Hyperliquid Oil Futures Spoofing Suspicions: $170 Million Ghost Orders and the Gray Area of DeFi Regulation

Author: TechFlow

During the weekend of March 10, the global oil market was on a roller coaster. WTI crude plunged from $119 to below $86, traditional exchanges were closed for the weekend, but oil perpetual futures on Hyperliquid remained open around the clock. Daily volume for CL-USDC surged from $21 million to $1.2 billion, briefly surpassing ETH to become the platform's second-largest market. Short whales flooded in, and $75 million worth of short positions were liquidated within a single day.

This was a high point for DeFi outcompeting traditional finance.

But seven months later, the same time window was unearthed, and things changed.

$170 Million in 'Ghost Orders'

On October 28, blockchain monitoring firm Solidus Labs submitted an analysis report to Bloomberg, stating that between March 8 and March 10, two accounts placed abnormal orders exceeding $170 million on energy perpetual futures such as Brent crude on Hyperliquid.

The orders shared highly consistent characteristics: large sell orders were placed on one side of the order book to create an illusion of intense selling pressure, then quickly canceled, while small buy orders were executed on the opposite side to take out the counterparty orders that had been scared off.

The numbers speak for themselves. On March 9, one account canceled approximately $17 million in sell orders while completing about $425,000 in buys. Canceled volume was roughly 30 times executed volume. Over the three days, the account's estimated profit was about $119,000.

In traditional financial markets, this practice has a specific term:Spoofing。

Section 747 of the 2010 Dodd-Frank Act explicitly defines it as unlawful conduct: 'bidding or offering with the intent to cancel before execution.' The CFTC further clarified in its 2013 enforcement guidance that proving spoofing requires intent beyond recklessness, and that partial execution does not automatically exempt the remaining orders from review.

In its report, Solidus Labs cautiously stated that the orders exhibited 'spoofing characteristics,' but the traders' identities and intent 'have not been confirmed.'

Hyperliquid's Response: The Chain Is the Evidence

Hyperliquid Labs did not dispute the data. Its response can be summarized in one sentence: all order submissions, cancellations, and executions are publicly verifiable on-chain, and any market participant or regulator can review them independently.

On the surface, this statement is a defensive posture, but on closer reading, it is also an offensive one.

Order data on traditional exchanges is opaque. Exchanges can see the full picture, but external regulators must issue subpoenas, request data, and follow procedures to obtain the raw records needed for analysis. In the 2015 Navinder Sarao 'flash crash' spoofing case, it took five years from the incident to the final conviction.

Hyperliquid used on-chain transparency to reverse this logic: the data has always been there, no subpoena is needed, no waiting is required, and anyone can monitor it in real time. The fact that Solidus Labs was able to produce a detailed analysis seven months later precisely demonstrates the auditability of this system.

The problem is that this transparency is a double-edged sword. It makes surveillance easier, but it also makes the 'evidence' more complete. If the CFTC decides to pursue the matter, the on-chain records are ready-made courtroom evidence, precise down to each order's timestamp and amount, with evidence-gathering efficiency several orders of magnitude higher than in traditional markets.

HIP-3: Who Is Responsible for 'Permissionless Markets'?

The complexity of this issue is rooted in Hyperliquid's unique market architecture.

At the end of 2025, Hyperliquid launched the HIP-3 (Builder-Deployed Perpetuals) framework. Any team can stake 500,000 HYPE (worth about $22 million at the time) and deploy its own perpetual futures market on Hyperliquid's shared order book and margin system. Deployers are responsible for setting contract specifications, oracles, reference prices, leverage limits, and settlement processes.

The first large-scale deployer was trade.xyz, under the Hyperunit team, which successively launched perpetual contracts on U.S. equities such as NVDA and TSLA, S&P 500 index perpetual contracts (officially authorized by S&P Dow Jones Indices), and crude oil and precious metals contracts. By June 2026, the HIP-3 market’s total open interest had exceeded $3.2 billion.

What makes this architecture elegant is that Hyperliquid provides the infrastructure (order book, matching engine, and on-chain settlement), while operational responsibility for individual markets rests with the deployer. Deployers can use the “settlement” function to suspend an asset, cancel all open orders, and force settlement at the current mark price. Validators can also penalize deployers that jeopardize protocol correctness or availability through the “technical slashing” mechanism.

But an unprecedented legal gap has emerged here,When suspected manipulation occurs in a permissionlessly deployed market, who bears responsibility?

Is it the deployer, trade.xyz? It set the contract specifications and oracle, but it has neither the obligation nor the ability to monitor whether every order constitutes spoofing.

Is it the Hyperliquid protocol itself? It provides the matching engine, but it too is only a layer of infrastructure.

Or is it the individual trader? In traditional markets, defendants in spoofing cases are usually the traders themselves. But the real identities behind these two Hyperliquid accounts remain unknown to this day.

There is currently no precedent.

Behind the crude oil spoofing case

Viewed together, the true significance of this suspected spoofing incident goes far beyond the $119,000 in profits or the $170 million in anomalous orders.

It raises a fundamental question:What rules should apply to DeFi derivatives platforms?

Hyperliquid's crude oil perpetual contracts track the same underlying asset as those on the New York Mercantile Exchange. Its price discovery may influence traditional markets in the reverse direction. Its trading volume has reached a non-negligible scale during extreme market conditions. Yet it is neither a CFTC-registered designated contract market (DCM) nor has it undergone any conventional regulatory approval.

The CFTC’s jurisdiction over spoofing is grounded in the Commodity Exchange Act and covers contracts traded on registered exchanges or subject to CFTC jurisdiction. Whether Hyperliquid’s on-chain crude oil contracts fall within this scope depends on whether the CFTC determines that these perpetual contracts constitute “swaps” or “futures.”

If the CFTC determines that they do, on-chain transparency becomes the most efficient enforcement tool: all evidence is self-authenticating, tamper-proof, and queryable in real time. The Solidus Labs report has already demonstrated this possibility.

If the CFTC determines that they do not, or is unwilling to address the issue for now, Hyperliquid will continue to operate in a gray area: a market whose trading volume can rival CME energy futures, yet with no enforcement precedent on market manipulation.

Whichever direction it takes, Hyperliquid has already placed the choice before the CFTC. Full on-chain transparency means: the evidence is here—will you come and take it?

Source: 深潮 TechFlow