50x Hyperliquid Whale Identity Revealed, Turns Out to Be a Fraudster Featured in UK News Headlines?

By: blockbeats|2025/03/20 16:00:03
Share
copy
Original Author: ZachXBT, On-chain Detective
Original Translation: DeepSeek

Editor's Note: The article reveals the identity of a mysterious Hyperliquid whale involved in illicit activities, who made approximately $20 million in profit through high-leverage positions from January to March 2025. The investigation found that this individual exploited casino game vulnerabilities and phishing attacks to acquire funds, and conducted high-leverage trades on both Hyperliquid and GMX using multiple wallets. Ultimately, the whale was traced back to a connection with William Parker (formerly known as Alistair Packover), a convicted felon with a history of fraud and gambling crimes. Currently, the funds are primarily held in an Ethereum address.

The following is the original article content (rearranged for readability):

An investigation has revealed the identity of a mysterious Hyperliquid whale involved in illicit activities, who made approximately $20 million in profit through high-leverage positions over the past few weeks.

50x Hyperliquid Whale Identity Revealed, Turns Out to Be a Fraudster Featured in UK News Headlines?

A trader opened multiple high-leverage positions on Hyperliquid and GMX from January to March 2025.

They drew widespread attention this month due to two on-chain transactions:

· Before Trump's announcement of a cryptocurrency reserve, 0xe4d3 opened a large ETH and BTC long position with 50x leverage (earning $10 million).

· 0xf3F4 opened a large BTC short position with 40x leverage (earning $9 million).

I further investigated and identified the primary counterpart of 0xf3f:

0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21

0x312f8282f68e17e33b8edde9b52909a77c75d950

0xab3067c58811ade7aa17b58808db3b4c2e86f603

0xe4d31c2541a9ce596419879b1a46ffc7cd202c62

These addresses are associated with Roobet, Binance, Gamdom, ChangeNOW, Shuffle, Alphapo, BC Game, and Metawin accounts.

0xf3f for X account @qwatio signed a message and claimed to have made $20 million on GMX and HL.

This implies that he must control the wallets related to this cluster for the $20 million figure to be accurate.

I replied to him on X yesterday, but the post was subsequently deleted.

An analysis of the X account used by 0xf3f suggests that the account may have been purchased at some point in time (recent name change, long period of inactivity, relatively old account).

I noticed that they follow @CryptxxCatalyst, who has posted links to multiple phishing websites and has replied to some individuals, attempting to deceive them.

I contacted @realScamSniffer, who regularly tracks these phishing websites.

In January 2025, a public address of a Hyperliquid whale was set as the receiving address for the projection[.]fi phishing website.

0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21

In January 2025, 0x7ab also directly received $17,100 from another phishing victim, and then his wallet was traced this month.

Since 0x7ab is the first EVM address used by 0xf3f, I traced the funds back to withdrawals from four casinos on Solana.

83Dumvk6pTUYjbGrC1fizBziRzDqcyNx73ieJcVbp56b

I contacted one of the casinos, and they clarified that the funds came from an input validation bug in their casino games.

They provided a now-deleted Telegram account: 7713976571, where they had negotiations with the exploiter of this bug.

I found a post from this account in a Telegram group through Open Source Intelligence (OSINT).

I discovered three help posts posted by the same TG ID in a GMX group.

To verify that this is the same person, I noticed that the posting times of these posts coincide with the on-chain transaction time of 0xe4d3.

I traced a recent payment by 0xe4d3 to an unnamed individual who confirmed they had been paid by an HL trader.

They provided a UK phone number for communication.

Public records indicate that this number is likely associated with the name William Parker.

Who is William Parker?

Last year, WP was arrested and sentenced in Finland for stealing approximately $1 million from two casinos in 2023.

Prior to this, WP was known as Alistair Packover (William Peckover) and later changed names.

In the early 2010s, AP made headlines in the UK news for fraud charges related to hackers and gambling (the age in the article matches the current information).

Clearly, WP/AP did not learn from their fraud conviction and is likely to continue gambling.

Currently, funds are primarily held in the following address:

0x51d99A4022a55CAd07a3c958F0600d8bb0B39921

Here is a quick summary:

In January 2025, an individual with a history of crimes leveraged a casino game vulnerability and phished victims, turning a six-figure sum of funds into $20 million through high-leverage on-chain transactions.

Original Article Link

You may also like

$COIN Joins S&P 500, but Coinbase Isn't Celebrating

On May 13, S&P Dow Jones Indices announced that Coinbase would officially replace Discover Financial Services in the S&P 500 on May 19. While other companies like Block and MicroStrategy, closely tied to Bitcoin, were already part of the S&P 500, Coinbase became the first cryptocurrency exchange whose primary business is in the index. This also signifies that cryptocurrency is gradually moving from the fringes to the mainstream in the U.S.



On the day of the announcement, Coinbase's stock price surged by 23%, surpassing the $250 mark. However, just 3 days later, Coinbase was hit by two consecutive events: a hack where employees were bribed to steal customer data and a demand for a $20 million ransom, and an investigation by the U.S. Securities and Exchange Commission (SEC) into the authenticity of its claim of having over 100 million "verified users" in its securities filings and marketing materials. These two events acted as mini-bombs, and at the time of writing, Coinbase's stock had already dropped by over 7.3%.


Coincidentally, Discover Financial Services, being replaced by Coinbase, can also be considered the "Coinbase" of the previous payment era. Discover is a U.S.-based digital banking and payment services company headquartered in Illinois, founded in 1960. Its payment network, Discover Network, is the fourth largest payment network apart from Visa, Mastercard, and American Express.


In April, after the approval of the acquisition of Discover by the sixth-largest U.S. bank, Capital One, this well-established digital banking company of over 60 years smoothly handed over its S&P 500 "seat" to this emerging cryptocurrency "bank." This unexpected coincidence also portrayed the handover between the new and old eras in Coinbase's entry into the S&P 500, resembling a relay race scene. However, this relay baton also brought Coinbase's accumulated "external troubles and internal strife" to a tipping point.


Side Effects of ETFs


Over the past decade, cryptocurrency exchanges have been the most stable "profit machines." They play a role in providing liquidity to the entire industry and rely on trading fees to sustain their operations. However, with the comprehensive rollout of ETF products in the U.S. market, this profit model is facing unprecedented challenges. As the leader in the "American stack," with over 80% of its business coming from the U.S., Coinbase is most affected by this.



Starting from the approval of Bitcoin and Ethereum spot ETFs, traditional financial capital has significantly onboarded users and funds that originally belonged to exchanges in a more cost-effective, compliant, and transparent manner. The transaction fee revenue of cryptocurrency exchanges has started to decline, and this trend may further intensify in the coming months.


According to Coinbase's 2024 Q4 financial report, the platform's total trading revenue was $417 million, a 45% year-on-year decrease. The contribution of BTC and ETH's trading revenue dropped from 65% in the same period last year to less than 50%.


This decline is not a result of a decrease in market enthusiasm. In fact, since the approval of the Bitcoin ETF in January 2024, the inflow of BTC into the U.S. market has continued to reach new highs, with asset management giants like BlackRock and Fidelity rapidly expanding their management scale. Data shows that BlackRock's iShares Bitcoin ETF (IBIT) alone has surpassed $17 billion in assets under management. As of mid-May 2025, the cumulative net inflow of 11 major institutional Bitcoin spot ETFs on the market has exceeded $41.5 billion, with a total net asset value of $1214.69 billion, accounting for approximately 5.91% of the total Bitcoin market capitalization.


Chart showing the trend of net outflows for Grayscale among the 11 institutions


Institutional investors and some retail investors are shifting towards ETF products, partly due to compliance and tax considerations. On one hand, ETFs have much lower trading costs compared to cryptocurrency exchanges. While Coinbase's spot trading fee rate varies annually in a tiered manner but averages around 1.49%, for example, the management fee for IBIT ETF is only 0.25%, and the majority of ETF institution fees fluctuate around 0.15% to 0.25%.



In other words, the more rational users are, the more likely they are to move from exchanges to ETF products, especially for investors aiming for long-term holdings.


According to multiple sources, several institutions, including VanEck and Grayscale, have submitted applications to the SEC for a Solana (SOL) ETF, with some institutions also planning to submit an XRP ETF proposal. Once approved, this may trigger a new round of fund migration. According to a report submitted by Coinbase to the SEC, as of April, the platform's trading revenue from XRP and Solana accounted for 18% and 10%, nearly one-third of the platform's fee revenue.



However, the Bitcoin and Ethereum ETFs passed in 2024 also reduced the fees for these two tokens on Coinbase from 30% and 15% to 26% and 10%, respectively. If the SOL and XRP ETFs are approved, it will further undermine the core fee revenue of exchanges like Coinbase.


The expansion of ETF products is gradually weakening the financial intermediary status of cryptocurrency exchanges. From their original roles as matchmakers and clearers to now gradually becoming mere "on-ramps and off-ramps" for funds, exchanges are seeing their marginal value squeezed by ETFs.


Robinhood Takes a Stand, Traditional Brokerages Join the Fray


On May 12, 2025, SEC Chairman Paul S. Atkins gave a keynote speech at the Tokenization and Cryptocurrency Working Group roundtable. The theme of his speech revolved around "It is a new day at the SEC," where he indicated that the SEC would not approach enforcement and regulation the same way as before but would instead pave the way for cryptocurrency assets in the U.S. market.



With signs of cryptocurrency compliance such as the SEC's "NEW DAY" declaration, an increasing number of traditional brokerages are attempting to enter the cryptocurrency industry. One of the most representative cases is the well-known U.S. brokerage Robinhood, which began expanding its crypto business in 2018. By the time of its IPO in 2021, Robinhood's crypto business revenue accounted for over 50% of the company, with a significant boost from the Dogecoin "moonshot" promoted by Musk.


In Q1 2025 earnings report, Robinhood showcased strong growth, especially in revenue from cryptocurrency and options trading. Fueled by Trump's Memecoin, cryptocurrency-related revenue reached $250 million, nearly doubling year-over-year. Consequently, Robinhood Gold subscription users reached 3.5 million, a 90% increase from the previous year, with the rapid growth of Robinhood Gold providing the company with a stable source of income.



Meanwhile, RobinHood is actively pursuing acquisitions in the cryptocurrency space. In 2024, it announced a $2 billion acquisition of the long-standing European cryptocurrency exchange Bitstamp. Additionally, Canada's largest cryptocurrency CEX, WonderFi, which recently went public on the Toronto Stock Exchange, also announced its integration with RobinHood Crypto. After obtaining virtual asset licenses in the UK, Canada, Singapore, and other markets, RobinHood has taken a proactive approach in the compliant cryptocurrency trading market.



Furthermore, an increasing number of brokerage firms are exploring the same path. Futu Securities, Tiger Brokers, and others are also dipping their toes into cryptocurrency trading, with some having applied for or obtained the VA license from the Hong Kong SFC. Although their user bases are currently small, traditional brokerages have a natural advantage in user trust, regulatory licenses, and low fee structures. This could pose a threat to native cryptocurrency platforms in the future.



User Data Breach: Is Coinbase Still Secure?


In April 2025, security researchers discovered that some Coinbase user data was leaked on the dark web. While the platform initially responded by attributing it to a "technical misinformation," it still raised concerns among users regarding its security and privacy protection. Just two days before Dow Jones Indexes announced Coinbase's addition to the S&P 500 Index, on May 11, 2025, Coinbase received an email from an unknown threat actor claiming to have obtained customer account information and internal documents, demanding a $20 million ransom to keep the data private. Subsequent investigations confirmed the data breach.


Cybercriminals obtained the data by bribing overseas customer service agents and support staff, mainly in "non-U.S. regions such as India." These agents abused their access to Coinbase's internal customer support system and stole customer data. As early as February this year, blockchain detective ZachXBT revealed on X platform that between December 2024 and January 2025, Coinbase users lost over $65 million to social engineering scams, with the actual amount potentially higher.


Among the victims was a well-known figure, 67-year-old Ed Suman, an established artist in the art world for nearly two decades, having been involved in the creation of artworks such as Jeff Koons' "Balloon Dog" sculpture. Earlier this year, he fell victim to an impersonation scam involving fake Coinbase customer support, resulting in a loss of over $2 million in cryptocurrency. ZachXBT critiqued Coinbase for its inadequate handling of such scams, noting that other major exchanges have not faced similar issues and recommending Coinbase to enhance its security measures.


Amidst a series of ongoing social engineering incidents, although there has not been any impact on user assets at the technical level so far, it has raised concerns among many retail and institutional investors. Especially institutions holding massive assets on Coinbase. Just considering the U.S. BTC ETF institutions, as of mid-May 2025, they collectively hold nearly 840,000 BTC, and 75% of these are custodied by Coinbase. If we price BTC at $100,000, this amount reaches a staggering $63 billion, which is equivalent to the nominal GDP of two Iceland in the year 2024.


Visualization: ChatGPT, Source: Farside


In addition, Coinbase Custody also serves over 300 institutional clients, including hedge funds, family offices, pension funds, and endowments. As of the Q1 2025 financial report, Coinbase's total assets under management (including institutional and retail clients) reached $404 billion. The specific amount of institutional custodied assets was not explicitly disclosed in the latest report, but it should still be over 50% based on the Q4 2024 report.


Visualization: ChatGPT


Once this security barrier is breached, not only could the rate of user attrition far exceed expectations, but more importantly, institutional trust in it would undermine the foundation of its business. Therefore, after a hacking event, Coinbase's stock price plummeted significantly.


CEXs are All in Self-Rescue Mode


Facing a decline in spot trading fee revenue, Coinbase is also accelerating its transformation, attempting to find growth opportunities in derivatives and emerging assets. Coinbase acquired a stake in the options platform Deribit at the end of 2024 and announced the official launch of perpetual contract products in 2025. This acquisition fills in Coinbase's gap in options trading and its relatively small global market share.



Deribit has a strong presence in non-U.S. markets, especially in Asia and Europe. The acquisition has enabled Coinbase to gain a dominant position in bitcoin and ethereum options trading on Deribit, accounting for approximately 80% of the global options trading volume, with daily trading volume remaining above $2 billion.


Meanwhile, 80-90% of Deribit's customer base consists of institutional investors, with their professionalism and liquidity in the Bitcoin and Ethereum options market highly favored by institutions. Coinbase's compliance advantage, coupled with its already robust institutional ecosystem, makes it even more suitable. By using institutions as an entry point, it can face the squeeze from giants like Binance and OKX in the derivatives market.



Facing a similar dilemma is Kraken, which is attempting to replicate Binance Futures' model in non-U.S. markets. Since the derivatives market relies more on professional users, fee rates are relatively higher and stickiness is stronger, making it a significant source of revenue for exchanges. In the first half of 2025, Kraken completed the acquisition of TradeStation Crypto and a futures exchange, aiming to build a complete derivatives trading ecosystem to hedge the risk of declining spot transaction fee income.


With the surge of Memecoin in 2024, Binance, OKX, and various CEX platforms began massively listing small-market-cap, highly volatile tokens to activate active trading users. Due to the wealth effect and trading activity of Memecoins, Coinbase was also forced to join the battle, successively listing popular tokens from the Solana ecosystem such as BOOK OF MEME and Dogwifhat. Although these coins are controversial, they are frequently traded, with fee rates several times higher than mainstream coins, serving as a "blood-boosting" method for spot trading.


However, due to its status as a publicly traded company, this practice is a riskier endeavor for Coinbase. Even in the current crypto-friendly environment, the SEC is still investigating whether tokens like SOL, ADA, and SAND constitute securities.


In addition to the forced transformation strategies carried out by the aforementioned CEXs, they are also starting to lay out RWAs and the most talked-about stablecoin payment fields, such as the PYUSD launched through a collaboration between Coinbase and Paypal, Coinbase's support for the Euro stablecoin EURC by Circle that complies with EU MiCA regulatory requirements, or the USD1 launched through a collaboration between Binance and WIFL. In the increasingly crowded trading field, many CEXs have shifted their focus from just the trading market to the application field.


The golden age of transaction fees has quietly ended, and the second half of the crypto exchange platform game has silently begun.


Arthur Hayes: Why I'm Betting on ETH While the Market Is Obsessed with SOL

"I personally have also allocated 20% to gold, expecting the price of gold to potentially rise to $10,000-20,000 by the end of this market cycle."

Key Market Insights for May 16th, how much did you miss out on?

1. On-chain Flows: $111.3M inflow to Ethereum this week; $237.6M outflow from Berachain 2. Largest Price Swings: $ETHFI, $NEIRO 3. Top News: Data: Solana Network's revenue reached $7.9M on the 13th, surpassing the sum of all other L1 and L2 chains

CryptoPunks Changes Hands Twice, Did the Originator of NFTs Finally Find Its "Forever Home" This Time?

The original NFT pioneer CryptoPunks has once again officially changed ownership after being sold to the Bored Ape Yacht Club (BAYC) developer Yuga Labs.

May 16 Key Market Information Gap, A Must-Read! | Alpha Morning Report

1. Top News: Coinbase Faces Double Blow with 'SEC Investigation' and 'User Data Breach,' Stock Price Drops by 7.2% 2. Token Unlocking: $ARB, $AVAX, $PRIME, $ASTR, $1INCH

MOG Coin Skyrockets as Elon Musk and Garry Tan Embrace "mog/acc" Identity

「mog/acc」 is rapidly sweeping through various figures, from Elon Musk to Garry Tan, boosting the project's visibility and ultimately driving up the price.

Popular coins

Latest Crypto News

Read more