ZachXBT: Mysterious Hyperliquid Whale Suspected of Fraudulent History, Leveraged Operations Yielding $20 Million Reveal Its Footprints
High Leverage, Big Profits: Accurate Moves on Bitcoin and Ethereum
Famous on-chain investigator ZachXBT recently released a report pointing to a mysterious trader who earned over $20 million in a short time on Hyperliquid and GMX. The trader’s true identity might be related to several fraud and hacking cases. This trader is suspected of using leveraged trades to precisely position around political and economic events, and has connections to gambling platforms, phishing websites, and money laundering addresses. The real identity behind the trader is William Parker, who was previously convicted of fraud and casino theft in the UK and Finland, and was known as Alistair Peckover in the past.
Leverage-Driven Profits: Precise Moves on Bitcoin and Ethereum
According to ZachXBT’s on-chain tracking, from January to March 2025, a trader (0xe4d3) used positions with up to 50x leverage to make substantial gains. They went long on BTC and ETH right before Trump’s announcement of the “Crypto Reserve” plan, making around $10 million on one trade. Later, using another address (0xf3F4), they shorted BTC, earning $9 million. These high-stakes trades quickly caught the attention of the crypto community, sparking curiosity about who this big trader might be.
Before Trump’s announcement on crypto reserves, 0xe4d3 held large long positions in ETH and BTC with 50x leverage (profit: $10 million).
0xf3F4 took large BTC short positions with 40x leverage (profit: $9 million).
Trader’s Address Connections: Ties to Gambling Platforms and Phishing Scams
ZachXBT conducted an in-depth analysis of the trader’s address interactions and transfer records (e.g., 0xf3F4, 0xe4d3), discovering that these addresses had extensive interactions with gambling or high-risk platforms, such as Roobet, Binance, Gamdom, Shuffle, Alphapo, and BC Game. Additionally, they interacted with well-known phishing exchange platforms like ChangeNOW and Metawin.
One critical address, 0x7ab8…, was found to have received a “drainer fee” from the phishing site projection[.]fi in January 2025, and even received transfers from other scam victims. These signs suggest that the trader was not merely engaging in “smart trading,” but was likely involved in illegal profit-making.
More evidence of 0xf3F’s identity. 0xf3F signed a post for the X account @qwatio, stating they earned $20 million on GMX and Hyperliquid. This indicates they must control the relevant wallets within this cluster to match the $20 million figure. After ZachXBT commented on X, the post was deleted.
ZachXBT believes that an analysis of the X account used by 0xf3F suggests it was likely purchased at some point (based on recent name changes, inactive years, and age of the account). He also found that this account followed @CryptxxCatalyst, which posts many links to multiple phishing websites, attempting to deceive those who interact with them.
From Solana to Ethereum: Funds Leak Reveals Flaws
ZachXBT further discovered that the earliest source of funds for this group of addresses came from an exploit of a gambling chain vulnerability on Solana. After contacting one of the casinos involved, ZachXBT confirmed that the funds originated from an “input validation exploit” and that negotiations with the trader had taken place through a now-deleted Telegram account.
Through open-source intelligence (OSINT), he further found that the Telegram user had posted in the GMX group, seeking help at the same time the trading activity occurred, providing additional evidence of the trader’s identity.
Payment Records Expose the Trader’s True Identity: William Parker
Ultimately, ZachXBT found that address 0xe4d3 had made a payment to someone, and through a UK phone number provided by the recipient, he linked it to a man named William Parker. This individual had been arrested and convicted in Finland in 2023 for stealing around $1 million from two casinos.
The investigation also revealed that William Parker had previously used the name Alistair Peckover (also known as William Peckover) and had made headlines in the early 2010s in the UK for internet fraud and gambling-related crimes. These patterns of behavior align with his current activities, suggesting that he has not reformed.
Funds Location and Current Status
Currently, most of the funds remain concentrated in the address: 0x51d99A4022a55CAd07a3c958F0600d8bb0B39921, which has not yet fully moved or been laundered.
ZachXBT emphasized that William Parker/Alistair Peckover clearly has not learned from his past mistakes and has returned to old habits even after serving time. This case serves as a warning about the risks of decentralized finance platforms and exposes how the combination of anonymity and high leverage allows long-time fraudsters to return to the “stage.”
Risk Warning
Cryptocurrency investments carry high risks, and their prices can fluctuate wildly. You may lose all of your principal. Please carefully assess the risks.
