The Great Shakeouts and Fakeouts

Heads up: we’ve written about this before, and it looks like it’s happening again. Read the Oct 20, 2026 update →

October 7, 2026 · Investigations · Robb Schrader

Updated Oct 20, 2026

By Robb Schrader · Research and drafting by the AI Corp Inc team (Ernest Reyes, Sam Ortega)

At 9:56:59 PM Eastern on Tuesday, Oct. 6, a single taker sell of about $4.38 million (279 fills) hit Coinbase’s BTC-USD market, roughly 1.2 seconds before Binance and OKX broke $85,000, six milliseconds apart (timing provisional; exchange clocks aren’t synced, and who placed the order is unknown). That price was also bitcoin’s one-hour 200-period moving average. What followed was a market-wide flush. XRP fell to as low as 1.4290 (lows varied by venue; Binance’s 5-minute low was 1.4345, a 3.93% drop), ether fell 3.57% and bitcoin about 2%, and roughly $415 million in positions was liquidated in the next hour, 97% of them longs, according to CoinGlass data reported by BeInCrypto. Over 24 hours, CoinGlass counted $609 million, $545 million of it longs (BlockBeats). Iran’s stepped-up tanker attacks had pushed Brent crude above $101, a risk-off backdrop, though no headline lines up with the break itself (CoinDesk).

The break itself took minutes. The run-up took most of the day.

Around 11 AM, US government wallets sent a tiny test transfer to Coinbase Prime. By 1:53 PM the tracker TimechainIndex had tallied 833.6 BTC moved that day, alongside 40,285 BNB. Reporting traces the coins to the HashFlare, Bitfinex and Alameda cases (CoinDesk, CryptoBriefing). Between 7:46 and 7:56 PM, four separate exchange hot wallets on Arbitrum, at least two with confirmed Coinbase labels, sent round amounts of USDC to four brand-new addresses: $500,000, $200,000, $175,000 and $125,000, or $1.0 million in total. The money went into Hyperliquid through its standard deposit contract. Between 8:04 and 8:16 PM, each wallet opened a 40x bitcoin short, about $12.5 million combined (Lookonchain).

That sequence invites a question: did someone know something? This article treats that as an open question, not an answer. The public record pushes hard the other way. The government transfer was visible on-chain and posted on X six to nine hours before the shorts, so no inside information was needed to know about it. No shared address, label or timing pattern links the government coins to the four wallets. Researchers found no bank, lobbyist or member-of-Congress connection, and no evidence of insider trading. As of 9:33 AM on Oct. 7, the wallets had not withdrawn a dollar and held roughly $315,000 in unrealized gains, with nothing realized, and were not among the day’s top Hyperliquid winners, whose shorts were already open before the event. An analyst weighting of causes rates an ordinary forced-sale cascade at 35% and the wallet cluster at 5%. By that weighting, the wallets positioned early but did not cause the move.

What follows sets out what is proven, what is not, and where the system leaves room for doubt.

How it unfolded

Key points

1. On Oct 6, ~$415M in crypto positions was liquidated in about an hour, 97% of them longs, after BTC broke $85K at 9:57 PM ET. Here’s what the public record shows, and what it can’t. h/t @realOscarRamos1 @KobeissiLetter
2. ~11 AM ET: US gov wallets began moving seized BTC to Coinbase Prime. By 1:53 PM, 833.6 BTC had moved, plus BNB (~$103M total). No sale confirmed. (via @TimechainIndex, @arkham, @CoinDesk; first flagged by @kyledoops, @AshCrypto)
3. 7:46–7:56 PM ET: 4 new wallets got round USDC ($1.0M total) from exchange hot wallets, at least 2 Coinbase-labeled. By 8:16 PM: ~$12.5M in 40x BTC shorts. Now up ~$315K, but NOT among the top winners. Who’s behind them? Public data can’t say. (via @lookonchain)
4. Insider? Open question; evidence pushes back. The gov move was public hours before the shorts. 9:56:59 PM ET: a ~$4.38M Coinbase sell hit ~1s before $85K broke (provisional); who placed it is unknown. Top winners were already short pre-event. (via @EmberCN, @OnchainLens)
5. Still open: who sees forfeiture moves before they’re public, and where the oversight gaps are. Only subpoenaed exchange records could unmask the wallets. Full breakdown coming soon. Follow for updates.

Read the thread on X: https://x.com/aicorpinc_David/status/2107841859657912781

Sources: CoinGlass data via BeInCrypto and BlockBeats; CoinDesk and CoinDesk; CryptoBriefing; TimechainIndex; Lookonchain; Hyperliquid public API; DOJ Money Laundering, Narcotics and Forfeiture Section.

Not financial advice. These are my own predictions and experiments, not recommendations to buy or sell anything. Do your own research.

Update, Oct 20, 2026: it’s happening again

Two weeks after the Oct 6 flush, our on-chain watch picked up a new set of brand-new wallets moving about $1 million into Hyperliquid overnight. All times below are Eastern. Every figure comes from our own watch data (on-chain observations from Tron, Arbitrum and the Hyperliquid public API), last checked at 8:38 AM ET.

Timeline (Oct 20, ET)

• 2:17–2:18 AM: An unlabeled Tron wallet (TXwGkk…o6nP) sends exactly 400,000 USDD to TRaGL6…ZSkJ and exactly 600,000 USDD to TSLVQe…FBzc. Both receiving wallets were created on Oct 20.
• 2:26 and 2:31 AM: The two wallets swap to 400,000 and 600,000 USDT on Tron.
• 2:28–2:36 AM: deBridge orders convert Tron USDT to Arbitrum USDC. A deBridge solver (a bridge, not an exchange) fills them. One receiving wallet, 0x4505…b289, got fills from both Tron wallets, which links the group.
• 2:36–2:40 AM: Four new Arbitrum wallets, each making its very first transaction, deposit through Hyperliquid’s bridge. They are credited between 2:36:49 and 2:40:37 AM: 0x7aa1…50b8 $242,601, 0x4505…b289 $256,320, 0x3154…a3a8 $245,147 and 0xe2b2…8eef $253,760, or $997,828 in total.
• 7:22–7:27 AM: Each wallet sends almost its whole balance to another brand-new Hyperliquid wallet (0x0565…19e7, 0x9286…336b, 0x2a05…6771 and 0x13e5…06cd).
• 7:56–8:00 AM: Those four empty into two more brand-new wallets: 0xf701…e05e ($498,918) and 0xf38b…017f ($498,904).
• 8:25:48 AM: 0xf38b…017f sends 498,904.01 USDC to Hyperliquid’s USDC system address (0x2000…0000). Per Hyperliquid’s documentation, a send to a token’s system address is a transfer from HyperCore to HyperEVM, so the funds moved to the HyperEVM side under the same address. About $0.02 is left on HyperCore.
• 8:38 AM (latest check): 0xf701…e05e still holds 498,918.42 USDC on HyperCore. Neither final wallet has any perps balance, positions, fills or open orders. No wallet in this chain has opened a short.

Meanwhile, the four Oct 6 wallets described above still hold their 40x bitcoin shorts, entered at $85,486 to $85,577. As of 8:38 AM they had made no trades in six hours and no deposits or withdrawals in 24 hours, with breakeven stop orders still in place.

How it lines up with Oct 6

• Fresh wallets: On Oct 6, four brand-new addresses received the money. Today, every hop lands in brand-new addresses again. That looks like the same habit of starting with clean wallets.
• Round amounts: On Oct 6 the deposits were $500,000, $200,000, $175,000 and $125,000. Today the upstream amounts were exactly 400,000 and 600,000, and $1 million in total again. The per-wallet amounts on Hyperliquid were not round, because of bridge fills.
• Bridging into Hyperliquid: On Oct 6, USDC moved on Arbitrum into Hyperliquid’s standard deposit contract. Today’s route went through deBridge from Tron, but it ended at the same Arbitrum-to-Hyperliquid door. That is consistent with the same destination, by a different road.
• Timing: Oct 6’s deposits came in a ten-minute evening window. Today’s four deposits landed within about four minutes, in the middle of the night.
• Consolidation: Today’s money was split four ways, moved again, then merged into two wallets of about $499,000 each. Minutes later, one of the two moved its half off Hyperliquid’s trading layer to HyperEVM. That is consistent with funds being staged, though staged for what isn’t visible.

What this doesn’t show

No wallet in the new chain has opened a short or any other position. The single most important piece of the Oct 6 pattern is missing. We don’t know who controls any of these wallets, and nothing on-chain ties them to the Oct 6 wallets. The funding source is different (Tron USDD through deBridge, not Coinbase-labeled hot wallets), and the per-wallet amounts weren’t round. Splitting, hopping and merging funds is also what ordinary treasury management, market makers, OTC desks and privacy-minded traders do every day. This is a record of observed transfers, not evidence of wrongdoing, and it is not a prediction about price. We’ll update this if anything changes.

Sources: AI Corp Inc on-chain watch data (Tron ledger, deBridge DLN fills, Arbitrum transactions and the Hyperliquid public API), observed Oct 20, 2026 from 2:55 to 8:38 AM ET; Hyperliquid public API (ledger, account, spot and open-order endpoints); Hyperliquid docs on HyperCore–HyperEVM transfers. Addresses are shortened. Not financial advice.

← All writing