TLDR:Investigators linked the POPCAT setup to 26 wallets coordinating a 25M dollar buy wall signal.The attacker absorbed a 4M dollar loss while Hyperliquid liquidity providers lost 4.9M dollars.Wallet traces connected multiple OKX and Bybit deposits to earlier manipulation activity.Funding trails led researchers to wallets associated with BTX Capital and its founder.The sudden turbulence around POPCAT trading on Hyperliquid has drawn fresh attention to a coordinated setup tied to large capital flows. Investigators tracked a complex series of wallets that supported a $25 million buy wall shortly before the orders vanished. The setup created sharp price distortions that wiped out traders and damaged Hyperliquid’s liquidity pool. The emerging trail now ties back to wallets linked to BTX Capital.POPCAT manipulation traced to coordinated walletsAnalysts monitoring the event reported that more than 26 wallets placed the large buy wall near 0.21 dollars on November 12. They noted that the orders created the appearance of strong demand before the attacker pulled them, which caused rapid liquidations. Data shared on social platforms showed that the attacker lost 4 million dollars in collateral while Hyperliquid’s liquidity provider absorbed 4.9 million dollars in losses. Investigators believe the attacker offset these losses by shorting the token on a centralized exchange with larger capital.The wallet identified as 0x0A11 funded seven additional wallets and appeared in an earlier manipulation involving TST. That wallet received 0.003 ETH from 0xad67, which also transferred 0.0457 ETH to 0x9e8 before funds later reached 0xf6c. Records show that 0xf6c sent gas funds to 0xc10, which deposited 598,615 USDT to OKX two days later.Investigators highlighted more deposits tied to related wallets. OKX Deposit 1 received 688,700 USDT from 0xbBf4 and sent 393,980 USDT to another OKX address. OKX Deposit 2 received 593,000 USDT from 0x01c8, which also funded 0xC0a before a 506,000 USDT Bybit deposit.Investigation into how @BTX_Capital and its founder @vc_btxcap are behind the token manipulation like $POPCAT on @HyperliquidX . They leverage their access to large capital to manipulate token prices and profit from it. pic.twitter.com/7BHmRmegxo— Specter (@SpecterAnalyst) November 13, 2025Blockchain trail leads to BTX Capital connectionsThe Bybit deposit wallet later received 50 million AKI tokens from a Polygon multisig created by 0xf97. That wallet was funded on Ethereum by the public address of BTX Capital founder Vanessa Cao. Analysts also noted that 0xf97 received 1 POL from a BTX Capital-linked wallet on Polygon earlier in the year. These linked transactions supported claims from market researchers tying BTX Capital to recent token volatility.Investigators described BTX Capital as a trading and investment firm with large liquidity reserves. They noted its activity around liquid token strategies and pointed to the scale of funding required for the POPCAT setup. As earlier reported by Blockonomi, POPCAT has faced intense market pressure from coordinated moves that disrupted normal trading activity. Market researchers now connect the firm to similar patterns in tokens such as ZEREBRO, JELLYJELLY, and HIFI.Analysts summarized the approach as a dual-venue setup. The attacker used Hyperliquid to create the manipulation while taking the opposite position on a centralized exchange. They viewed the structure as a straightforward way to profit from artificial moves without relying on long exposure.The post BTX Capital Faces On-Chain Scrutiny After POPCAT Market Shock appeared first on Blockonomi.