Spoofing (also known as deceptive order placement) is a trading practice that creates false signals about market supply and demand by submitting buy or sell orders without a genuine intention to execute them. It typically involves a trader placing a large number of orders on one side of the order book to influence how other participants assess market depth and price direction, while executing actual trades on the other side and then canceling the previously placed orders.
On October 28, 2026, unusual trading activity involving Hyperliquid crude oil perpetual contracts attracted market attention. Solidus Labs, a market monitoring firm, analyzed trading data from March 8 to 10 and identified suspicious characteristics involving two accounts, including large order placements, rapid cancellations, and trades in the opposite direction. The abnormal orders involved more than $170 million. However, existing analysis has not conclusively established that the accounts acted with the intent to manipulate the market.
The controversy involves more than the trading activity of individual accounts. It also reflects new challenges facing the on-chain derivatives market. Blockchain technology can provide public trading records, but is data transparency sufficient to prove market manipulation? Where is the boundary between order cancellations and spoofing? When regulatory standards from traditional financial markets are applied to on-chain perpetual contracts, what technological and legal differences must be considered?
Key Takeaways
-
Suspicious order placement occurred in Hyperliquid crude oil perpetual contracts. A market monitoring analysis disclosed on October 28, 2026, indicated that two accounts submitted more than $170 million in abnormal orders over the preceding three days.
-
The core of spoofing is the lack of genuine intent to execute. By placing orders that they plan to cancel before execution, traders may create false buying or selling pressure and influence the decisions of other market participants.
-
Frequent order cancellations do not necessarily constitute market manipulation. Market making, risk management, and market conditions can all lead to legitimate cancellations. The key question is whether the trader had a genuine intention to execute when placing the order.
-
On-chain transparency improves the reviewability of trading activity. Public records of orders, cancellations, and executions help reconstruct the trading process but may not independently prove manipulative intent.
-
Suspicious trading patterns must be distinguished from legal violations. Market monitoring systems can identify abnormal activity, but a final legal determination requires consideration of the complete evidence, applicable regulations, and regulatory procedures.
What Happened to Hyperliquid Crude Oil Perpetual Contracts?
Hyperliquid is a decentralized trading infrastructure known primarily for its on-chain order book and perpetual contract trading. Unlike decentralized trading protocols that rely primarily on automated market makers (AMMs), Hyperliquid uses an order book mechanism that allows traders to submit limit orders. Prices are formed by matching buy and sell orders.
The market monitoring analysis disclosed on October 28, 2026, focused on crude oil-related perpetual contract trading activity that occurred from March 8 to 10 of the same year. At the time, international energy markets were experiencing significant volatility, and related assets such as Brent crude oil and WTI crude oil were attracting market attention.
According to Solidus Labs' analysis, two trading accounts whose common control relationship has yet to be further confirmed submitted abnormal orders totaling more than $170 million over three days. The accounts repeatedly submitted and canceled large orders on one side of the order book while executing actual trades on the other side.
The analysis disclosed several notable indicators:
| Observation |
Disclosed Details |
| Trading period |
March 8–10, 2026 |
| Disclosure date |
October 28, 2026 |
| Accounts involved |
2 accounts |
| Suspicious order size |
More than $170 million |
| Ratio of canceled order value to opposite-direction trade value |
Approximately 30:1 |
| Estimated trading profit over three days |
Approximately $119,000 |
| Primary markets involved |
Brent crude oil perpetual contracts, as well as WTI crude oil and natural gas-related contracts |
A group of trades on March 9 attracted particular attention. The accounts reportedly canceled approximately $17 million in sell orders while executing approximately $425,000 in buy trades.
This pattern may create the appearance that a large number of sell orders have entered the order book, leading other traders to believe that strong selling pressure exists. The accounts involved may then use the market's response to buy the asset in the opposite direction.
However, it is important to note that $170 million refers to the size of the abnormal orders identified. It does not equal the actual executed amount, market losses, or confirmed manipulation gains. The approximately $119,000 profit was also an estimate disclosed in the analysis and cannot, by itself, prove that the profit resulted from market manipulation.
Solidus Labs stated that the trading activity had typical characteristics of spoofing, but the intent to manipulate the market still requires further verification. Hyperliquid Labs emphasized that the platform's order, cancellation, and execution records are publicly reviewable, allowing market participants and regulators to conduct independent analyses based on the relevant data.
What Is Spoofing? How Can Deceptive Order Placement Affect Market Prices?
The core of spoofing is not the placement of large orders. It is the trader's intention, at the time of submission, to cancel the orders before execution in order to create misleading signals about market supply and demand. In order book-based markets, buyers and sellers express their trading intentions through limit orders. Buy orders generally reflect potential demand, while sell orders reflect potential supply.
Other traders assess short-term market supply and demand by observing order book depth, the distribution of bids and asks, and changes in large orders. If a large number of buy orders suddenly enter the order book, market participants may believe that strong buying support exists around a certain price. If a large number of sell orders appear, they may interpret them as potential price resistance or selling pressure.
Spoofing exploits this information transmission mechanism. Suppose a perpetual contract is currently trading at $100 and a trader wants to buy at a lower price. The trader may place a large number of sell orders near the current price, making the order book appear to show significant selling pressure. After seeing the increase in sell orders, other traders may lower their quotes, sell their positions, or adjust their trading strategies. The trader may then execute actual trades on the buy side and quickly cancel the previously placed large sell orders.
If the sell orders were never intended to execute and were instead intended to influence market perceptions, the conduct may constitute spoofing. Its potential effects are mainly reflected in three areas.
-
Fake orders may distort market depth. The liquidity displayed in the order book may appear sufficient, but the orders may already have been canceled when other traders attempt to execute against them.
-
Fake orders may change short-term price expectations. Traders or automated trading systems may interpret large orders as genuine buying or selling pressure and adjust their quotes accordingly.
-
A manipulator may profit through trades in the opposite direction. The fake orders are used to create a market signal, while the actual profit may come from genuine executions on the other side.
However, whether market prices were actually affected, whether the accounts involved obtained improper gains as a result, and whether the orders lacked genuine execution intent must all be determined based on specific evidence.
How Is Spoofing Different From Normal Order Cancellations?
In order book markets, canceling orders is a normal and necessary trading operation. Traders may adjust unfilled orders based on price changes, financial conditions, position risk, and market liquidity. For example, market makers typically submit both buy and sell orders to provide two-sided liquidity. When prices change rapidly, existing quotes may no longer be appropriate, requiring market makers to cancel or update orders to avoid taking on more risk than expected.
High-frequency trading systems may also submit, modify, and cancel large numbers of orders within a short period. These behaviors do not necessarily indicate market manipulation. Therefore, distinguishing spoofing from normal order cancellations requires more than simply looking at the number of cancellations or the size of the orders.
| Comparison |
Normal Order Cancellation |
Suspicious Spoofing Activity |
| Purpose of placing orders |
Seeking genuine execution |
May be intended to create false buying or selling signals |
| Execution intent |
Willing to execute under the applicable conditions when placing the order |
May already be planning to cancel before execution |
| Reason for cancellation |
Market changes, risk management, or strategy adjustments |
May cancel inducement orders after the market reacts |
| Order distribution |
Consistent with actual quotes and risk management |
May repeatedly concentrate large orders on one side |
| Opposite-direction trading |
May be part of normal two-sided trading |
May be coordinated with fake orders |
| Basis for assessment |
Trading context and genuine execution intent |
Evidence from order sequences, execution activity, and manipulative intent |
The U.S. Commodity Futures Trading Commission (CFTC) emphasizes in its explanation of spoofing whether the trader intended to cancel the order before execution when submitting it. Good-faith order modifications and cancellations should not be deemed spoofing solely because the order was ultimately not executed.
The CFTC also states that even if an order is partially executed, that does not automatically rule out the possibility of spoofing. The assessment must still consider the trading environment, order activity, execution characteristics, and other relevant facts.
This shows that there is no simple one-to-one relationship between order cancellations and unlawful manipulation. For on-chain order book markets such as Hyperliquid, it is likewise necessary to distinguish normal trading strategies from conduct intended to create false liquidity.
Why Do Large Orders and Opposite-Direction Trades Easily Raise Spoofing Concerns?
Market monitoring systems generally do not determine that an account is engaging in manipulation simply because it submits one large order. What matters is the timing relationship between different orders and whether order placement, cancellation, and actual execution repeatedly form similar patterns. In a typical suspicious trading sequence, a trader may first submit large orders on the sell side of the order book, making the market appear to face significant selling pressure. Other traders may then adjust their quotes, while the account executes trades on the buy side. After completing the purchases, the account quickly cancels the original large sell orders.
If this process occurs repeatedly and the large orders are rarely executed, a market monitoring system may identify it as abnormal activity. In the Hyperliquid incident, the ratio of canceled order value to opposite-direction trade value was approximately 30:1. This means that the notional value of the orders canceled by the accounts was significantly greater than the value of their trades in the opposite direction. Such a ratio can serve as a risk monitoring signal, but it cannot directly serve as quantitative proof of manipulation.
This is because order value and executed value are different concepts. A $10 million limit order may be only partially executed, or it may be canceled in full because of price changes. Order size reflects the potential trading quantity submitted at the time, not the amount of funds ultimately transferred.
In addition, market makers and quantitative trading systems may frequently adjust large quotes during periods of high volatility. If the market's liquidity, price volatility, and trading strategies at the time are not considered, relying solely on the value of canceled orders can easily lead to misjudgment.
Therefore, identifying spoofing generally requires examining the relationship among multiple indicators, including the distance between orders and the best bid and ask, the length of time orders remain open, the likelihood that orders will be executed, the timing of opposite-direction trades, and whether similar behavior continues to repeat. CME Group's explanation of spoofing also emphasizes that creating false buying or selling pressure through large orders on one side and using orders on the other side to execute trades is a behavior pattern that warrants particular attention.
Can On-Chain Order Data Prove Market Manipulation?
On-chain order data can provide important evidence for market manipulation investigations, but public records alone do not prove manipulative intent. Complete order data from traditional centralized trading platforms is generally maintained internally by the exchange. External researchers may only be able to access execution records, partial order book snapshots, or other public market data.
By contrast, Hyperliquid's on-chain order book architecture makes more trading activity publicly reviewable. Researchers can use available historical data to analyze account-level order placement, cancellations, executions, and position changes, and attempt to reconstruct the relevant trading sequences. This transparency has at least three important benefits.
-
Researchers can observe account activity more directly without relying entirely on statistics provided by the trading platform.
-
Different research institutions can independently analyze the same historical records and compare their methods for identifying abnormal trading.
-
Public records help establish an evidence chain that can be repeatedly verified. For example, whether an account executed buy trades after submitting large sell orders, and whether those sell orders were quickly canceled, can be examined through the corresponding order history.
However, on-chain data still has clear interpretive limitations.
Order records cannot directly reveal a trader's subjective intent. Even if an account repeatedly cancels large orders, those records alone cannot establish whether the trader had already decided, when placing the orders, that they would not allow them to execute.
An on-chain address does not necessarily correspond to one unique actual trader. A trader may control multiple accounts, and establishing whether different accounts are under common control generally requires additional evidence. Market activity may also be affected by off-chain information. News events, prices on other exchanges, external hedging trades, and automated strategy parameters may explain some orders and cancellations that appear abnormal.
Data completeness and chronological order are equally important. Investigators must confirm whether the data used fully covers the relevant order lifecycles and accurately establishes the sequence of different trading and cancellation events. Therefore, on-chain transparency primarily addresses whether trading activity can be observed and reconstructed. It does not automatically resolve questions about motive or legal responsibility.
How Can Suspicious Trading Activity Be Identified Through an On-Chain Order Book?
For on-chain trading platforms that use order book mechanisms, market monitoring generally needs to move beyond single-trade analysis and examine complete order activity.
-
Large orders can be monitored to determine whether they consistently appear on a particular side of the bid or ask. If an account frequently submits orders far larger than normal trading volumes near the best available quotes and cancels them shortly afterward, the activity may warrant further attention.
-
The relationship between order placement and opposite-direction execution can be analyzed. When an account submits a large number of sell orders, does it also execute trades on the buy side? Do the sell orders tend to be canceled after the buy trades are completed? Does this behavior repeatedly occur at different times?
-
Order activity can be compared with market price movements. If the market price or other traders' quotes change after large orders appear, and the account subsequently receives favorable executions in the opposite direction, the correlation may increase a monitoring system's concern about abnormal activity. However, a time sequence does not automatically establish causation. Researchers must also consider overall market trends, price changes on other trading platforms, and whether external events jointly affected prices.
-
Accounts can be checked for coordinated activity. When multiple accounts submit complementary orders at around the same time, investigators may need to further analyze their funding sources, trading activity, and control relationships. However, similar activity by two addresses alone cannot establish that they are controlled by the same person.
-
Observed activity can be compared with normal market behavior. For example, the average cancellation rate, order duration, and execution ratio for the same trading pair under similar volatility conditions can all serve as references for assessing the degree of abnormality.
It is important to emphasize that these indicators are primarily used to identify activity that warrants investigation, rather than directly determine that an account has violated the law. A high cancellation rate may be a risk signal, but there is no single cancellation-rate threshold that applies to all markets and trading strategies.
How Is Spoofing Determined in Traditional Financial Markets?
Spoofing is not unique to cryptocurrency markets. Similar conduct has long attracted attention in stocks, futures, and other financial markets that use order book mechanisms. In the United States, the Dodd–Frank Act of 2010 amended the Commodity Exchange Act and prohibited spoofing conduct involving a specific intent to cancel orders.
Interpretive guidance issued by the CFTC in 2013 further explained that determining whether a violation occurred requires consideration of the trader's intent when submitting the order, rather than simply whether the order was ultimately canceled. The guidance also identified conduct that may involve spoofing, including using orders to create a false appearance of market depth and attempting to induce artificial price movements.
CME Group Rule 575 likewise restricts trading activity that disrupts market order and expressly prohibits conduct intended to cancel or modify orders before execution to avoid execution. Its rules are not identical to the CFTC's statutory standards, and their specific application must be distinguished. In actual investigations, regulators may assess the nature of the conduct by considering order history, links between accounts, trading communications, strategy design, and other materials. For on-chain perpetual contract markets, regulators must also consider the legal structure of the trading platform, the locations of participants, the nature of the contracts, and the regulatory authority of the relevant jurisdictions.
This means that spoofing rules from traditional financial markets can provide an important reference for understanding abnormal on-chain trading, but a specific on-chain account cannot be deemed to have violated a particular regulation without completing an analysis of the applicable law.
Regarding the Hyperliquid incident, the existing public information supports describing the activity as a suspicious trading pattern with characteristics of spoofing, rather than as a market manipulation case that has already been legally established.
What Challenges for On-Chain Derivatives Markets Does the Hyperliquid Incident Highlight?
The significance of the Hyperliquid incident lies not only in whether individual accounts engaged in suspicious trading. It also shows that on-chain derivatives markets are facing trading-order issues similar to those found in traditional financial markets. As on-chain perpetual contracts gradually expand beyond crypto assets, price exposure to crude oil, precious metals, and other traditional financial assets is also entering the on-chain trading environment. These products can expand trading hours and methods of market participation, but they also create new requirements for order book liquidity, price discovery, and market monitoring.
-
On-chain trading transparency cannot automatically prevent manipulation. Public records can reduce the difficulty of conducting an analysis after the fact, but they cannot guarantee that all traders have genuine execution intent.
-
On-chain order books require more comprehensive systems for monitoring abnormal trading. For high-frequency order placement, unusual cancellations, opposite-direction executions, and coordinated activity across accounts, market monitoring systems need to conduct comprehensive analyses using both real-time data and historical behavior.
-
On-chain derivatives may develop closer price links with traditional financial markets. When an on-chain crude oil perpetual contract references prices from external markets, researchers need to examine the on-chain order book, external reference prices, and liquidity changes in related markets at the same time to better understand the potential impact of abnormal trading.
-
The relationship between the openness of on-chain markets and regulatory responsibility still requires coordination. Public and transparent trading infrastructure can provide regulators with more data, but trading rules, market supervision, and legal responsibility still require clear institutional arrangements.
The Hyperliquid incident shows that market transparency and market fairness are not the same concept. Transparency improves the observability of activity, while fairness also requires effective trading rules, risk monitoring, and corresponding enforcement mechanisms.
Conclusion
Spoofing is a trading practice that uses orders placed without genuine execution intent to create false signals about market supply and demand. The key criteria are not the size of the orders or the frequency of cancellations, but whether the trader planned to cancel the orders when placing them and whether the conduct was intended to mislead the market.
The dispute involving Hyperliquid crude oil perpetual contracts provides a specific case for understanding market monitoring in on-chain order books. More than $170 million in abnormal orders, a high ratio of canceled orders to opposite-direction executions, and recurring patterns of order placement and cancellation can all serve as leads for further investigation. However, they are not sufficient by themselves to prove manipulative intent.
The advantage of on-chain transparency is that researchers can use public data to reconstruct trading activity and independently analyze suspicious patterns. However, account control relationships, the background of trading strategies, subjective intent, and the application of law still require assessment based on additional evidence.
As on-chain derivatives markets continue to expand, establishing effective mechanisms for identifying abnormal activity, supervising markets, and managing risk in open trading environments will become an important issue for the development of trading infrastructure.
FAQ
What is Spoofing?
Spoofing is the practice of submitting buy or sell orders with the intent to cancel them before execution, potentially using those orders to create misleading signals about market supply and demand.
Has Market Manipulation on Hyperliquid Been Confirmed?
As of November 2, 2026, publicly available analyses have identified suspicious order activity with characteristics of spoofing. However, they have not confirmed the intent to manipulate the market of the accounts involved, nor can they establish that market manipulation in the legal sense occurred.
Why Doesn't Frequent Order Cancellation Necessarily Constitute Spoofing?
Normal market making, risk management, and market conditions can all lead to the cancellation of large numbers of orders. The key to determining whether conduct constitutes spoofing is the trader's genuine execution intent when placing the order, not the number of cancellations itself.
Can On-Chain Trading Records Prove Spoofing?
On-chain records can help reconstruct the process of order placement, cancellation, and execution and provide evidence for an investigation. However, manipulative intent, account control relationships, and the background of the activity generally require support from additional evidence.
What Is the Difference Between Spoofing and Wash Trading?
Spoofing primarily involves placing and canceling orders without genuine execution intent. Wash trading generally involves actual trades designed to create a false appearance of trading volume or market activity. Both can mislead the market, but their specific mechanisms differ.
How Can Ordinary Traders Identify an Abnormal Order Book?
Traders can monitor whether large orders appear frequently and disappear quickly, whether bid and ask depth changes abnormally, and whether order placement is significantly mismatched with actual executions. However, these signs can serve only as risk indicators and cannot directly prove that an account is manipulating the market.
