A Textbook Exploit on Day One
TREE NEWS reports: Papertrade, a perpetual futures platform built on top of Hyperliquid, went live on October 10. Within eight hours, a single wallet had demonstrated exactly how to profit from its design — walking away with roughly $1.28 million after spending about $52,000 in fees on the venue it was exploiting.
The platform’s pitch is simple: no order book, no market makers, no funding rates. A single USDC pool acts as the counterparty to every trader, and pricing is pulled directly from the midpoint of Hyperliquid’s best bid and offer. With leverage capped at a headline-grabbing 1,000x, the setup was an open invitation.
The Mechanics of the Attack
Just after 6 p.m., the wallet bought roughly 6,060 ETH on Hyperliquid’s spot market, nudging the price up by about $3 — a move of 0.12%. At normal leverage, that’s noise. At 1,000x, it’s a 120% gain on margin. The wallet held a synchronized long on Papertrade, and its collateral doubled in minutes.
An hour later, the same play ran in reverse: a 660x short on 30 ETH (roughly $297 million in notional value) opened on Papertrade, followed by a sale of about 6,590 ETH on Hyperliquid to push the price down. Total cost on Hyperliquid: ~$52,000. Total withdrawn from Papertrade: ~$1.28 million. A return of nearly 25 to 1.
Why the Pool Couldn’t Defend Itself
On-chain records show the address deposited about $1.2 million and withdrew about $2.48 million that day. It is not a newcomer — the wallet has traded on Hyperliquid since February 2025, starting with $2 million and generating $14.2 billion in cumulative volume for $13.1 million in net profit.
The structural flaw is straightforward. Papertrade’s pool passively accepts whatever price it reads from outside. It does not adjust quotes when one side of the book grows dangerously lopsided, the way a traditional market maker would. The casino’s odds are set by the casino next door — and the players can walk over and move them whenever the cost of doing so is cheaper than the payout.
Not a One-Off
This is a recurring pattern in passive liquidity pools. Hyperliquid’s own HLP pool has been hit at least twice: a whale manipulation of ETH positions cost it roughly $4 million in March 2025, and the POPCAT incident added another $4.9 million loss. Papertrade simply layered higher leverage on top of a market whose prices have already proven movable.
Papertrade’s response — that the issue was loose position limits during launch, now being tightened — is only half right. Tighten caps enough and the 1,000x headline becomes marketing fiction. The deeper tension is that any platform sourcing prices externally, pairing them with a passive pool, and offering extreme leverage will attract the same arbitrageurs.
The Real Bill
DeFi derivatives are in a leverage arms race: 50x, 100x, 500x, 1,000x. Each new venue competes on multiples and friction. But when leverage is pushed to the limit, the pricing and solvency risk lands on the pool — and therefore on LPs. ‘Turning liquidations into ownership’ sounds elegant until the pool is drained directionally, and PAPER tokens simply anchor a shrinking base.
Papertrade’s TVL is approaching $70 million with over 10,000 active addresses, and $1.28 million is not fatal. But the structural problem will not disappear by tuning a few parameters. Extreme leverage sells excitement. Its other face is fragility — and the market has just been shown the price of that trade.
