Analysis: Papertrade did not adopt Hyperliquid’s official oracle pricing mechanism, enabling a trader to manipulate the system and earn $1.28 million in profits.

According to Butler’s monitoring, Papertrade was exploited by an address to earn around $1.28 million in profits just roughly 8 hours after its launch. The same trader has accumulated over $13 million in historical profits on Hyperliquid, with a trading volume of $14 billion. Since Papertrade prices its trades based on Hyperliquid’s real-time ETH price, the attacker repeatedly opened large long and short positions on Papertrade while trading ETH on Hyperliquid, briefly pushing prices up or down before closing positions for gains. Data shows the trader executed a total of 305 trades, 296 of which were profitable, giving a win rate of approximately 97%. The average holding time was just 98 seconds, with cumulative trading profits peaking at $1.73 million. However, the attacker later opened 30 short positions on Papertrade at $2507.35, with a notional value of around $297 million, and sold roughly 6,600 ETH on Hyperliquid to drive the price down to $2504.4, but this attempt to close the positions failed. Afterward, ETH’s price rose to $2509.95, triggering full liquidation of the 30 short positions, resulting in a loss of roughly $450,000. The attacker ultimately netted approximately $1.28 million in profits. The Papertrade team may have curbed the attack by blocking the attacker’s position closures, but this is only speculation and has not been confirmed. Analysts noted that if the platform continues to directly use Hyperliquid’s BBO (Best Bid Offer) as its pricing basis, underlying manipulation risks will remain. They recommend adopting Hyperliquid’s official oracle price, which aggregates quotes from multiple trading platforms, to reduce risks from manipulation of a single order book.