Who Is The Hyperliquid Whale? How OSINT Shook Crypto Twitter

Thanks to ZachXBT, OSINT Industries helped expose the Hyperliquid Whale.

“Here’s a quick TLDR for those people who have a short attention span: in January 2025 after exploiting a casino game and phishing victims, a person previously charged for multiple crimes gambled 6 figs into $20M using high leverage onchain.” – @ZachXBT, Crypto and Blockchain Investigator [Source: Twitter (X)]

Outside of Crypto Twitter, Hyperliquid was far from a household name. A decentralized perpetual futures exchange, Hyperliquid’s point of difference is that unlike Binance or Bybit, this platform is non-custodial, operating without an intermediary so users trade directly with each other, wallet-to-wallet. Users can trade “perps”, futures with no expiry date. In plain English, Hyperliquid’s makeup translates to a super-fast high-frequency arcade atmosphere. Big bets, big wins, and in the case of big losses, borrowing extra money to make even bigger bets. This water is teeming with whales, playing with 10X or even 100X leverages.

In early 2025, one whale emerged as the fattest catch. An obscure, high-volume trader on Hyperliquid profited around $20 million using highly leveraged positions on ETH and BTC. MAGA memecoins quickly made their way into the mix, alongside suspiciously well-timed trades, including a 50X long position right before Trump's crypto reserve announcement. On March 12th alone, this whale’s intentional liquidation of approximately $200 million Ether caused $4 million to drain from Hyperliquid’s liquidity pool, while he splashed back $1.8 million in profit. 

‍

Soon Crypto Twitter sat up and noticed. Talk spread about a trader almost too big to be true. Claiming the Leviathan title for himself and himself alone, this mysterious mammoth trader became known as The Hyperliquid Whale.

Reactions ranged from anger to congratulations to excitement at the chance to participate in a buzzy online saga. Yet as quickly as this whale had breached, somebody set out to expose him. Using OSINT Industries, it was time to rig harpoons. 

It’s “funny watching CT [Crypto Twitter] speculate on the Hyperliquid Whale”, investigator ZachXBT posted, “when in reality it’s just a cybercriminal gambling with stolen funds.”

‍

Meet ZachXBT… and the Hyperliquid Whale.

Crypto and blockchain investigator ZachXBT describes himself as a “rug pull survivor turned 2D investigator”. He uses OSINT, crypto investigation tools and investigative know-how to expose scammers, fraudsters, suspicious shorters and exploit artists on 2D crypto or fintech platforms. An investigation into the alleged identity of the mysterious Hyperliquid whale was far from this analyst’s first investigation. Through his diligent work, ZachXBT has also exposed:

‍

• $243 Million in Stolen Bitcoin: Over 4,000 BTC was stolen from one victim when fraudsters posed as Google and Gemini support to get at their private keys. ZachXBT traced the stolen funds, following the money to secure identification and arrest for the suspects, and the freezing of over $9 million in scammed assets.
• Scammers in Paris: Two French phishers defrauded victims of NFTs worth millions. ZachXBT tracked the trail of breadcrumbs they left behind to a comprehensive breakdown of their methods.
• Teen SIM Swapper: Somebody SIM-swapped a single individual for $37 million worth of Bitcoin and Bitcoin Cash, alongside multiple Twitter account hacks. ZachXBT discovered the culprit was a Canadian teenager.
• A Story of Machi Big Brother: Bored Ape Yacht Club whale Machi Big Brother was a mystery, until ZachXBT found Jeffrey Huang – a former Taiwanese-American rapper and tech entrepreneur – his history, and his controversies. 

After these quarries, linking the Hyperliquid Whale to his identity would prove to be well within ZachXBT’s grasp. This hunt would employ all the knowledge of potential illicit activity, connections to phishing sites, Solana casino exploits, and major on-chain counterparties like Roobet and Binance that this Ahab had gained on his travels; and this wouldn’t be a doomed voyage. 

The identity of his great white Moby-Degen? Meet William Parker from Hailsham, East Sussex. 

‍

Also known as William Peckover and Alastair Peckover, an OSINT Industries search revealed the name and parochial personality behind a titanic rise and fall. A baby-faced online gambling addict, two-time casino thief, ex-convict in Finland, and – most importantly – a fraudster making bets with stolen money. With our tool and a helpful mistake, ZachXBT exposed the fabled Hyperliquid Whale to scrutiny… and Crypto Twitter ridicule.

‍

Ahab’s OSINT: Mapping the Whale’s Blockchain Footprints

How did ZachXBT do it? The story went something like this.

Between January and March 2025, the Whale was still the biggest predator in the sea. The then-anonymous trader was turning six-figure positions into $20 million gains with highly leveraged positions on Hyperliquid and GMX. Two onchain trades sent the biggest ripples through the Twittersphere: a large BTC short position on 40X leverage made by by wallet 0xf3F4 at a $9M profit, and a large ETH and BTC long position on 50X leverage by 0xe4d3 – suspiciously well-timed with Trump’s crypto reserve announcement – at a $10M profit.

‍

Drenched in risk, but always dredging up profits. The Whale was either extremely lucky or an insider. Still, these trades sparked ZachXBT’s hunting instinct. Suspecting 0xf3f was the Whale’s address, he “went and identified the main counterparties”:

0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21

0x312f8282f68e17e33b8edde9b52909a77c75d950

0xab3067c58811ade7aa17b58808db3b4c2e86f603

0xe4d31c2541a9ce596419879b1a46ffc7cd202c62

ZachXBT mapped out the territory. These four addresses (0x7ab, 0x312, 0xab3, 0xe4d3) were closely linked to 0xf3f, meaning they either sent or received funds. Blockchain analysis showed ties to Roobet, Binance, Gamdom, ChangeNOW, Shuffle, Alphapo, BC Game, and Metawin accounts. 

‍

Analysis was showing the Hyperliquid Whale's money didn’t exist in isolation. Links to so many major crypto gambling platforms and exchanges suggested 0xf3f’s funds came from – or were laundered through – these platforms. Gambling sites mix funds and hide their origin, scrubbing money fast; dirty funds flowing through a network of crypto casinos and exchanges would come out squeaky clean.

‍

But ZachXBT needed names. He noticed 0xf3f couldn’t help but brag about his $20M score on GMX and Hyperliquid. In a stunning slip-up, he’d signed a post on a Twitter (X) account: @qwatio. The signer “would have to control the related wallets in this cluster for the $20M number to be accurate”.

ZachXBT replied to the post, calling the Whale out. The post was deleted fast.

The Harpoon Strikes: A Phone Number Sinks the Hyperliquid Whale

‍

ZachXBT’s analysis for the @qwatio account owned by 0xf3f indicated it was not created organically. The Hyperliquid Whale had bought an existing crypto influencer account. OSINT research showed a recent name change, years of inactivity, and an account age verging on ancient – long outliving the Hyperliquid Whale’s saga. What’s more, familiar phishing sites were floating in the murky waters of @qwatio’s follow list. 

“I saw they follow @CryptxxCatalyst who posted links to multiple phishing sites + replied to people trying to trick them…” – @ZachXBT, Crypto and Blockchain Investigator [Source: Twitter (X)]

‍

The Whale was engaging with phishing marks. ZachXBT sought out @realScamSniffer, a regular tracker of phishing sites. They recognized the accounts @qwatio had replied to. The murk thickened. A public address was set as the drainer fee receiver on the projection[.]fi phishing site in Jan 2025. This wallet address belonged to 0x7ab, the Hyperliquid Whale. 0x7ab had directly received $17.1K from another phishing draining customer too, prior to tracking on his wallet.

It was clear that 0x7ab was the first EVM address 0xf3f had used. ZachXBT then traced the source to withdrawals on Solana from four casinos – and learned from one casino that the funds came from an input validation exploit on a game. They had negotiated post-exploitation with a now-defunct Telegram account: 7713976571.

‍

Employing OSINT, ZachXBT found three posts in the GMX group from the same Telegram ID; around the same time 0xe4d3 was trading on-chain. This was the Hyperliquid Whale again. 

Tracking down a recent payment from 0xe4d3 to an unnamed person, this payee volunteered that the Hyperliquid Whale was on the other end of the transaction. They also volunteered a UK phone number.

A UK phone number was enough to sink this Whale’s operation. Cue OSINT Industries.

‍

Exploring this alias exposed the 34-year-old UK resident, previously convicted in Finland  for stealing $1M from two casinos in 2023. Before this time, OSINT revealed ‘William Parker’ has been known as ‘William Peckover’, and before that, ‘Alastair Packover’ – attempting to launder his name in the same way he’d washed his dirty funds.

‘Alastair Packover’ had a digital presence of his own: multiple UK news headlines for fraud charges related to hacking, gambling and ‘computer misuse’. The names and ages matched. OSINT Industries had delivered the final strike in this Whale hunt. Our tool was the harpoon that speared ZachXBT’s prey at last. 

‍

This was the face of the Hyperliquid Whale.

“It is abundantly clear WP/AP has not learned his lesson over the years after serving time for fraud and will likely continue gambling.” – @ZachXBT, Crypto and Blockchain Investigator [Source: Twitter (X)]

ZachXBT thinks that the now-unmasked Whale is unrepentant; Parker’s actions indeed suggest that he’s unlikely to stop even now the kraken has been unleashed.

From his research, ZachXBT believes that the stolen funds William Parker played with currently sit in wallet address 0x51d99A4022a55CAd07a3c958F0600d8bb0B3992, awaiting his return. It remains to be seen whether Parker ‘appreciates’ the identification of his ill-gotten gains.

‘PS, Long Melania’: OSINT and the Future of Crypto Whale Hunting

‍

Since, William Parker has retreated into the weird world of MAGA memecoins.

Some see these semi-serious, irony-laden coins like TrumpCoin ($TRUMP) and MelaniaCoin ($MELANIA) as a symptom of shift in the crypto space. Fuelled by right-wing crypto enthusiasm and speculative pumps around political events – $TRUMP, for example, surged following Trump’s pro-crypto statements and "crypto reserve" pipe dream – these coins thrive in the the gray area between memetic hype, opportunistic cash grabbery, and outright scammery. Part satire, part speculative vehicle, and part financial grift, this is all right on-brand for the Whale. 

“Regarding commentary and questions on the 0xf3f4 user's ETH long: To be clear: There was no protocol exploit or hack…” – Statement by @HyperliquidX [Source: Twitter (X)]

Hyperliquid claims that no exploitation or wrongdoing took place in the Whale’s actions, but it’s clear this is another gray area. Timing trades with suspicious precision around market-moving events is not illegal in DeFi, but it raises legitimate ethical and transparency concerns in onlookers like ZachXBT. Hyperliquid’s refusal to wade past the shallows and address these deeper concerns — such as the Whale’s connections to phishing schemes, money laundering and gambling exploits — only muddies the water. The money was stolen, but the corporate crypto world seems uninquisitive about the source of funds flowing in. When "degen" culture embraces risk and manipulation as part of the game, the difference between an elite trader and a fraudster is increasingly a matter of perspective. 

This is where OSINT becomes a counter. As in this case, OSINT offers clarity; by independently tracking on-chain activity, unmasking pseudonymous actors, and exposing patterns of fraud, it’s easier to delineate when a borderline trader should be in hot water. Investigators like ZachXBT are using OSINT Industries and blockchain forensics to hold grifters accountable — the transparency and verification that centralized entities refuse to deliver. The tools clearly exist to separate whales from sharks from outright scammers; the real question is whether the crypto world has the will to use them.

Until then, the whale hunt is on.

To find out more about ZachXBT’s work, visit:

Site: Investigations By ZachXBT

Telegram: https://t.me/investigations

Of course, Twitter (X): @zachxbt 

‍