Allegations of a Papertrade exploit surfaced on October 11, centering on two wallets that reportedly placed roughly $20 million in Ether orders each on Hyperliquid. X user Boblob (@Dr_bobo54) claimed the trades moved ETH quotes by 0.1% to 0.2%. The same wallets allegedly held leveraged long positions on Papertrade worth hundreds of millions of dollars in combined nominal exposure.

Trader Rune (@RuneCrypto_) shared the warning, pointing to Papertrade's own published risk disclosures:

the docs itself exposed the “exploit” risk pic.twitter.com/0q2EdyYLVA — Rune (@RuneCrypto_) October 11, 2026

Direct post link: https://x.com/RuneCrypto_/status/2109087204870131974?ref_src=twsrc%5Etfw

As of the reports published that day, no independent analysis had confirmed the manipulation, the wallet identities, or any resulting profits or losses, and Papertrade had not issued a confirmed public response. The claims center on the protocol's pricing design, which depends on prices generated outside its own system, and the market impact remains unclear.

Papertrade Exploit Claims Center on $20M ETH Trades

The researcher said the orders shifted ETH quotes by roughly 10 to 20 basis points. A basis point equals 0.01%, making the move approximately 0.1% to 0.2%. He claimed the same wallets held long positions on Papertrade, with combined nominal exposure in the hundreds of millions. Long positions can magnify small quote changes when notional exposure far exceeds the margin posted by the trader.

Rune flagged the exploit risk in Papertrade's own risk documentation. Initial reports, however, did not include wallet addresses, transaction hashes, or independent transaction analysis. The exploit remains unverified, and public claims have not established that any account profited from the price moves.

Papertrade launched recently on HyperEVM, the smart-contract environment connected to Hyperliquid. Rather than matching users through an order book, the protocol settles synthetic swaps between each trader and its liquidity pool. When a position opens or closes, it reportedly reads Hyperliquid's best bid and best offer and uses the midpoint of the two as the fill price. The platform supports leverage of up to 1,000 times on supported Bitcoin and Ethereum markets. That structure makes the reported midpoint, rather than a wallet's own execution price on Hyperliquid, the input that sets a Papertrade position's entry and exit values — which is why orders placed on a different venue drew scrutiny in the first place.

The exploit theory centers on the use of another venue's midpoint as a reference price. A new order can shift the best bid or offer before it executes, and Rune argued that such a move could change Papertrade's quoted price while a much larger position remains open. The documentation reportedly identifies manipulation of the best bid and offer as an unresolved risk, although that risk disclosure does not prove the suspected wallets exploited it. For on-chain protocols that price trades off an external venue, the exposure is structural rather than incidental: their quotes inherit whatever moves occur on the source market.

Hyperliquid Price Safeguards Differ From Papertrade BBO

The alleged exploit concerns how the protocol uses external prices, not evidence of a breach of Hyperliquid's native systems. BBO stands for best bid and offer. Hyperliquid's native perpetual use separate oracle and mark prices for their trading safeguards. Its oracle price is a weighted median of centralized exchange prices and updates about every three seconds. The mark price combines several inputs, including Hyperliquid order-book prices and data from other trading venues, and Hyperliquid uses it to calculate unrealized profit and loss, determine margin requirements, and trigger liquidations. Papertrade's reported midpoint serves a different function: it determines synthetic trade entries and exits. The distinction matters when assessing which system may have been affected.

A separate, unaffiliated PaperJet description says Papertrade's liquidity pool starts at zero and grows from traders' realized losses. It also says profitable closes may wait in a queue if the pool lacks funds, that PAPER tokens can be minted after eligible trading losses, and that stakers may receive USDC distributions. Under that description, a trader's payout depends on the pool holding funds rather than on a matched counterparty, since the protocol settles against its own pool instead of an order book. Those mechanics describe possible settlement constraints, not confirmed effects from the current allegations.

A comparable episode involved a Hyperliquid-linked SK Hynix perpetual contract, which dropped 17.9% in July after an unusual South Korean transaction affected its external price reference. Trade.xyz later said it would cover qualifying liquidation losses. That case involved a different contract and pricing arrangement, and it does not confirm the Papertrade allegations.

The reports published October 11 did not establish whether the alleged exploit affected the pool, and they left withdrawals and queued claims unconfirmed. They also lacked verified wallet identities, a loss amount, any compensation plan, or a timetable for changing the midpoint-based pricing system. The items that would resolve those open questions are a confirmed response from Papertrade, wallet-level on-chain analysis, and any disclosed changes to how the protocol derives its fill price.

Source: Blockonomi, Papertrade Exploit Claims Follow $20M ETH Trades on Hyperliquid