Investigation Targets Hyperliquid Whale Behind $20M in Leveraged Profits

Key Insights:

• Blockchain analysis linked Hyperliquid whale’s $20M gains to William Parker, a convicted fraudster.
• Parker’s trades were funded by phishing scams and a casino exploit traced to Solana withdrawals.
• Investigators identified Parker using on-chain links, payments, and a UK-based phone number.

A recent investigation by blockchain analyst ZachXBT has identified the individual behind a series of highly leveraged cryptocurrency trades that generated approximately $20 million in profits between January and March 2025.

The trader, known in on-chain circles as the Hyperliquid whale, used platforms such as Hyperliquid and GMX to place strategic long and short positions. ZachXBT’s findings indicate the individual, William Parker, has a criminal history involving financial fraud and hacking.

The Hyperliquid Whale and Suspicious Trade Clusters

The trader first gained widespread attention in March 2025 after executing two notable on-chain transactions. One involved a large Ethereum (ETH) and Bitcoin (BTC) long position at 50x leverage, placed just before President Trump announced a crypto reserve policy. This trade resulted in a $10 million profit. The second major transaction was a Bitcoin short position at 40x leverage, yielding approximately $9 million in gains.

The Hyperliquid whale drew attention in March 2025 after executing two major trades. One involved a long Ethereum (ETH) and Bitcoin (BTC) position at 50x leverage ahead of President Trump’s announcement of a crypto reserve policy. That trade netted roughly $10 million. Another short position in Bitcoin at 40x leverage yielded nearly $9 million.

Blockchain analysis linked these trades to the wallet address 0xf3F4, which had also been actively engaging with other wallets in a broader cluster. Investigators identified key counterparties, including wallets connected to platforms such as Roobet, Binance, Gamdom, ChangeNOW, Shuffle, Alphapo, BC Game, and Metawin. This suggested that the trader was deeply embedded in multiple financial and gambling ecosystems.

Connections to Phishing and Exploits

Further analysis revealed troubling links between the trader’s activities and phishing schemes. One wallet in the cluster, 0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21, was identified as the drainer fee receiver for the phishing website projection[.]fi in January 2025. This wallet had also received approximately $17,100 from another phishing operation before being flagged by blockchain trackers.

In addition to phishing, investigators traced the origins of some funds to an exploit involving an online casino game. Withdrawals from four different casinos on the Solana blockchain were linked to the trader, with one casino confirming that an input validation vulnerability had been exploited.

The casino also provided details about an unnamed Telegram account used in negotiations with the exploiter. The account was later deleted, but open-source intelligence (OSINT) research found posts from the same Telegram ID in a GMX discussion group, requesting assistance at the same time that wallet 0xe4d3 was conducting on-chain trades.

Tracing the Identity Behind the Wallets

To confirm the Hyperliquid whale’s identity, ZachXBT followed transaction trails from wallet 0xe4d3 to a recipient who verified they had received payments from the trader. That individual shared a UK-based phone number used during their communication.

Parker had previously identified as Alistair Packover or William Peckover. And was arrested in 2023 for stealing roughly $1 million from two casinos and sentenced in Finland. He had participated in several UK-related hacking and gambling fraud cases before this. Testimony from early 2010s reports that he was being investigated for masterminding online scams and financial fraud schemes.

Parker, who was convicted of fraud offenses, never stopped his illicit financial freelance work. His funds from phishing and trades on hyperliquid and GMX made significant gains. Converting and moving proceeds from on-chain through. Various platforms has been the belief by investigators to obscure where the funds originated.

As of now, almost all funds related to these activities have been locked up in 0x51d99A4022… Significant assets remain in the wallet raising the concerns for further trading activities.

Disclaimer

In this article, the views, and opinions stated by the author, or any people named are for informational purposes only. And they don’t establish the investment, financial, or any other advice. Trading or investing in cryptocurrency assets comes with a risk of financial loss.