Papertrade's $1.28M BBO Manipulation: $3 ETH Pushes Against a 1,000x Venue

TL;DR

On October 10, 2026, within eight hours of Papertrade going live on HyperEVM, one wallet netted about $1.28 million from the venue's pool by moving Hyperliquid's ETH price roughly $3 at a time while holding far larger Papertrade positions on the other side, according to The Block's review of the wallet's trades. Papertrade offers 1,000x and prices every open and close at the midpoint of Hyperliquid's best bid and offer, with no independent price to check it against. At the venue's 1,000x maximum, a 0.12% move is more than the whole margin. Papertrade says the exposure caps were deliberately loose for launch and is tightening them; it has announced no change to the pricing itself. The venue's price could be bought for an evening of taker fees, about $52,000, and its caps let one account stack $10 million positions into hundreds of millions of exposure on it.

What Happened at Papertrade?

Papertrade is a synthetic perpetuals exchange that runs on HyperEVM, Hyperliquid's smart contract layer. Its launch post set trading live at 14:00 UTC on October 10, right after a scheduled network upgrade, and published the risk parameters this story turns on. Crypto Briefing reported more than $137 million in pre-deposits from over 11,000 addresses and $14.4 billion of notional volume inside the first ten minutes.

There is no order book. Every trade is a synthetic swap against a single pool, the Martingaler LP, which starts empty and grows only from traders' losses. Losers are paid in PAPER, a token whose stakers earn USDC from the venue. Winners are paid from the pool, and when the pool is short, their payout waits in a queue.

At 22:22 UTC that evening, a trader posting as Boblob flagged that Papertrade was "getting actively exploited by two wallets moving ETH 10-20bps on hyperliquid using $20m clips" while holding nine-figure longs on Papertrade. Early the next morning, the trader butler published the address, 0x2025137a136bea7446deba681cbfc7cf1970840e, and a trade-by-trade breakdown. The Block then reconstructed the evening from Hyperliquid trade data and Papertrade's own account records. Boblob's first flag described two wallets; only one address, 0x2025, has been named and traced, so every figure below is for that wallet alone.

Papertrade disputes the word "exploit". Its response on October 11 called the activity "manipulation attempts" that "were not an oversight in the mechanism design we spent six months working on". We call it manipulation of an oracle the venue knew was weak. Every trade settled as written, and the money still came out of a pool filled by other users' losses.

How Does Papertrade Price a Trade?

A best bid and offer (BBO) is the top of an order book: the highest resting buy and the lowest resting sell. Its midpoint is a fair snapshot of the price at one instant, as long as nobody is pushing on it. Push on it with size and the snapshot moves with you.

Crypto.news, working from Papertrade's documentation, describes the whole pricing stack: the contract reads the midpoint of Hyperliquid's best bid and best offer, records it as your entry, and settles the position against the liquidity pool at the midpoint it reads when you close. It offers up to 1,000x on BTC and ETH, without slippage or funding, subject to per-market open-interest limits.

The risk was written down before launch. Crypto.news reports that Papertrade's published risk disclosures identify manipulation of the best bid and offer as an unresolved concern: a trader can shift the midpoint by posting a new best bid or offer, even one that never fills, and the contract accepts the resulting price without an independent check. Papertrade does not use the oracle and mark prices Hyperliquid itself relies on for margin and liquidations.

Hyperliquid's own oracle and mark prices are built from a weighted median of external exchange prices, published by validators about every three seconds, with exponential moving averages folded into the mark. To move those you would have to move several exchanges at once. In this incident the BBO needed one book and about a minute of buying.

The friction Papertrade did build is small. The launch post lists a profit deadman of 0.2 basis points. The pushes here were about 12 basis points, roughly sixty times that.

The Attack, Step by Step

Times are UTC on October 10 and 11. Butler's breakdown documents one representative cycle from 22:01; the ledger below shows the loop had started about an hour earlier. The evening totals and the final short come from The Block.

Butler put gross PnL from the loop at $1.73 million; the $450,000 liquidation took it to $1.28 million.

At an ETH price near $2,507, a $3 move is about 0.12%. On $200 million of notional that is about $240,000 gross, and butler's ledger shows $168,000 booked. The short leg is the same story: about $191,000 of raw move on $160 million, $97,000 booked. Both legs land well under the arithmetic. Papertrade's launch post publishes its asymmetric profit fee parameters and says the curve is inherited from Rollbit's, but nobody has published the per-trade deduction, so read these economics as butler's ledger.

What Did the Manipulation Cost, and What Did It Pay?

The trade was cheap to run. The Block counted about $231 million of ETH traded on Hyperliquid that evening for about $52,000 in fees. Against that, the wallet's Papertrade account shows $1.28 million of profit on $3.18 billion of volume, about $2.48 million withdrawn against roughly $1.2 million deposited, and a $1.54 million withdrawal at 22:06 UTC.

We pulled the same wallet's fills from Hyperliquid's public info endpoint (userFillsByTime for 0x2025...840e, October 10 12:00 to October 11 06:00 UTC) to check the reconstruction. The cycle sizes reconcile: 6,058 ETH bought across 22:01 and 22:02 with the fill price walking from $2,506.70 to $2,509.50, then exactly 5,210 ETH sold at 22:03, which is The Block's figure (butler's 5,260 appears to fold in adjacent fills). The 23:13 to 23:15 dump comes to 6,593 ETH with a floor of $2,504.40. Our day total, about $224 million and $50,000 of fees, sits a few percent under The Block's, so we treat theirs as the headline.

The wallet's ledger, from the same endpoint's userNonFundingLedgerUpdates query, matches The Block's account figures and fixes the timeline. Four transfers into its Papertrade deposit address (0xa6a5...2ce4) total $1.2 million, but only $100,000 of it had arrived before 22:06. Five transfers back out of Papertrade total about $2.48 million, and the first two came at 21:13 ($17,961) and 21:34 ($131,739), before the 22:01 cycle butler documents. The fills agree: the same alternating multi-thousand-ETH bursts run from 21:06. By 22:06 the account had taken out about $1.69 million against $100,000 in. The loop started around 21:06, and most of the money that left Papertrade had left within the hour. The ledger shows no mixer deposits, and one of the two largest later sends, $500,000, went back to an address that had funded the wallet hours earlier.

Roughly $52,000 of fees on the reference book bought $1.28 million from the pool, a return of about 25 to 1 before the trader's own spread losses on Hyperliquid. Crypto Briefing put the pool at about $3.15 million shortly after launch, and Papertrade said it held about $5 million a day later. Against either number, one wallet took a quarter or more of it.

The trader was no newcomer. The Block traced the address to about $14.2 billion of lifetime Hyperliquid volume and $13.1 million of profit since February 2025.

Why Did the Loop Stop?

Butler guessed that "the team blocked 0x2025's closes to stop the attack", since the 23:13 short could not be closed at the pushed price and sat open for more than three hours until it was liquidated. Papertrade's statement gives a different mechanism: the launch queue "provided a natural protection against manipulation as confirming opens/closes had non-deterministic timing", and as congestion eased the team "began the process of tightening up oi caps both onchain and at the relayer level". That last short was funded fresh: $500,000 went into the deposit address at 23:06, seven minutes before it opened, and $297 million at 660x needs about $450,000 of margin. The liquidation took exactly that. Whether the close stalled in the queue or was held back by the team, no published on-chain evidence settles it.

Papertrade described its caps this way: they were "extremely permissive for launch congestion", because "any oi cap during the queued launch demand would have exacerbated the slow experience". The launch post gives the numbers. Each position was limited to $10 million, with no limit on how many a user could hold, and floating OI headroom was set at $1 billion per market side. The 23:13 short squares with that: 30 positions totalling about $297 million, each just under the per-position limit.

Papertrade also says the trader "continued to try again, ultimately donating almost all his profit back to the house via new accounts", and that several users agreed to "undo" manipulated trades in exchange for keeping their farmed PAPER. FinanceFeeds and The Block both note that the return could not be verified, and the original wallet's withdrawals still exceed its deposits. So the clawback stays Papertrade's unverified claim, and $1.28 million stays the on-record figure for the one address anyone has named.

The Block reports that the $450,000 liquidation minted about 17.6 million PAPER, and Papertrade pays PAPER to the trader who takes the loss. The failed final leg of the manipulation earned its author the venue's own reward token.

Is This Mango Markets Again?

On October 11, 2022, according to the CFTC's complaint, Avraham Eisenberg built large positions in a MNGO swap on Mango Markets, bought MNGO on the exchanges that fed Mango's oracle until the reported price jumped more than 13-fold in 30 minutes, then borrowed against the inflated positions and withdrew over $110 million. The CFTC called it the first enforcement action it had brought over "oracle manipulation".

Papertrade's reference market was ETH, one of the deepest books on Hyperliquid, so the push was $3 where Mango's was 13-fold. The amplifier was 1,000x positions instead of a collateral loan. And the oracle was a single venue's top of book, which made the push cheaper. It happened four years less a day after Mango.

We covered the lending-market version of the pattern in Tectonic's $75M TONIC collateral manipulation and the general class in reserve manipulation isn't dead.

Why This Keeps Happening

Papertrade's statement frames it this way: "in a system like this, a manipulation attack is always possible, whether economically advantageous to attempt is the question."

The cost to move the price was set by Hyperliquid's ETH book depth. The payout was set by Papertrade's position caps. Nothing in the contract compared them. When the caps let one account hold $200 million, a single $3 push paid $168,000.

An oracle review would have reported this, and Papertrade's own risk disclosures already did. The design had already accepted the risk and left the bound to a parameter. We saw a configuration gap of the same kind in the Aave oracle parameter incident.

The loop ran for about an hour, and its traces sat in Papertrade's own state: positions as large as $200 million against a pool Crypto Briefing put at about $3.15 million shortly after launch and Papertrade at about $5 million a day later, then a single $1.54 million withdrawal at 22:06. Both fit the shape of a pool invariant: the pool never pays out more than a set share of its balance in one transaction, and open interest on one market never grows past a set multiple of the pool. An alert does not stop a cycle in flight, and a pause needs a granted role: the launch post describes a guardian 2-of-3 multisig that can pause opens and freeze markets, and Papertrade would have to give a pause-only key that power. Tripwire checks rules like these on every block and pending transaction, alerts the team, and with that role can pause the contract on-chain. Fired on the first oversized position, it puts the freeze in front of the signers while the loop is still running.

What Operators Should Do This Week

1. Price against a reference you cannot rent. If you read a single venue's BBO, also read a slower, multi-venue price (on Hyperliquid, the validator oracle or mark) and reject any execution whose mid deviates past a threshold you can defend in writing.
2. Size caps to the cost of moving the reference. For each market, estimate what it costs to push the reference mid by your deadband and by ten times your deadband. Cap per-account and per-side notional so that the payout at your maximum multiplier stays below that cost.
3. Cap exposure relative to the pool. A position whose 0.1% move exceeds a few percent of LP equity is a solvency event in waiting. Make that ratio an on-chain check.
4. Add a time dimension to small wins. A minimum hold, a TWAP close, or a lookback check makes a one-minute push carry real market risk.
5. Wire your levers to rules before launch day. Papertrade had a guardian that could freeze markets; the account still drew most of its money out inside an hour. Write the triggers (one account's open exposure against the pool, a single withdrawal against pool balance) before the queue opens, and test that they fire.

Frequently Asked Questions

Was Papertrade hacked?

No. Every trade settled the way the contract was written to settle it. The trader moved the price the contract reads, which coverage of the incident calls oracle manipulation, and Papertrade calls "manipulation attempts" that its design anticipated.

How much did the Papertrade manipulation cost the pool?

About $1.28 million, the named wallet's net profit after a $450,000 liquidation. Papertrade says most of it came back through new accounts; nobody has verified that.

Is Papertrade still exposed to BBO manipulation?

Yes, by its own account. Papertrade's statement says "a manipulation attack is always possible", and it has announced no change to the BBO-mid pricing itself. What changed is the OI caps, which Papertrade says it is tightening on-chain and at the relayer.

Would an audit have caught this?

Yes, as a finding. A single-venue price with no independent check is a standard oracle-review item, and Papertrade's own risk disclosures already listed it. A finding alone would not have prevented the loss, because Papertrade had accepted the risk. The money went through launch-sized caps with no automated response, which is where parameter review and runtime rules come in.

Sources / References

• The Block: Trader nets $1.28 million on new 1,000x exchange Papertrade by moving Hyperliquid's ETH prices
• butler (@btlrtrades) on X: on-chain breakdown of the 0x2025 wallet
• Papertrade (@papertrade_xyz) on X: response to the manipulation attempts
• Papertrade (@papertrade_xyz) on X: launch timing and details
• Boblob (@Dr_bobo54) on X: first public flag
• Crypto Briefing: Papertrade faces oracle manipulation allegation as its loss-funded pool shows $3M
• crypto.news: Hyperliquid ETH trades raise concerns: Was Papertrade exploited?
• FinanceFeeds: Papertrade Faces BBO Price-Manipulation Allegations Following HyperEVM Launch
• Hyperliquid Docs: price indices
• Hyperliquid Docs: Info endpoint
• CFTC: CFTC Charges Avraham Eisenberg with Manipulative and Deceptive Scheme to Misappropriate Over $110 million from Mango Markets, a Digital Asset Exchange