Someone placed a large crude oil sell order on Hyperliquid, seemingly preparing to dump, while continuously buying on the other side. Once the trades were completed, those sell orders were withdrawn.

This is the crude oil trading controversy recently reported by Bloomberg.

Market surveillance firm Solidus Labs found that between March 8 and 10 this year, two accounts submitted over $170 million in anomalous orders, profiting about $119,000 over three days. During this period, for every $1 actually traded, approximately $30 in orders on the other side were canceled.

Solidus described this behavior as having characteristics of Spoofing. Spoofing, i.e., fraudulent order placement: displaying large orders to influence others while hiding the actual intended trade on the other side.

Spoofing is certainly illegal, but framing it as a problem unique to Hyperliquid is somewhat unfair.

Address Behavior

Following on-chain records, a set of accounts highly consistent with the report can be identified: the main account 0xc926…98d3, and its sub-account 0x2577…4897. Together, after deducting fees, they earned approximately $119,000 from crude oil trading over these three days.

At the time, Brent prices fell from about $83.06 to $81.42, then quickly rebounded. The main account repeatedly placed sell orders of about $200,000 above the price—just placed, then withdrawn, quotes updated, and re-listed. What watchers saw was a large crude oil sell order constantly sitting above.

Meanwhile, this account was also buying. In the 15 seconds around the sharp drop, the main account actually purchased about $458,000 in crude oil contracts.

The sub-account spread orders across multiple price levels: sell orders above, buy orders below, continuously adjusting with the price. It also bought about $18,000 in contracts during this sharp drop.

In other words, when the large sell orders repeatedly appeared, this group of accounts was buying at the same time. This behavior clearly fits the characteristics of spoofing.

Spoofing Orders

Suppose you are preparing to buy crude oil and see a sell order suddenly appear above the price that is far larger than anyone else's. What would you think?

It is easy to assume that a large holder is eager to sell and that the price will probably fall further. Those who originally wanted to buy decide to wait, and those already holding positions worry about a bigger drop and simply sell first.

If that large sell order was intended to make everyone react this way, the person who placed it has achieved their goal. They have a genuine buy order sitting below that they actually want filled, wait for others to actively sell contracts to them, and once they have bought enough, they cancel the large sell order above.

The sell order pressures the market, while the buy order takes the goods for them.

The same works in reverse. Someone who wants to sell can first place a large buy order to make others think there is capital support below. Some people therefore raise their bids and chase the market to enter, and the person takes the opportunity to sell, then cancels that large buy order.

What spoofing exploits is that people judge from the order book whether others want to buy or sell. Ordinary traders look at large orders, and automated trading programs also adjust quotes based on the thickness of the bid/ask depth. A sufficiently conspicuous order can make many people react at the same time.

The U.S. futures market has explicitly prohibited this type of behavior. The key legal focus is "placing an order with the intent to cancel it before execution in order to mislead the market."

The Old Problem on CEXs

Discussion of spoofing appeared on centralized trading platforms long ago.

In its official website introduction to market manipulation, Kraken directly uses "pressuring the price with a large sell order, buying low, then canceling the sell order" to explain this tactic. It also specifically monitors another practice: spreading orders across several adjacent price levels to make one side of the order book appear unusually thick, creating the impression that a lot of capital is buying or selling.

Over two consecutive weekends this month, these spoofing orders appeared on Kraken. These orders created the impression of sustained buying interest, helping to push prices higher.

For those who believe that "a large buy wall is support," here lies the risk: you decide to buy based on that order, but the person who placed it can withdraw it at any time. You have already executed your trade; they merely changed their quote.

Trading platforms include this type of behavior in their surveillance, and traders constantly discuss how to identify it. Against this backdrop, packaging spoofing orders as a newly emerging problem on on-chain trading platforms is hard to believe.

Sometimes, the asset the manipulator actually wants to sell isn't even in the same market.

During weekends with poor liquidity, large players often use spoofing orders in BTC to make BTC's price rise slowly, thereby leveraging algorithmic assistance to pump altcoins and help themselves exit.

A transparent platform becomes a target instead

Hyperliquid has one difference from centralized trading platforms in this matter: orders, cancellations, and trades all have public records.

We were able to find this group of accounts, see where they placed orders, when they withdrew them, and how much they ultimately bought, precisely because this data can be checked by external researchers.

On centralized trading platforms, what ordinary people see is usually just aggregated order book depth. When a buy wall is withdrawn, who placed it? Are the sell orders on the other side from the same person? It is very difficult for external observers to connect these questions.

When anomalous trading is discovered, it should of course be investigated. Platforms should also monitor and address manipulative behavior. But since CEXs face the same type of risk, they should accept the same scrutiny.

Focusing only on Hyperliquid and portraying an old problem that spans multiple trading platforms as its unique flaw is very much like drawing the target around the arrow after it lands.

What should really be asked is how much data each trading platform is willing to disclose and what it does after discovering anomalies. Claiming that whoever's data is easier to check is the biggest problem—such a conclusion is unconvincing.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia