OAK — OnChain Attack Knowledge

Worked example · 2025-03

Hyperliquid Whale — Illicit Trading via Highly Leveraged Positions — 2025-03

Loss
~$20M profit by alleged threat actor via highly leveraged positions on Hyperliquid (decentralized perpetuals exchange). Profit was extracted from the Hyperliquid liquidity pool, not directly from individual counterparties.
OAK Techniques observed
none for the trading conduct — the file establishes no manipulation primitive. What is documented is outlier-leverage position-taking (3–5× platform average) that profited when the market moved; the file itself concedes the activity may be "aggressive trading" rather than manipulation, attribution is inferred-weak, and the subject denies involvement. No T17.* fits: no spoofing or cancel-flood (T17.003), no engineered liquidation cascade (T17.002), no cross-venue spread manufacture (T17.001), no oracle manipulation (T9.001). OAK-T8.001 (Common-Funder Cluster Reuse) — attribution mechanism only; multiple accounts with correlated leverage patterns funded from one source. Candidate gap: outlier-leverage position-taking on a permissionless perp DEX with alleged information advantage, where the LP pool rather than an identifiable counterparty absorbs the loss.
Attribution
inferred-weak — ZachXBT investigated the alleged identity of the whale. Suspect identified as William Parker (WP/AP), a UK-based trader with prior fraud convictions. Suspect denies involvement.
Key teaching point
The Hyperliquid whale case demonstrates the illicit position engineering pattern on decentralized leverage platforms: a trader uses multiple accounts to build highly leveraged positions, profits when the market moves in their favor, and the profit is effectively extracted from the protocol's liquidity pool (not from identifiable counterparties). The detection approach is: identify accounts that (1) take outlier-leverage positions relative to market norms, (2) are linked on-chain to known threat actor clusters, and (3) exhibit sudden profit extraction followed by immediate withdrawal.

Summary

In early 2025, a mysterious trader ("Hyperliquid whale") profited ~$20M through highly leveraged positions on Hyperliquid, a decentralized perpetuals exchange. The positions were large enough to move the platform's liquidity pool, and the profit extraction pattern was anomalous: the trader took positions that were outliers in both size and leverage ratio relative to all other market participants.

ZachXBT investigated the alleged identity, tracing on-chain activity to William Parker (WP/AP), a UK-based individual with prior fraud convictions who had previously served time. The investigation revealed that the suspected address held large positions that benefited from market movements in ways consistent with insider knowledge or market manipulation.

The case raised significant community debate about: (1) whether taking large leveraged positions on a decentralized exchange constitutes "illicit activity" vs. aggressive trading, (2) the lack of KYC on decentralized leverage platforms, and (3) the vulnerability of liquidity pools to extraction by whales with superior capital or information.

Timeline

When Event OAK ref
Early 2025 Trader opens highly leveraged positions on Hyperliquid across multiple accounts T12 position engineering
2025-02~03 Positions profit ~$20M as market moves. Profit extracted from Hyperliquid liquidity pool T12 profit extraction
2025-03 ZachXBT traces on-chain activity to wallet cluster linked to William Parker (WP/AP). Investigation published (attribution)
Post-Mar 2025 Subject denies involvement. Funds remain in identified addresses (disputed)

What defenders observed

  • Outlier leverage ratios: The whale's positions used leverage ratios that were 3-5x the platform average, making the positions identifiable in the leverage distribution.
  • Multi-account clustering: Multiple accounts with similar leverage patterns were funded from the same source — classic insider/wash-trading wallet clustering.
  • Rapid withdrawal after profit: Profits were withdrawn to cold storage immediately after position close, not reinvested — profit extraction behavior.
  • Prior fraud history: The suspected individual had prior convictions for fraud, a relevant attribution signal.

What this example tells contributors

  • Leverage outlier detection is a T12 signal. Positions with leverage ratios >3σ from the platform mean, combined with multi-account clustering from common funding, are the detection signature for illicit position engineering on decentralized leverage platforms.
  • Decentralized leverage platforms create unique T12 surfaces. Unlike centralized exchanges (which can freeze accounts), DEX leverage platforms cannot prevent profitable position extraction by whales. The protocol's liquidity pool is the victim, not individual traders.
  • The boundary between "aggressive trading" and "illicit activity" is contested. This case generated significant community debate about whether the trader's activity was criminal or simply aggressive. T12 technique pages should clearly distinguish between provable manipulation (wash trading, spoofing) and outlier position-taking (which may be legal but is a risk signal).

Public references

Techniques demonstrated (1)