Papertrade faces oracle manipulation claim on HyperEVM

Crypto NewsBearish for crypto

Papertrade faces oracle manipulation claim on HyperEVM

By the ParadiseTeam10 min read
Papertrade faces oracle manipulation claim on HyperEVM

Table of Contents

Papertrade faces oracle manipulation claim on HyperEVM

Listen: the breakdown

Update on this developing report (October 12, 2026, 13:17 UTC):

GoPlus Security: Breakdown: Papertrade BBO oracle manipulation – ~$1.28M taken 8 hours after launch

On Oct 10, 2026, HyperEVM perp venue went live, with $85.3M in pre-deposits and TVL reaching $118M within 24 hours. About 8 hours after launch it was hit by an oracle manipulation attack. Loss: ~$1.28M.

This was a cross-market oracle and quote-manipulation incident. The suspected attacker first opened oversized synthetic longs and shorts on Papertrade, then used real capital to buy and sell ETH on Hyperliquid, briefly displacing Hyperliquid’s BBO mid. That displaced mid was then used for execution and PnL on Papertrade. The resulting PnL was paid by the Martingaler LP.

Root cause

1. Instant BBO from one market was the oracle

Opens and closes both read the Hyperliquid best-bid/ask mid directly. The official docs explicitly state there is no max-deviation cap, no TWAP, no lookback, and no independent reference price. A non-zero, non-crossed BBO could therefore be accepted even if it had been manipulated. Papertrade’s own risk docs identified “Hyperliquid BBO manipulation” as a major protocol-level risk before launch: https://docs.papertrade.xyz/#/how/pricing-bbo

2. 1,000x leverage turned a tiny move into a large payout

On hundreds of millions in notional, pushing ETH ~10-14 bps was enough to generate hundreds of thousands of dollars in Papertrade PnL. Trading loss on the external venue was far smaller than the synthetic PnL paid by the LP.

3. The per-position cap was bypassed by splitting

The per-position notional cap was ~$10M. The final $297M short was split into 30 positions of ~$9.9M each, just under the limit. Directional OI controls still left ~$1B of headroom, so existing controls did not meaningfully constrain aggregate exposure in this case.

4. LP capital did not match the exposure

The Martingaler LP is the sole counterparty, and its pool is largely built from trader losses. Public data showed ~$3.14M in LP against hundreds of millions in notional, up to 1,000x. Available LP capital was severely mismatched with the potential payout.

Attack flow

1. Displace the upstream BBO

The suspected manipulator executed concentrated buying and selling on Hyperliquid, moving the ETH perp’s best bid and ask. Papertrade used that mid as its execution price, so the distorted BBO mid fed directly into Papertrade’s pricing. This activity occurred on HyperCore’s order book and does not map to a single HyperEVM transaction hash.

2. Open the first high-leverage positions

Once the upstream BBO had shifted, the suspected manipulator submitted signed orders to the Papertrade relayer. The relayer then called the Exchange contract to open the positions.

https://hyperscan.com/tx/0x199de70bc0527b0a3bec7d2c3da9d284e7e401bacd00fa75ce8e9ba5fcc40c5d

The relayer appearing in the `from` field should not, by itself, be treated as the attacker.

3. Split positions to bypass the per-position cap

The per-position notional cap was ~$10M. The suspected attacker split the exposure into ~30 positions of ~$9.9M each, for total exposure far above the single-position limit. Batch that appears to include ~30 shorts:

https://hyperscan.com/tx/0xfad8681101614762ed5ee3dfb94feac28300f6943def595acc2f1fad91807bd3

4. Trade the other way and close in profit

After the Papertrade positions were in place, the suspected manipulator traded in the opposite direction on Hyperliquid so the BBO moved in favor of those positions. With no TWAP, no max deviation, and no lookback, the distorted mid was used directly to close the positions and calculate PnL.

5. Position termination path

About 30 related positions were subsequently terminated. This transaction appears to correspond to the batch termination or suspected liquidation path:

https://hyperscan.com/tx/0x2a337b31c935ceb52e01ef18cc2d45248bb601d5dcecc3c42edc5c13905eb7d4

Addresses

Suspected attack / manipulation

https://hyperevmscan.io/address/0x2025137a136bea7446deba681cbfc7cf1970840e

Funds receiver / suspected coordinating address

https://hyperevmscan.io/address/0x7e4e766d0ae5ea9cded0c694669194db92800107

Final suspected liquidation caller

https://hyperscan.com/address/0x07626d8137ede6b922bcecf3b67f82a21100a612

Papertrade trading / settlement contract

https://hyperevmscan.io/address/0x6cd5661646289fb6e65ea5c032310fded797d0a2

Security recommendations

Simply blocking the suspected attacker address does not address the root cause.

1. Stop using an instant BBO as the only settlement price.

2. Use Hyperliquid’s multi-venue weighted oracle or mark price as a reference, plus TWAP, deviation limits, and freshness checks. Official oracle docs: https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/oracle

3. Bind total OI, per-address OI, and max payable PnL to LP capital that is actually available.

4. Trigger circuit breakers on rapid long/short reversals by the same address, large trades on external markets, and anomalously high win rates.

Developing story: This story is still unfolding. We are tracking it and will update this article as more details are confirmed.

Market briefing: Papertrade, a HyperEVM perps exchange, faces an oracle manipulation claim after wallets allegedly nudged ETH quotes to fund massive 1000x longs. ETH barely moved near $2,497 and Bitcoin held near $82,907.

  • Two wallets allegedly used roughly $20M in Hyperliquid orders to move ETH quotes by 10 to 20 basis points.
  • Papertrade reads Hyperliquid's BBO to price trades, and its own documentation disclosed the pricing vulnerability.
  • ETH barely moved near $2,497 while Papertrade's loss-funded pool sits near $3.15M.

Papertrade, a 1000x perps exchange on HyperEVM, faces an oracle manipulation claim that turned a tiny quote shift into huge leveraged longs. Is capital on 1000x perps ever truly safe?

A perpetuals exchange built for 1000x leverage now faces a question no risk disclosure wants to answer. Papertrade, which runs on HyperEVM, stands accused of an oracle manipulation exploit. The claim surfaced from a single trader, and it points straight at the plumbing beneath the platform.

Here is the alleged mechanism. Two wallets placed roughly $20 million in orders on Hyperliquid. Those orders nudged ETH quotes by 10 to 20 basis points. Papertrade reads Hyperliquid's order book to price its own trades, so a small shove in the quote became a large swing in position value. The same wallets allegedly held 9-figure long positions on Papertrade at the time.

The leverage is the whole point. A 1000x product turns a 10 basis point wobble into a violent move on paper. Small cause, enormous effect.

Papertrade's own documentation reportedly flagged this risk. It described a vulnerability in its protocol-level pricing, tied to manipulation of Hyperliquid's BBO, the best bid and offer. A disclosed risk is not the same as a safe one.

The platform's loss-funded pool sits near $3.15 million. That number matters, because it is the buffer standing between an exploit and user losses. ETH barely moved on the news, trading near $2,497, and Bitcoin held around $82,907. The wider market shrugged. That calm is not comfort. It is a market that has not yet decided this matters.

Remove Ads
Live BTC/USDT chartinteractive

A pricing feed built on thin liquidity

Oracle manipulation is the oldest attack in DeFi, dressed in new clothing. The mechanism never changes. A protocol trusts an external price feed, and an attacker rents that feed for a moment.

Papertrade's design makes the attack cheap. It borrows Hyperliquid's order book as its source of truth. On a thin book, $20 million is enough to tilt a quote. On a 1000x product, that tilt is leveraged into a payout. The attacker pays for order flow, not for the position's real risk.

This is why the story can travel beyond one platform. HyperEVM hosts a growing cluster of protocols that lean on Hyperliquid pricing. Each one that reads the same book inherits the same weakness. A single manipulable feed becomes a shared fault line.

The broader lesson is about trust, not price. DeFi sells itself as trustless, yet most perps exchanges quietly trust one order book to tell them what things are worth. That trust holds until someone with capital tests it.

Papertrade disclosed the risk in its own documents, which is honest and also damning. A known vulnerability that ships anyway is a decision, not an accident. Users were told the door had a weak lock.

Remove Ads

For the wider ecosystem, this reads as a reminder rather than a rupture. The $3.15 million pool caps the direct damage. The reputational damage to high-leverage perps is harder to size.

Contained damage but a slow trust leak

Start with what did not happen. ETH did not sell off. It sat near $2,497, up a fraction on the day. Bitcoin held near $82,907. No liquidity cascade reached the majors.

That absence tells its own story. The exploit is protocol-specific, so it drained no broad liquidity. It threatened Papertrade's pool, not ETH's order books. The market treated it as a local fire, not a system alarm.

Still, the directional pull here is negative, and it works through trust rather than flows. Every oracle exploit chips at confidence in on-chain leverage. Capital that fears manipulation sits out, and thinner participation makes the next shove easier. That is the quiet bearish loop.

For BTC, the read-through is indirect. Bitcoin rarely trades on one perps platform's trouble. But sentiment around high-leverage DeFi feeds the risk appetite that supports alts.

Remove Ads

ETH feels it more directly, because the alleged manipulation targeted ETH quotes. The move was engineered, not organic, so it says nothing about real ETH demand.

Alts tied to HyperEVM carry the sharpest risk. Tokens of protocols that share Hyperliquid's pricing could reprice if traders start to question their feeds. Liquidity there is thin, and fear travels fast through thin books. The majors absorb the news. The edges of the market are where it stings.

Signals that turn a claim into contagion

The first thing to watch is Papertrade's loss-funded pool. It sits near $3.15 million today. If that buffer shrinks fast, the exploit was real and costly. If it holds, the claim may be smaller than it sounds.

Watch for an official response next. A credible fix to the pricing mechanism would confirm the vulnerability and start to close it. Silence, or a vague statement, would keep the risk open and the fear alive.

The on-chain trail is the hard evidence. The allegation names roughly $20 million in Hyperliquid orders and 9-figure longs. Those positions either exist in the data or they do not. Confirmation lives on the ledger, not in a thread.

A key invalidation would be proof that the quote moves were normal market flow, not a deliberate shove. Ten to twenty basis points is small. On a busy day, that noise is ordinary.

Watch whether other HyperEVM protocols react. If several harden their oracles at once, the market is treating this as systemic. If none move, it stays a Papertrade problem.

Finally, watch ETH's structure for any second-order stress. So far there is none. ETH near $2,497 shows no sign the broader market cares. A sudden change in that calm, without a macro trigger, would be the tell that this story grew teeth while everyone looked away.

Reading protocol risk against a bullish tape

The ParadiseTeam frames this as a protocol story, not a market story. Nothing in it changes Bitcoin's structure. BTC traded near $82,907 as of 10:38 UTC, still pressed under the $83,400 level that has capped recent attempts.

That backdrop matters for how traders weigh the news. Our standing read sees smart money accumulating around the $81,000 to $81,500 support, absorbing fearful selling. A single DeFi exploit does not break that picture. It is noise against a constructive tape.

Where the story does bite is positioning in high-leverage perps. The ParadiseTeam treats 1000x products as a different risk universe from spot or modest leverage. When the price feed itself can be rented for $20 million, the real danger is not the market. It is the mechanism.

So the practical read is about where capital sits, not a level to chase. Exposure on platforms that share one manipulable oracle carries a hidden tail risk. That risk stays invisible until it is not.

For BTC itself, the levels still rule. A hold above $81,500 keeps the accumulation thesis alive, and a clean break over $83,400 opens room toward $90,000. This Papertrade claim lives outside that map. Traders who confuse a protocol scare with a macro signal tend to sell strength that smart money is quietly buying.

The read behind this: we framed this story through our own market analysis, Bitcoin Miner Moves $81M: Is $44K Next?

Track it live: our live crypto funding rates and the Crypto Fear and Greed Index both update in real time, so you can watch this shift for yourself.

Related coverage

For exact entries, targets, and stop losses with full risk management, that is what ParadiseFamilyVIP is for. New to reading these moves? Start with our crypto trading strategies guide.

ParadiseTeam is monitoring the market situation closely, and we are taking these developments into consideration while building our trading tactics inside ParadiseFamilyVIP.

Crypto trading involves substantial risk. Prices are volatile and you can lose money. This article is educational and is not financial advice. Past performance does not guarantee future results.

Paradisers' Poll

Does the Papertrade oracle claim spread to other HyperEVM perps?

How 14 Paradisers are calling it

The first call is still open

Join the discussion 7

Nadia Haddad
Nadia HaddadActive Paradiser· Oct 14, 2026

Feels like everyone's still focusing on the 'oracle manipulation' angle... but the ETH liquidity drain around those positions is probably the bigger tell for how this plays out.

Carlos Mendes
Carlos MendesActive ParadiserZone Mapper· Oct 13, 2026

Ahhh, oracle attacks 😫 what a classic! 📉 I almost got rekt by one on a farm in '21, thank god I pulled some. Lucky escape, eh Ben? 😂

Ben Carter
Ben CarterPro ParadiserActive Paradiser· Oct 11, 2026

The oracle manipulation here is unfortunate but not surprising on these platforms. Sticking to sats remains the sensible approach.

Diego Fernandez
Diego FernandezActive ParadiserRisk First· Oct 11, 2026

Oracle manipulation for 1000x longs.. feels a bit like those currency controls moving exchange rates. Someone always benefits from the "official" price.

Aisha Bello
Aisha BelloActive ParadiserZone Mapper· Oct 13, 2026

Makes me remember those wild 2021 alt spikes 📈 when I thought I was seeing things on the 1m. Always check the oracle, abi? 👀🤦🏽‍♀️