Bloomberg published on October 28, 2026 a survey based on data from Solidus Labs, a company specializing in crypto market monitoring. According to Solidus Labs, two accounts placed and then canceled more than $170 million in orders on Hyperliquid’s Brent perpetual contracts. The sequence took place from March 8 to 10, in the midst of an oil panic around the Strait of Hormuz. The gain would reach $119,000. The accounts are not identified and no intent is proven. However, this suspicion of spoofing falls at the moment when Pump.fun opens the retail floodgates to Hyperliquid.
Spoofing explained simply
To understand the matter, you have to start from the order book. It is the public list of pending buy and sell offers in a market, ordered by price. Traders read it all the time. A large wall of sell orders suggests that the price will fall. Conversely, a big buying wall announces an increase.
Spoofing exploits this reading. The manipulator displays large orders that he has no intention of letting be executed. Let's take a simplified example. Brent is trading at $83 and the spoofer places $10 million in sell orders just above the price. The other traders believe in a selling wave and sell in turn, so that the price slides to 81 dollars. The spoofer then purchases discreetly at this low price. Then he cancels his false orders before they are affected. The wall disappears, the price rises and he sells at a profit.
A variant, layering, layers these false orders on several price levels to make the wall more credible. To spot a spoofer, monitoring companies like Solidus Labs look for three main signals. First, an overwhelming share of canceled orders compared to executed orders. Then, large orders withdrawn just before being hit. Finally, transactions in the opposite direction made at the same time by the same account.
The practice has been illegal in the United States since section 747 of the Dodd-Frank Act of 2010. This text prohibits placing an order “with the intention of canceling it before its execution”. In Europe, the regulation on market abuse, known as MAR, also classifies these false orders as price manipulation.
What Solidus Labs saw in Hyperliquid’s Brent notebook
The playing field also deserves a definition. A perpetual contract is a derivative product with no maturity date. It allows you to bet up or down on Brent with leverage, without ever holding oil. On Hyperliquid, these contracts are traded 24 hours a day in an entirely on-chain order book, visible to everyone.
The scenario described by Bloomberg fits this definition. On March 9, one of the two accounts canceled approximately $17 million in sell orders. At the same time, $425,000 of purchases were being made on the other side of the book, or forty times less. In other words, this account was withdrawing approximately $40 in orders for every $1 actually traded. According to Solidus Labs, the Brent perpetual first slipped from 83.06 to 81.42 dollars in around ten seconds. It then climbed to $87.56 in less than a minute. The same trader also accounted for more than 90% of the cancellations in this market. Over three days, the estimated gain reached $119,000.
These three days are those of the oil frenzy. On March 9, WTI touched $119.48 before falling to $81.19 in the same session. In addition, the daily volume of Hyperliquid oil contracts exceeded $1 billion at the height of the crisis. In such a nervous book, a few million phantom orders are enough to move the price.
Spoofing: what the CFTC should prove
Bloomberg specifies that the identity of the two accounts and their intention have not been established. But intention is the heart of any spoofing case. The CFTC is the American derivatives watchdog. Since its 2013 guidelines, it requires proof that the order was placed with the intention of canceling it before execution. Mere recklessness is not enough. Even in a regulated market, this type of file takes years. As of October 29, no media outlets have reported regulatory action.
The heaviest precedent gives the measure of the risk. In September 2020, JPMorgan agreed to pay $920.2 million to US authorities, according to the CFTC, for hundreds of thousands of fictitious orders placed from 2008 to 2016 on precious metals and Treasury bond futures. “Spoofing is illegal, pure and simple,” summarized Heath Tarbert, president of the CFTC.
Hyperliquid Labs and Trade.xyz refer to blockchain
With Bloomberg, Hyperliquid Labs stuck to one sentence. According to the company, each order, each cancellation and each transaction are recorded in a public and immutable register, which can be consulted by everyone in real time. Trade.xyz, the team that deploys oil markets through HIP-3, says its markets are designed to resist manipulation. The team also provides continuous monitoring and alerts. HIP-3 is a framework launched in October 2025. It allows any team that locks in 500,000 HYPE to create their own perpetual markets and set the rules.
The transparency argument cuts both ways. Public data allowed Solidus Labs to reconstruct the sequence without any privileged access. They would also serve as evidence if the CFTC one day decides to act. On the other hand, blockchain simply records and does not sanction anyone. On a regulated market, the operator detects and transmits to the regulator. On Hyperliquid, it is the HIP-3 deployer which itself sets the rules of the market it monitors.
CME and ICE on the charge while Washington reaches out to Hyperliquid
The affair comes after six months of crossfire. CME and ICE, the two major American derivatives exchanges, alerted the CFTC and parliamentarians on May 15, according to Bloomberg. They targeted Hyperliquid oil perpetuals and cited the risk of manipulation, circumvention of sanctions and possible distortion of global oil benchmarks. At the end of May, Jeffrey Sprecher, CEO of ICE, judged the platform “bigger than Nasdaq”. He pointed out in passing that it only has eleven people. The Singapore monetary authority, MAS, in turn placed it on its investor alert list at the end of June. These attacks have so far lacked a concrete case. Solidus Labs provides them with one, even without proof of intent.
Washington is however blowing the heat. On August 19, Donald Trump affirmed at the White House that CFTC Chairman Michael Selig is also “working to bring Hyperliquid to the United States” in a “fully compliant and legal” manner. On August 26, the Hyperliquid Policy Center and trade[XYZ] then requested by letter to the CFTC to authorize regulated perpetuals on WTI, Brent and Henry Hub gas. The alleged spoofing in March therefore falls at the height of the request for approval.
Hyperliquid and its notebooks already targeted
This is not the first time that Hyperliquid's books have been used as a playground. In March 2025, a strategy on the memecoin JELLYJELLY left the HLP vault, the platform's community market maker, with approximately $12 million in unrealized losses according to Lookonchain. Hyperliquid then reported “indications of suspicious market activity,” and its validators voted to withdraw from the market. The Hyper Foundation then compensated the users, except for the reported addresses.
On November 12, 2025, the POPCAT affair even took on the appearance of spoofing. A trader spread $3 million across 19 portfolios to build a large long position. He put up a $20 million buy wall, then withdrew it all at once. The price collapsed, liquidations continued and the HLP vault took in $4.9 million in unrecoverable debt, according to on-chain data analyzed by Lookonchain. It was already the third attack of this type in 2025, after JELLYJELLY and TST in July.
The year 2026 has not been calmer. In April, the HLP vault lost $1.5 million in an attack orchestrated via Fartcoin. At the end of July, an aberrant price from a Korean exchange caused the SK Hynix perpetual to plunge by 17.9% and liquidate $57 million across 960 accounts. Each time, the transparency of the blockchain made it possible to reconstruct the attack after the fact, without preventing it.
Pump.fun connects its audience to Hyperliquid perps with 50x leverage
Pump.fun announced on October 28 on X the opening of perps in its application. More than 300 Hyperliquid markets become accessible, from cryptos to stocks to commodities. Leverage rises to 50x on the S&P 500, 40x on bitcoin, 25x on ether and 20x on Tesla or Nvidia, according to TokenPost. Positions are opened on an isolated margin, that is to say with a guarantee specific to each position, from a balance in USDC or SOL without going through a bridge. Pump.fun charges 0.05% per transaction on top of protocol fees, and its terms of service exclude the United States and Ontario.
Pump.fun has not built anything on the engine side. Solana's memecoins launchpad is limited to one interface. It routes orders to Hyperliquid’s books using builder codes, a mechanism that pays it a share of the fees. HyperCore matches orders and manages liquidations. In other words, the most impulsive public in crypto arrives with leverage on the same oil books that Solidus Labs has sifted through.
