How a Wallet Extracted $1.28M from a 1000x Leverage Perp Venue in One Afternoon

On October 10, 2026, a new perpetuals exchange called Papertrade went live on HyperEVM, the smart contract layer of Hyperliquid. It offered up to 1,000x leverage. Within hours, a single wallet had extracted $1.28 million in profit by moving ETH prices on Hyperliquid itself. The exploit was possible because Papertrade priced every trade at the midpoint of Hyperliquid's best bid and offer, and because its launch-period open interest caps were set loosely.

This is a case study in oracle manipulation risk. It shows how a venue that relies on an external price feed can be gamed by a trader with enough capital to move that feed. It also shows why position limits and OI caps matter, and what happens when they are set wrong.

The setup #

Papertrade is built on Hyperliquid's blockchain but operates as a separate perp venue. It takes the other side of each position through a shared USDC pool funded by trader losses. Losing traders earn the protocol's PAPER token. The venue prices every trade at the midpoint of Hyperliquid's current best bid and offer.

This pricing model is efficient under normal conditions. It means Papertrade does not need to maintain its own order book or liquidity. But it also means the venue has no independent price discovery. It trusts Hyperliquid's order book completely.

At 1,000x leverage, a 0.1% price move equals the full margin on a position. A trader who can move the reference price by 0.1% can double their money. A trader who can move it by 1% can make a 10x return. The leverage amplifies both directions.

the exploit #

The wallet, identified as 0x2025...840e, repeatedly opened large positions on Papertrade, then bought or sold thousands of ETH on Hyperliquid to move that reference price, before closing. According to The Block's analysis of Hyperliquid and Papertrade data:

• At 6:01 p.m. ET, it bought about 6,060 ETH on Hyperliquid as the price rose roughly $3, or 0.12%.
• At 6:03 p.m., it sold about 5,210 ETH and the price fell about $3.50.
• The wallet traded about $231 million worth of ETH on Hyperliquid on Saturday evening and paid roughly $52,000 in trading fees.
• Papertrade's portfolio page for the wallet shows $1.28 million in profit on $3.18 billion in volume.
• The wallet withdrew about $2.48 million from Papertrade on Saturday against $1.2 million in deposits, including a single $1.54 million withdrawal at 6:06 p.m. ET.

Later, at 7:13 p.m. ET, the wallet opened 30 ETH shorts at 660x leverage with a combined notional value of $297 million, then sold about 6,590 ETH on Hyperliquid over the next three minutes, pushing the price down to $2,504.40. Those shorts stayed open for more than three hours and were liquidated at 10:31 p.m. ET at $2,509.95, for a loss of $450,000. Those losses minted about 17.6 million PAPER to the wallet, according to Papertrade's interface.

Over its lifetime, the wallet has logged about $14.2 billion in volume and $13.1 million in profit on Hyperliquid, according to Hyperliquid data. It began trading on Hyperliquid in February 2025 with about $2 million in deposits.

The response #

Papertrade said on Sunday it is tightening limits on open positions in response to the trades, first flagged by X users. The venue said the trader who profited overnight later gave almost all of the gains back to its pool through new accounts. It also said some users agreed to reverse manipulated trades in exchange for keeping the PAPER they had earned.

The Block could not verify either claim. The 0x2025 wallet's withdrawals from Papertrade still exceed its deposits by about $1.28 million, according to Papertrade's records.

Why this matters for onchain perps #

This exploit exposes a structural risk in perp venues that rely on external price feeds. Hyperliquid is the largest on-chain perp venue by open interest. As of October 13, 2026, it processed $7.75 billion in 24-hour perp volume across 234 assets with quotes, according to Hyperliquid's public API. ETH alone accounted for $1.47 billion of that volume.

The same order book that provides liquidity for legitimate traders also provides the price feed for venues built on top of it. A trader with enough capital can move that feed and profit from any venue that trusts it.

JW3.ai integrates five on-chain perp venues: dYdX, Hyperliquid, Polymarket, Aster, and Pacifica. None of these venues is immune to oracle manipulation. The risk is structural, not a bug that can be patched.

What to watch #

• OI caps. Papertrade's loose launch-period caps allowed the wallet to build positions far larger than the shared pool could absorb. Tighter caps reduce the maximum extractable value but also limit legitimate traders.
• Price feed diversification. A venue that prices from a single external source is vulnerable to manipulation of that source. Venues that aggregate multiple price feeds or use their own order book are harder to game.
• Leverage and liquidation. At 1,000x leverage, a 0.1% adverse move wipes out the full margin. The wallet's 660x shorts were liquidated when the price moved against it by less than 0.3%. Leverage amplifies both profit and loss.
• Shared pool risk. Papertrade's model means one trader's profit comes directly from the pool funded by other traders' losses. A single exploiter can drain a significant portion of that pool.

The bottom line #

The Papertrade exploit is a live demonstration of oracle manipulation risk. It shows how a venue that prices from an external source can be gamed by a trader with enough capital to move that source. It shows why position limits and OI caps matter. And it shows that leverage amplifies both directions.

For traders using on-chain perp venues, the lesson is simple: understand where the price comes from, know the venue's risk controls, and size positions accordingly. The venue's design choices create attack surfaces. Trade with that in mind.

Cryptocurrency trading, leveraged perpetual futures, and automated algorithmic strategies carry significant risk of rapid and total financial loss. Never risk funds you cannot afford to lose completely.

Sources:

• The Block: Trader nets $1.28 million on new 1,000x exchange Papertrade (published October 11, 2026; fetched October 13, 2026)
• Hyperliquid public API: metaAndAssetCtxs (fetched October 13, 2026)