U.S.-China Relations
NextFin News - A trader operating through two accounts placed more than $170 million in unusual orders on Hyperliquid's oil perpetual contracts during the March 2026 oil frenzy, in a pattern that a market-surveillance firm says appears consistent with spoofing - the illegal practice of placing orders with no intention of executing them. The finding lands as US regulators and lawmakers are already scrutinizing a string of suspiciously timed oil trades, and it puts a spotlight on the decentralized exchange that has quietly become Wall Street's weekend oil market.
The orders, identified in a detailed analysis by Solidus Labs, were placed as the oil market swung wildly in early March, when the conflict with Iran sent West Texas Intermediate crude up more than 30% in a week to nearly $120 a barrel. On Hyperliquid, a decentralized derivatives platform that trades around the clock, the oil perpetual contract briefly became the second-most traded market on the venue, behind only Bitcoin. The combination is what makes the episode significant: it sits at the collision of three trends that will define the next phase of commodity trading - 24/7 crypto-native oil speculation, a widening federal probe into manipulation of energy markets, and a regulatory fight over whether perpetual futures belong in US markets at all.
What Spoofing Looks Like, and Why This Pattern Fits
The mechanics are straightforward, and they are illegal. A spoofer places large orders on one side of the market to create a false impression of supply or demand, then cancels them before execution while profiting from the price move those orders induced. The US Commodity Futures Trading Commission defines the practice as "bidding or offering with the intent to cancel the bid or offer before execution" - and the intent element is what separates manipulation from aggressive but legitimate trading.
Regulators have pursued the tactic aggressively for more than a decade. In the CFTC's first spoofing case, Michael Coscia and Panther Energy Trading were ordered to pay $2.8 million - split between a $1.4 million civil penalty and $1.4 million in disgorged profits - and banned from trading for one year. A later case against a Heraeus Metals trader resulted in a $130,000 penalty and a four-month suspension. Those cases were built on exchange data and order-book records; the Hyperliquid episode raises a harder question, because the order book lives on a permissionless, offshore blockchain rather than behind a regulated exchange's compliance desk.
The Solidus Labs analysis, which examined the two-account activity during the March volatility, concluded that the trader appeared to be trying to move prices through the spoofing tactic. The firm, founded in 2018 by Goldman Sachs veterans, runs surveillance technology that monitors more than a trillion events daily across 150-plus markets - the kind of infrastructure that regulated exchanges deploy in-house, but that decentralized venues typically lack. The $170 million figure is the size of the unusual orders, not a verified profit; no enforcement action has been filed, and the trader has not been identified publicly.
"The integrity of America's commodity futures markets must remain above reproach. Should market participants become convinced a few insiders are profiting on inside information at their expense, we could see reduced market liquidity, heightened volatility, and disruptions to the efficient pricing and flow of physical commodities."
That warning came from a bipartisan group of senators - Raphael Warnock, Amy Klobuchar, Cory Booker, Ben Ray Luján, and Elissa Slotkin - in a letter to the CFTC about a separate but related pattern of suspiciously timed oil trades. The overlap is the point: the same volatility that made oil the momentum trade of choice on Hyperliquid also drew federal attention to how those prices are being made.
How a Crypto Exchange Became the Weekend Oil Market
To understand why the spoofing allegation matters, you first have to understand what Hyperliquid has become. The platform specializes in perpetual futures - derivatives with no expiration date that trade 24 hours a day, seven days a week, with leverage that would be unavailable on a regulated US venue. In February, when news of potential airstrikes against Iran broke on a Saturday, hedge-fund commodities traders did not wait for Sunday night's futures open; they turned to Hyperliquid, which was already trading.
The oil contract itself - CL-USDC, a cash-settled perpetual tracking WTI crude through an external oracle - arrived via the platform's HIP-3 permissionless-market system, which lets third-party builders list new contracts. During the March frenzy, the contract logged more than $1.2 billion in 24-hour volume, briefly overtaking Ether to become the venue's second-most traded market. Open interest on Hyperliquid's permissionless market hit a record $1.2 billion around the same time, as traders rotated into energy bets while Bitcoin and the broader crypto market stagnated.
The structural appeal is not subtle. Traditional oil futures close for the weekend; geopolitical risk does not. A venue that never closes absorbs the weekend gap, and in doing so it begins to set the reference price that Monday's open will follow. Perpetual futures "are a better product, period," said Arthur Hayes, co-founder of BitMEX, the exchange widely credited with inventing the contract.
That is the second-order story most market participants have not fully priced. The conventional read of the Hyperliquid phenomenon is deregulation winning: a builder based outside the US, praised at the highest levels of government, capturing derivatives flow that used to belong to CME Group. The less comfortable read is that price discovery is migrating to venues whose compliance infrastructure was built for crypto volatility, not for commodity markets that move on presidential announcements and Middle East escalations. When the underlying asset can jump 30% on a weekend headline, the incentive to game the venue that prices it rises proportionally.
The Regulatory Noose Is Already Tightening
The federal scrutiny predates the spoofing allegation and runs deeper than one trader. In March, roughly 15 minutes before President Trump posted on Truth Social that a ceasefire with Iran had been agreed, a single trader made more than $580 million in oil futures trades, according to the senators' letter to the CFTC. Public reporting has identified at least three instances in which traders timed the oil market unusually well since the conflict began. The senators asked the CFTC to investigate, provide a public update, and brief congressional staff by June 15.
The CFTC is simultaneously fighting over the future of perpetual oil contracts on regulated venues. In June, the commission considered blocking CME Group's bid to launch a round-the-clock oil contract - a proposal the exchange announced without consulting the regulator. In October, the Commodity Markets Council, which represents CME and trading houses, urged the CFTC to withhold approval of Kalshi's proposed perpetual oil futures contract and to close what it called a loophole giving retail traders access to offshore platforms. The council's argument is market integrity: perpetual futures pose risks that existing rules do not cover.
Hyperliquid has anticipated this line of attack. In a response to a CFTC request for comment filed in August, the platform argued that its design makes spoofing difficult to execute profitably. Funding rates - the periodic payments that keep a perpetual contract anchored to its underlying price - are calculated from impact bid and ask prices sampled every five seconds and averaged over the hour, so influencing funding would require sustained distortion of the order book rather than a single transient order. Funding is also capped at 4% per hour, limiting the payoff from any manipulation strategy. The platform further pointed to hard-coded pre-trade limits on leverage and open interest, and to the onchain transparency of its transaction history, which it says aids cross-market surveillance.
Those defenses are technically coherent but they do not answer the core allegation. Sampling every five seconds and averaging over an hour makes funding-rate manipulation harder; it does not make order-book spoofing impossible, because a spoofer's profit can come from inducing fills on the opposite side of the book rather than from the funding payment itself. The CFTC's own enforcement history shows that spoofers profit from the reaction they trigger, not from the mechanics of the contract. The five-second sampling window is a defense against one attack vector, not an alibi.
Cyclical Abuse on a Structural Shift
The critical question is whether this episode is a cyclical blip or evidence of a structural break. The answer is both, and confusing the two produces the wrong conclusion.
The manipulation risk is cyclical. Spoofing clusters in volatility: thin weekend liquidity, fast-moving headlines, and wide spreads create the conditions where a large fake order can move price. When oil calms and liquidity deepens, the same tactic becomes far less profitable and far easier to detect. Historical spoofing cases - Coscia, the Heraeus trader, the precious-metals prosecutions of the 2010s - all cluster in periods of elevated activity. If oil returns to a quiet range, the specific incentive to spoof Hyperliquid's oil book recedes with it. Three conditions define the cyclical leg: a short-term volatility driver, thin liquidity, and a mean-reverting pattern once normal conditions return.
The venue shift is structural. That is the part that will not revert on its own. Hyperliquid has built a permanently open, permissionless market for commodity exposure, and the technology does not go away when volatility fades. The evidence for the structural claim is the regime change itself: trading hours that no longer match the underlying exchange, listing rules that do not require a compliance review, and an audit trail that is public but not policed. The 24/7 gap is not a temporary arbitrage; it is a new architecture for price discovery. And the regulatory response - senators demanding CFTC updates, incumbent exchanges lobbying to block competing perp products, and political praise for the platform while its regulator hesitates - shows the system has not yet decided what rules apply.
Separating the two matters because it determines what to watch. If this were purely cyclical, the story would end when oil volatility fades. Because the structural leg is real, the story continues regardless of the next oil print: the next volatility spike will find the same open venue, the same thin weekend liquidity, and the same unanswered question about who is watching.
The Strongest Case Against the Manipulation Read
The adversarial case deserves its due. Spoofing requires intent, and onchain data shows orders and cancellations, not state of mind. A large order placed and cancelled during a weekend gap could be a legitimate attempt to test liquidity, a hedging adjustment, or an aggressive market-making strategy in a market where spreads widen by design. Hyperliquid's own filing makes this argument implicitly: its funding-rate design caps the economic payoff of manipulation, which means a rational actor would not spoof unless the expected profit exceeded the funding cost and the risk of detection.
There is also a selection-bias problem. Solidus Labs flagged activity that looked unusual; unusual is not the same as illegal. No regulator has filed charges. The $170 million figure describes order size, not profit, and there is no public evidence that the trader actually captured gains from the pattern. In traditional markets, the majority of flagged spoofing alerts never become enforcement actions - the false-positive rate is the reason exchanges employ layers of review before referring cases.
But the counter-thesis, while substantial, does not erase the concern. Intent is routinely inferred from patterns in regulated markets - Coscia's scheme was algorithmic, and no one ever saw a written instruction to spoof. The burden of demonstrating real-time surveillance falls on the venue, and a permissionless exchange that lists commodity contracts without a compliance desk has, by design, deferred that function. The correct framing is therefore the one the surveillance firm itself used: the activity appeared consistent with spoofing. "Appeared" is doing real work here.
The falsifying signal is concrete. If the CFTC and the Department of Justice close their broader oil-trading investigation without charges by the June 15 congressional briefing deadline, and if Solidus-style order patterns fail to repeat across the next two oil-volatility spikes, the manipulation narrative weakens materially. Conversely, a single enforcement filing naming the trader or the venue would confirm that the pattern was not a false positive.
Who Benefits, Who Is Exposed, and What Comes Next
The beneficiaries of this episode are predictable, and they are not the traders. Market-surveillance and compliance vendors - firms of the Solidus type - gain a fresh proof point for selling monitoring infrastructure to venues that lack it. Regulated exchanges arguing for a level playing field, notably CME Group and the trading houses behind the Commodity Markets Council letter, gain political ammunition for restricting offshore perp competition. Lawmakers pushing crypto-derivatives legislation gain a concrete example of the gap they say needs closing.
The exposed are equally clear. Permissionless builders listing commodity perps without US compliance infrastructure now face the risk that enforcement lands on the venue rather than the individual trader - which would reprice the entire permissionless-listing model. Traders using weekend liquidity face the risk that the liquidity they rely on is thinner and more gameable than it appears. And the deregulation narrative for crypto derivatives - the idea that a builder outside the US can capture commodity flow with minimal friction - takes a hit every time a manipulation allegation surfaces.
The forward look splits cleanly by horizon:
- Short term (sentiment and liquidity): more scrutiny headlines, wider weekend spreads as market makers price manipulation risk, and continued volume concentration in energy perps while geopolitical risk persists.
- Medium term (enforcement and guidance): the CFTC's public update to Congress, any filing in the oil-trading probe, and the decisions on Kalshi's and CME's perpetual oil proposals - each is a leading indicator of how commodity perps will be treated onshore.
- Long term (structural): commodity price discovery fragments across 24/7 venues regardless of enforcement outcomes. The architecture exists; it will not be uninvented.
Three scenarios frame the base case. In the base case, the investigation continues without immediate charges, and regulatory guidance narrows which commodity perps can be offered to US traders. In the upside case for Hyperliquid, no enforcement action materializes, US onboarding proceeds, and derivatives volume migrates further onchain. In the downside case, charges are filed against the trader or the venue, US retail access to commodity perps is restricted, and leverage or funding-rate caps are imposed across the sector.
The oil market has always had its weekend warriors; what is new is that the battlefield now stays open on Sundays, and the referees are still learning the terrain.
Explore more exclusive insights at nextfin.ai.
