The short version
- Hyperliquid hacker suspect: a wallet funded with 3,100 ETH from Tornado Cash now holds a 263.8 BTC long and an 8,946 ETH short, about $20 million each.
- The trade only pays if ETH falls against Bitcoin; the wallet entered at about 0.0295 BTC per ETH, with $6.92 million behind $40 million of positions.
- Nobody has tied the ETH to a theft: the Tornado Cash pool took in 226 deposits from 88 addresses in the 12 days before, including hacker-linked ones.
- Next: whether ETH/BTC breaks below its 200-day MA at 0.0293, the move the wallet is waiting for.
The Hyperliquid hacker, as Lookonchain calls the wallet, spent the night building a $40 million pair trade on Hyperliquid: long Bitcoin, short Ethereum, the same dollar size on each side. Every dollar of it came out of Tornado Cash a few hours earlier.
Three steps, all of them onchain:
1. On Saturday, between 14:50 and 16:05 UTC, it took 31 withdrawals of exactly 100 ETH from Tornado Cash, 3,100 ETH in total. Even its first gas money came from the mixer. 2. It sold all 3,100 ETH for 6.92 million USDC through CoW Swap and bridged the stablecoins to Hyperliquid, with a $100 test first. 3. At 17:37 UTC it set two orders that trade in small slices over 12.5 hours, a TWAP (time-weighted average price). They finished around 06:07 UTC on Sunday with 263.8 BTC long and 8,946 ETH short, about $20 million each.
So whose ETH was it, and what exactly is the wallet betting on?
Lookonchain flagged the trade two thirds of the way in, when it was still about $25 million:
A hacker is going long $BTC and short $ETH!
A newly created wallet received 3,100 $ETH from #TornadoCash, sold it for 6.92M $USDC, and deposited the funds into Hyperliquid.
Then opened a 20x long on 169.47 $BTC ($12.84M) and a 20x short on 5,740 $ETH ($12.83M).
Which Hack Did the Hyperliquid Hacker’s ETH Come From?
Nobody can say for sure, and that is what Tornado Cash is for. Lookonchain called the owner a hacker but didn’t name a theft. Onchain Lens went further and labelled the wallet the Drift Protocol exploiter, without showing the link.
A mixer pool works like a cloakroom with identical tickets. People drop in 100 ETH and get a private note; anyone holding a note can later take 100 ETH out to a brand-new address. Between October 27 and the first withdrawal, the 100 ETH pool took in at least 226 deposits from 88 addresses through its main router, so these 31 notes could belong to any of them, or to deposits made weeks earlier.
Two hacker-linked names do stand out in the recent flow. The Drift hacker, tied by Drift to North Korea, pushed about $122 million of ETH into Tornado Cash on October 20 and 21, mostly in 100 ETH chunks. And on Thursday, Lookonchain flagged a wallet “possibly linked to a hacker” that woke up after three years and put 1,700 ETH into the same pool. Either could have paid for the Hyperliquid hacker’s trade. So could plenty of people with nothing to hide, and the onchain data can’t tell them apart.
The mixer money kept moving on Sunday morning. Lookonchain spotted 1,670 ETH from Tornado Cash going into Hyperliquid over 20 hours and being sold for 2,959 ZEC, about $3.73 million. That happened at a different address from the pair trade, and Lookonchain only says it “appears” to be the same hacker:
It appears the hacker is selling ETH to buy ZEC!
Over the past 20 hours, 1,670 $ETH ($3.73M) from #TornadoCash was deposited into Hyperliquid and sold to buy 2,959 $ZEC ($3.73M).
arkm.com/explorer/entit…
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
How Does the Long BTC, Short ETH Trade Make Money?
A long BTC short ETH trade wins if ETH falls against Bitcoin, whatever the dollar price does. Because both sides are the same size, a 5% drop in the whole market barely moves the account; a 5% drop in ETH/BTC, the price of one ETH in Bitcoin, makes roughly $1 million. That is the whole bet.
The wallet entered at about 0.0295 BTC per ETH. That is a long on Bitcoin at an average of $75,783 and a short on Ethereum at $2,234.
The “20x” on the positions is a setting, not the real risk. Both sit on cross margin, so the whole $6.92 million backs them, which works out to about 5.8 times leverage across $40 million. Hyperliquid puts the short’s liquidation price at $2,923 if Bitcoin stood still. In ratio terms, ETH would have to gain about 31% on Bitcoin before Hyperliquid liquidates the account.
SIDE TRAIL: Drift Hacker Sends $122M in ETH to Tornado Cash
ETH/BTC Price: Where Does the Ratio Stand?
ETH/BTC trades at 0.0295 at the time of writing, right on the wallet’s entry. Ethereum is at $2,233 and Bitcoin at $75,806, both close to flat on the day.
The trend is on the wallet’s side. It has been for a month. The ratio last closed above its 50-day moving average (MA) on October 3, at 0.0317, then slid to a low of 0.0284 on October 30. A spike to 0.0305 on Wednesday faded within a day.
Two lines frame the trade now:
- Just below: 0.0293. The 200-day MA, which ETH/BTC has sat on for most of the past two weeks. A clean break lower is what the wallet needs.
- Above: 0.0303. The 50-day MA, the level that has capped every bounce since early October.
Further down, June’s closing low of 0.0258 is the last stop of 2026. Getting there would be a 12.5% drop in the ratio, worth about $2.5 million to the wallet.
TRAIL MAP: Futures and Leverage Explained: Perps, Margin and How Liquidation Really Works
36 days. That is how long ETH/BTC has gone without a close above its 50-day MA, and $20 million says the streak isn’t over.
Satoshi Flipper has more than 20 years of trading experience, starting in stocks before moving into crypto in 2017, and holds an MBA from the Kellogg School of Management. The edge is reading the economic data: rate decisions, inflation, jobs numbers, earnings and the US markets that move Bitcoin.
More from Satoshi Flipper
