Crypto Sleuth Claims Mysterious $20M ‘Hyperliquid Whale’ Is Tied To Illicit Activity

Crypto detective ZachXBT alleged that the mysterious “Hyperliquid whale” that’s been making headlines across the crypto community is suspected to be a convicted criminal from the UK. The trader has made around $20 million in profit from leveraged trading, raising questions about their identity.

On Thursday, ZachXBT shared an investigation revealing the “Hyperliquid Whale” as a British hacker previously charged with multiple crimes. The trader’s identity has been a hot topic among crypto investors over the past few weeks.

According to the X thread, the trader was identified as William Parker, known as Alistair Packover, before he changed his name. Parker was arrested and sentenced in Finland in 2024 for stealing nearly $1 million from two online casinos in 2023.

Since January 2025, the trader has made millions by opening several highly leveraged positions on Hyperliquid and GMX but gained attention this month for two specific trades.

Right before US President Donald Trump’s “Strategic Crypto Reserve” announcement on March 2, the whale opened a large Ethereum (ETH) and Bitcoin (BTC) long position on 50X leverage using address 0xe4d3.

Following this trade, the crypto community speculated that the whale could be an insider, with some users alleging that the trader was linked to the Trump family due to their timing. Meanwhile, others suggested that the mysterious whale was tied to the North Korean hacking group Lazarus.

The trader later opened a BTC short position on 40X leverage using address 0xf3F4, profiting $19 million from the two positions. After the whale closed its short position earlier this week, the crypto sleuth revealed that the trader was allegedly involved in illicit activity.

“It’s funny watching CT speculate on the ‘Hyperliquid whale’ when in reality it’s just a cybercriminal gambling with stolen funds,” he initially responded to the speculation.

In the thread, ZachXBT shared four key counterparties of the 0xf3f address, including 0xe4d3, which he had identified. He also noted that the cluster was tied to Roobet, Binance, Gamdom, ChangeNOW, Shuffle, Alphapo, BC Game, and Metawin accounts.

Additionally, the 0xf3f signed a message on-chain with an X account under the username @qwatio, which has seemingly been purchased recently.

After the crypto detective’s initial claims, the X user denied the cybercrime allegations and claimed the $20 million profits from the GMX and HL trades were clean and traceable on the blockchain.

However, the on-chain investigator alleges that “he would have to control the related wallets in this cluster for the $20M number to be accurate.” Notably, an address in the cluster, 0x7ab, was found to have received funds from a phishing scam and an exploited casino game on Solana.

Then, ZachXBT tracked down a recent payment from 0xe4d3 and obtained a UK phone number that seemingly connects the trader and the name William Parker.

I tracked down a recent payment from 0xe4d3 to an unnamed person who confirmed they had been paid by the HL trader. They provided a UK phone number used to communicate with them. Public record reveals the name William Parker is likely tied to this number.

The crypto sleuth concluded that Parker, who was also convicted three times in the early 2010s for crimes related to fraud, hacking, and gambling, has now “gambled 6 figs into $20M using high leverage on-chain” for the past two months, and will likely continue to do so.