Manipulation Tactics Behind the 18% XPL Flash Crash

Source: Quote team member filo

Compiled by Odaily (@OdailyChina); Translator: Azuma (@azuma_eth)

At 12:32 Beijing time on November 1, Plasma (XPL) on Hyperliquid plummeted 18% in a straight-line flash crash within one minute, while during the same period BTC fell only 0.04%.

Between 12:32:50 and 12:32:59, Hyperliquid's HLP liquidator vault passively took over a $12,177,100 long position; by the time it finished closing out and selling 75 minutes later, the vault had lost $555,800.

Within hours of the incident, on-chain analysts kenni.hl (@kennishjp) and Naeven (@Naeven_) pieced together the rough outline of the event — a cluster of wallets withdrew margin in the minutes before the crash.

kenni.hl compared the matter to an incident that occurred in March 2025, when a trader withdrew margin from a massive ETH long position. Hyperliquid said at the time that HLP lost about $4 million, the trader ultimately profited about $1.8 million, and there was no exploit or hack.

We wanted to answer the three questions left unresolved in that preliminary outline: Are these wallets really connected? How did the losses flow through to HLP? Did these wallets profit from it?

To that end, we pulled every readable fill record, withdrawal, and transfer, including withdrawal requests that Hyperliquid rejected. The short conclusion is: these wallets are indeed connected; the path by which the losses flowed to HLP is clearly visible; but they lost money on Hyperliquid.

As for who sold XPL during that one minute and why, the public data cannot provide an answer.

Key Findings

• Are these wallets connected? Yes. Of the 16 wallets, 14 are distributed across 4 independent USDC transfer funding trees on Arbitrum; although these funding trees have no direct transfer overlap, they displayed completely identical order instructions and timing.
• Did the withdrawals accelerate the liquidation? Yes. All 12 wallets that made withdrawals began being liquidated earlier than the other 4 wallets that did not withdraw. They held 70.3% of the group's positions and accounted for 90.7% of the positions taken over by the vault. How much HLP would have lost without these withdrawals, we cannot know, because one of the wallets that withdrew nothing at all ultimately also triggered a vault takeover.
• Did these wallets cause the crash? Cannot be determined. Before the first liquidation on Hyperliquid, XPL had already fallen 6% (based on XPL's own price action alone), and Binance perpetual contract volume was higher than Hyperliquid's at the time; no public data shows who was selling.
• Did these 16 wallets profit? Not on Hyperliquid. They lost a cumulative approximately $711,000 on the platform; whether they held positions on other platforms (if any) is beyond our observation.

A Cluster of Wallets Sharing Funds and Trading Habits

We started with the 16 addresses published by Naeven and ran comparison tests against the other 55 accounts that were liquidated around the crash (between 12:30 and 12:36).

Hyperliquid's ledger shows that most deposits came from Circle deposit wallets, which obscures the real sender of funds, but Arbitrum on-chain data does not lie.

On September 12, 2 wallets received $797,334 and $624,954 respectively within 46 seconds of each other, and a 3rd wallet received $743,730 that afternoon; on October 29 and 30, these 3 wallets sent USDC to another 9 wallets (one of which went through an intermediate address); on October 31, a 4th source wallet, 0x3f42…9bf5, funded 0x9a72…adb3. Most of the receiving addresses transferred the funds into Hyperliquid within an hour.

Behavioral patterns link these funding trees together and identify another 2 wallets with no direct funding connection.

Starting at 11:45, 10 wallets made consecutive test withdrawals ranging from $501 to $1,185 within 6 minutes; from 12:12 onward, 4 more test withdrawals appeared. Between 12:22 and 12:28, 11 wallets from all 4 funding trees placed TWAP (time-weighted average price) buy orders in two rounds: the first round lasted 60 minutes and bought about $300,000; the subsequent round lasted about 15 minutes and bought about $200,000. Among them, 3 orders were sized to the exact same 3,502,136 XPL.

10 of the 16 wallets set the same referral code, while among the other 54 liquidated accounts we found only 1 account that used that referral code (though earlier referral relationships may be invisible to us, and the code may also be public). In addition, those 55 external accounts had no withdrawal records in the 3 hours before the incident.

Of course, the match is not 100%. 0x3f42…9bf5 did not perform any of the above operations in the final few hours and is linked only through the funding chain; another 2 central distribution wallets (hubs) made no test withdrawals or TWAP orders. From the fill records we could read (starting at 18:02 on October 31), no mutual trading occurred among these wallets.

The available evidence points to a single operator or several people working in coordination, but we have no conclusion whatsoever about their true identities.

All 16 Wallets Were Stuck Just Below a Single Margin Tier

As of 12:32, the group held a total of about 269 million XPL in long positions, worth $23,091,800.

Since October 28, network-wide Open Interest has increased by 281 million XPL on a one-sided basis, so the group's long position size is almost equivalent to the entire increase over that period (though others were also trading within that window). At the same time, this position size is 12.5 times the resting bid depth within 5% above and below the average mid-price over the past 24 hours.

No single wallet held more than $2,373,100. Hyperliquid's XPL margin tier table allows up to 10x leverage for notional value below $3 million, dropping to 5x leverage above $3 million — if concentrated in a single account, this total position would require $2,159,000 in maintenance margin; spread across 16 accounts, it required only $1,155,000.

It is an established fact that all 16 wallets kept their positions below this tier line; whether this was a deliberate target, we cannot say.

Based on an average entry price of $0.07669, when the price was at $0.0859 the group still had $2,475,000 in unrealized gains. Hyperliquid allows traders to withdraw unrealized PnL (paper gains) as long as the account retains margin equal to at least 10% of notional value.

• Note: The growth in Open Interest is highly synchronized with the group's long position trajectory; both are denominated in one-sided XPL quantity.

Withdrawals That Stopped Right at the Edge of the Limit

The first large withdrawal settled at 12:24:47, and the last completed at 12:32:11.

The 12 wallets successfully executed 20 withdrawals in total, pulling out $2,039,000, while another 7 withdrawals were rejected for "Insufficient balance." These rejection records show just how tightly they pushed the limit — one wallet, after a request to withdraw $162,000 was rejected, immediately re-requested $100,000 and $50,000; another wallet had a last-minute request to withdraw $7,280 rejected as well.

The group's account equity as a percentage of notional value plunged from 22.4% to 13.5%. Among the 12 wallets that withdrew, 10 ended with margin ratios between 9.9% and 11.2%.

During this period, the group kept buying. In the final half hour, they bought 15,225,600 XPL, while Hyperliquid's entire order book had total volume of 29,531,300 XPL over the same period — in other words, even as margin kept flowing out, their positions continued to expand.

• Note: Light-colored bars represent wallets that made withdrawals; all 12 wallets had begun entering liquidation before 12:32:50.816. The 4 dark bars (non-withdrawing wallets) subsequently triggered liquidation at 12:32:52, 12:32:55, 12:32:55, and 12:37:44, respectively.

The last bar in the chart, 0xd6e2…423d, is the sample closest to a control group: it was funded by the same central wallet as 2 other withdrawing wallets, also made test withdrawals and placed the same TWAP orders, but subsequently moved out no other funds. At 12:37:44 it liquidated 20% of its position into the order book, and no position flowed into the liquidator vault.

However, a single wallet can only serve as a reference case; 0xf0b1…5414 illustrates the limits of this comparison — that wallet's only large withdrawal request was rejected, yet it still ultimately handed 14,586,500 XPL in liquidated positions to the vault.

The Price Drop Occurred Before the Liquidations

The first liquidation on Hyperliquid occurred at 12:32:43. Before that, prices on both Binance and Hyperliquid had already fallen about 6% from the prior minute's level, so it could not have been Hyperliquid's liquidations that triggered this drop. Whether forced-selling liquidations occurred on other trading platforms, we have no way to observe.

During those first 43 seconds, Binance perpetual contracts traded 49,210,700 XPL, of which 75.9% was seller-initiated, while Hyperliquid's volume over the same period was 11,437,500.

Binance almost always hit each price threshold first, typically by less than a second — a gap so narrow that it may even be affected by system clock error. We measured using each platform's own price as the benchmark, because before the drop Hyperliquid's price was 41.5 basis points (bps) higher than Binance's.

At the same time, other major tokens barely moved. At that minute's low, ETH fell only 0.12%, and ENA, the worst performer among the 10 other tokens we checked, fell only 0.54%. We found no news about XPL or any scheduled token unlock that day, though public searches are inevitably incomplete.

Over the full one-minute span, the center of volume shifted. Hyperliquid's order book traded 167 million XPL, exceeding Binance's 144 million, of which 49% came from forced-selling liquidations. kenni.hl's statement that "Hyperliquid itself had almost no volume" holds only before 12:32:43.

• Note: Backstop transfers are not counted here, because these positions never entered public order book matching.

The Vault Inherited Losing Positions and Held Them in a Falling XPL Market

Under the mechanism, Hyperliquid first sends 20% of a large position to the order book for liquidation (we observed this process on 11 of the wallets). If account equity falls below 2/3 of maintenance margin, the account is handed over to the liquidator vault (a $1 million sub-component within HLP).

At 12:32:50, when XPL's mark price fell to $0.077378, the vault took over 134 million XPL; by 12:32:59, its total takeover had reached 160 million.

The takeover price was below the mark price at the time, with the difference equal to "remaining wallet equity divided by position size" — a rule we derived and reproduced on every wallet, with an error within $15. This discount averaged 108 basis points. Yet at the same time, when these 134 million XPL changed hands, the latest traded price on Binance had already fallen to $0.07408, 4.3% below Hyperliquid's mark price.

• Note: The mark price updates roughly every 3 seconds and had also consistently been above the Binance price before the crash.

If measured against Binance's price as the benchmark, the loss can be broken down into 3 parts (with a measurement error within $132):

1. Takeover price difference cost ($282,408): Part of this stems from the 41.5 basis point premium that Hyperliquid itself had in the minute before the crash;
2. Cost of XPL's further decline on Binance during the vault's closing ($260,258);
3. Execution slippage and fees: The vault sold at a rate of about 2 million XPL per minute, of which 99.6% was crossing the spread; the execution price was a total of $7,771 below Binance's price within the same minute, and it also paid $5,218 in fees. The vault's own continuous selling may also have exacerbated the further price decline, but we cannot isolate that effect.

• Note: As of 18:30 Beijing time, HLP's total size was $169.6 million, so this loss accounted for 0.33% of HLP's total funds, but 55.6% of the liquidator vault's own principal.

All the execution steps we could verify complied with Hyperliquid's published rules, including the 10% withdrawal margin floor and the initial 20% order book split liquidation. As of 18:30, we found no official statement from Hyperliquid on the matter.

On Hyperliquid, These 16 Wallets Lost Money

The similarities to the March 2025 incident end here.

Setting aside the $243,350 one wallet transferred to another, these wallets had a total deposit inflow of $3.21 million, withdrawal outflow of $2.33 million, and another $165,775 still remaining on the platform (almost all in 0xd6e2…423d's still-open position).

This means the group had a net loss of about $711,000 on Hyperliquid; the withdrawals did save $2,038,000 of ultimately losing positions from liquidation, but overall they still lost money.

The timeline of events is all documented. The first test withdrawal appeared 47 minutes before the crash, the first large withdrawal 7 minutes before the crash, and the last approved withdrawal request was signed at 12:31:57 (just as the drop was beginning).

However, chronological order cannot explain the underlying motive. Whether they held hedged positions on other trading platforms, or simply had a directional view on price, the on-chain and platform data would present the same appearance; it cannot even be ruled out that there was an external seller completely unrelated to these wallets. We have so far found no evidence supporting any of these hypotheses, including whether short positions existed.

Why We Measured These Figures

The core pivot of this analysis is a set of comparative figures — a massive position of 269 million XPL, facing resting bid depth only one-twelfth its size.

We measured this because we focus on trade execution, and assessing how much impact an order book can absorb is precisely where that work begins. Quote (the team the original author belongs to) assigns each market a real-time liquidity score from 0 to 10, and our trading engine dynamically adjusts order size based on available depth.

Limitations of This Investigation

• We can only read public data from Hyperliquid and Arbitrum. Binance, Bybit, and OKX do