A new investigation from on-chain researcher @SpecterAnalyst is pointing toward one of the most aggressive market manipulation attempts seen on Hyperliquid this quarter, and the trail leads directly to BTX Capital and its founder, Vanessa Cao. According to the analyst, a coordinated attack involving 26 wallets, a $25 million artificial buy wall, and a web of transactions tied to OKX, Bybit, and prior $TST manipulation campaigns resulted in $4.9 million in losses for Hyperliquid’s liquidity provider (HLP). Meanwhile, the attacker likely covered their personal losses by taking the opposite position on centralized exchanges. Investigation into how @BTX_Capital and its founder @vc_btxcap are behind the token manipulation like $POPCAT on @HyperliquidX . They leverage their access to large capital to manipulate token prices and profit from it. pic.twitter.com/7BHmRmegxo — Specter (@SpecterAnalyst) November 13, 2025 The evidence paints a picture of a sophisticated price-action stunt designed to trigger liquidations, and a trading firm with enough capital to absorb millions in collateral losses to profit elsewhere. The Setup: A $25M Buy Wall That Never Intended to Fill On November 12 around 4PM UTC, Hyperliquid’s order books for $POPCAT suddenly showed life. A buy wall worth ~$25 million appeared near the $0.21 level. The signal was clear: heavy demand. That demand wasn’t real. More than 26 wallets placed synchronized orders to push sentiment upward. Traders reacted instantly, opening leveraged long positions into what looked like a major bullish move. Then the entire wall disappeared. The attacker pulled the bids, drained liquidity beneath the price, and triggered a chain reaction of forced liquidations across the board. The result: Attacker’s own collateral loss: ~$4 million HLP losses: ~$4.9 million Real profit engine: short positions on centralized exchanges This pattern matches textbook manipulation, except the financing behind it points to a deeper operation. The Wallet Trail: From POPCAT to TST to BTX Capital The wallets used in the $POPCAT stunt didn’t appear out of nowhere. Blockchain tracing shows the main wallet 0x0A11…773C3 was previously involved in the $TST manipulation event months prior. That wallet funded seven additional wallets in the POPCAT operation. From there, the chain grows: On August 4, the TST-linked wallet received 0.003 ETH from 0xad67. 0xad67 sent 0.0457 ETH to 0x9e8, which forwarded assets to 0xf6c. 0xf6c funded 0xc10, which deposited 598.6K USDT into OKX on August 10. The OKX deposit wallet involved, 0x71b578…, shows even more activity: Received 688.7K USDT from 0xbBf4 on July 3 Deposited 393.9K USDT to another OKX wallet on June 4 That secondary OKX wallet received 593K USDT from 0x01c8 on May 11 The same 0x01c8 wallet also funded fees for 0xC0a, which later deposited 506K USDT into a Bybit account: 0xaE7A4A99Db2d7eE28aE244F05a1833388321Ab72 This Bybit wallet is where the story turns unmistakable. It received 50 million $AKI tokens on Polygon from a multisig wallet (0x6cb) created by 0xf97. And 0xf97 connects directly to Vanessa Cao: On Ethereum, funded by vanessacao.eth On Polygon, funded by BTX Capital’s own wallet on March 6 These links position BTX Capital and its founder at the heart of the funding chain behind the wallets used in the POPCAT manipulation. BTX Capital’s Role: “Liquid Token Strategies” Taken Literally BTX Capital describes itself as a “liquid trading and investment firm” focused on liquid token strategies. Founded in 2019, the firm markets itself as a sophisticated player capable of moving large amounts of capital quickly. The investigation suggests they may be taking this mission statement quite literally. The size of the POPCAT buy wall, and the willingness to burn $4 million in personal collateral, signals a firm with deep liquidity and a high tolerance for risk when paired with profitable off-chain positioning. This isn’t the first time analysts have flagged tokens possibly influenced by BTX. The firm is suspected of involvement in several sudden, unnatural pumps on Hyperliquid, including: $ZEREBRO $JELLYJELLY $HIFI and potentially $ZEC In every case, the pattern is similar: on-chain manipulation, off-chain profit capture. UPDATE: @BTX_Capital just deleted every single post, repost, and reply except one on their page following my investigation into them being behind the $POPCAT manipulation. I was able to get their page look https://t.co/cetJ8OqzsE pic.twitter.com/DfXleV2XAM — Specter (@SpecterAnalyst) November 14, 2025 How They Profit: Manipulate On-Chain, Hedge Off-Chain The strategy is simple but deadly efficient. Step 1: Manipulate token price using overwhelming buy or sell pressure on Hyperliquid. Step 2: Wait for traders to take the bait. Step 3: Trigger liquidations through sudden reversals. Step 4: Capture profit using large short or long positions on centralized exchanges where liquidity is deeper and slippage is low. This is why the attackers could afford losing millions on Hyperliquid. Their real gains likely happened on OKX or Bybit. Unusual Silence: BTX Capital Wipes Its Page Perhaps the most telling moment came after the investigation surfaced. @BTX_Capital deleted every post, repost, and reply on their X account except one. The timing aligns precisely with @SpecterAnalyst publishing the wallet evidence. The move has only intensified suspicion. Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on Twitter @nulltxnews to stay updated with the latest Crypto, NFT, AI, Cybersecurity, Distributed Computing, and Metaverse news !
