-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0253
============================================================

Advisory-ID:  0xCERT-2026-0253
Severity:     High
Published:    2026-10-10T00:00:00.000Z
Updated:      2026-10-18T08:08:03.570Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0253

Title: Papertrade Launch-Day Price Manipulation

Summary
- -------
A trader moved Hyperliquid's ETH reference price while holding leveraged Papertrade positions, netting about $1.28 million from the platform's shared USDC pool on launch day.

Details
- -------
Summary
A trader moved Hyperliquid's ETH reference price while holding leveraged Papertrade positions, netting about $1.28 million from the platform's shared USDC pool on launch day.

Incident
- - Victim: Papertrade
- - Date (UTC): 2026-10-10
- - Estimated loss: $1.3M
- - Chain(s): Hyperliquid
- - Attack type: oracle manipulation
- - Funds status: stolen

Recommended actions
- - Revoke token approvals granted to Papertrade contracts until the project confirms they are safe
- - Integrators: pause or delist affected assets and monitor for attacker fund movements
- - Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/papertrade-2026. Primary sources: https://financefeeds.com/papertrade-faces-bbo-price-manipulation-allegations-following-hyperevm-launch/ ; https://phemex.com/news/article/papertrade-exploited-for-128m-on-launch-day-as-1000x-leverage-model-faces-scrutiny-99518 ; https://www.kucoin.com/news/flash/papertrade-launch-exploited-for-1-28m-in-8-hours-using-1000x-leverage.

References
- ----------
- - https://www.blockchainbreaches.com/en/breaches/papertrade-2026
- - https://financefeeds.com/papertrade-faces-bbo-price-manipulation-allegations-following-hyperevm-launch/
- - https://phemex.com/news/article/papertrade-exploited-for-128m-on-launch-day-as-1000x-leverage-model-faces-scrutiny-99518
- - https://www.kucoin.com/news/flash/papertrade-launch-exploited-for-1-28m-in-8-hours-using-1000x-leverage

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmroItgJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdrRgChGl4iKXeYulGVajFEM94ZwgN4m2AoqArd
jkZxuxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACjMQD9HwDkhmjoA3FZVVUF
+FuXVAwhnUzuDdDx2j198NyAimAA/0zSk2+M0gFXvqSVDiMNuJpUgdXJg53I
vRML3PGsLRkN
=GDuf
-----END PGP SIGNATURE-----