders were canceled for every $1 of volume that actually traded, a ratio that points to order-book activity far exceeding genuine execution.

On-chain records reviewed by Solidus identify a main wallet, 0xc926...98d3, and a connected sub-account, 0x2577...4897. Their combined profit from Brent contracts after fees aligned with the approximately $119,000 figure during the period examined.

The episode offers an unusually detailed look at behavior that is difficult to assess on many conventional trading venues. Hyperliquid records order placements, cancellations and fills on-chain, allowing outside analysts to reconstruct wallet-level activity and compare visible liquidity with the orders that were actually executed.

Large sell orders appeared as Brent declined

Brent prices on Hyperliquid moved from roughly $83.06 to $81.42 during the period before recovering, according to the on-chain data cited by Solidus Labs. As the market weakened, the main wallet repeatedly placed sell orders of about $200,000 above the prevailing price, canceled them shortly afterward and reposted updated orders as prices moved.

At the same time, the wallet bought Brent contracts into the decline. Around the sharp price move, it acquired approximately $458,000 in contracts within 15 seconds, the data show.

The linked sub-account used a more distributed approach. It placed sell orders at several levels above the market and buy orders below it, adjusting both sides as prices changed. During the decline, the account bought about $18,000 in Brent contracts, according to Solidus Labs.

The pattern described by the firm resembles spoofing: placing large, visible orders that create an impression of supply or demand, then withdrawing those orders before execution while trading in the opposite direction. In this case, the recurring sell orders could have made the offer side of the book appear heavier, while the wallets accumulated contracts at lower prices.

A single canceled order does not establish manipulation. Traders routinely cancel and replace orders as prices move or risk limits change. The concern arises when order sizes, cancellation frequency, timing and opposite-side executions form a repeated pattern that appears designed to influence other participants view of available liquidity.

Public order data makes reconstruction possible

On a conventional market, detailed order-level surveillance is generally handled by exchanges, brokers and regulators with access to proprietary data. Hyperliquids public records create a different dynamic: researchers can examine individual wallets, distinguish between posted and filled orders, and track how quoted liquidity disappears around price movements.

That transparency can make suspicious behavior easier to identify after the fact, but it does not automatically stop it while it is occurring. A trader viewing a live order book may see a large sell wall without knowing whether it reflects durable selling interest or an order likely to vanish seconds later.

Large visible orders can influence short-term trading decisions even if they never execute. Traders may lower bids, sell to avoid an expected drop or place protective orders closer to the market when they believe substantial selling pressure is building. If the apparent supply is withdrawn and the market rebounds, the account that bought during the decline may benefit from the temporary shift in sentiment and liquidity.

The case also illustrates a limitation of treating displayed order-book depth as a straightforward measure of market interest. Depth is useful when orders remain available for execution. It becomes less reliable when large orders are repeatedly canceled before they can trade.

Spoofing rules vary across market structures

In U.S. futures markets, spoofing is prohibited under the Commodity Exchange Act. Enforcement cases typically focus on whether an order was placed with the intent to cancel it before execution and whether the conduct was intended to mislead other market participants.

Determining intent remains difficult, especially in fast markets where automated systems may cancel orders rapidly for legitimate reasons. Regulators and surveillance teams therefore usually assess patterns across many orders rather than treating rapid cancellation alone as conclusive.

Decentralized perpetual-futures venues operate through a different enforcement structure. Trading interfaces, market designs and risk controls can vary by protocol, while on-chain transparency gives independent firms and users more ability to examine activity directly. The trade-off is that public visibility does not necessarily provide a real-time remedy for participants who react to misleading liquidity before it disappears.

Hyperliquids scale raises the practical stakes of those distinctions. The platform processed about $633 billion in trades during the first quarter of 2026, according to figures provided in the source material, while daily volume has frequently exceeded $8 billion. High-volume markets attract more sophisticated automated trading strategies and make reliable liquidity signals increasingly valuable.

Order-book signals require greater caution

For traders using leveraged Brent or other perpetual contracts, the Solidus Labs findings are a reminder that visible size should be weighed alongside execution history. A large wall that repeatedly follows the market, disappears before being filled and reappears at new levels may carry less information than steady orders that remain available through changing prices.

Wallet-level data can help users examine whether large quoted orders have a history of being canceled. Third-party analytics tools may also be able to identify clusters of orders placed across adjacent price levels, a tactic that can make a market appear deeper than it is.

Risk controls remain especially relevant during abrupt moves. Traders relying on highly leveraged positions can be vulnerable when apparent support or resistance evaporates, leaving prices to move through thin liquidity. Entering positions solely because of a sudden order-book imbalance can expose participants to precisely the type of reversal described in the March activity.

The March Brent episode does not establish that every large cancellation on Hyperliquid is manipulative. It does show that publicly auditable markets can reveal patterns resembling traditional order-book abuse, placing greater pressure on traders and protocol operators to distinguish executable liquidity from temporary signals.