Hyperliquid Labs Denies North Korea Exploit Reports, Confirms All User Funds Secure

Hyperliquid, a prominent on-chain perpetual futures exchange, is under scrutiny following claims of wallet activity linked to North Korean hackers.

Following the allegation, the platform token HYPE dropped over 25%, from $34 to $25. The platform assured users that their funds remained secure and accounted for.

Security Dispute or Misunderstanding? Hyperliquid’s Response to Allegations of North Korean Hackers

The controversy began when Taylor Monahan, a security expert from MetaMask, reported suspicious trades involving wallets tied to North Korean hackers.

According to Monahan, these wallets traded ETH on Hyperliquid, resulting in liquidations exceeding $700,000.

DPRK's trading career is…uh….going…..🙈

tbh if i was the dude managing Hyperliquid's 4 validators (or those fucking ghetto ass binaries on gh) I would be shitting my pants right now.

Hyperliquid dudes dont seem worried at all though so im sure its fine. 🫠 pic.twitter.com/JrrU7t1sJe

— Tay 💖 (@tayvano_) December 22, 2024

On X (formerly Twitter), Monahan suggested the activity was not regular trading but potential vulnerability testing. “DPRK doesn’t trade. DPRK tests,” she posted.

The allegations triggered widespread user withdrawals. Data from Hashed’s Dune Analytics dashboard revealed over $194 million in USDC was withdrawn on Monday alone.

In response, Hyperliquid Labs denied any exploits or vulnerabilities on the platform. In a statement on its Discord channel, the team reassured users that funds remained secure.

The team stated,

“Hyperliquid Labs is aware of reports circulating regarding activity by supposed DPRK addresses; there has been no DPRK exploit—or any exploit for that matter—of Hyperliquid. All user funds are accounted for.”

Hyperliquid Labs: We are aware of reports circulating regarding activity by supposed DPRK addresses. There has been no DPRK exploit – or any exploit for that matter – of Hyperliquid. All user funds are accounted for. Hyperliquid Labs takes opsec seriously. No vulnerabilities have… https://t.co/VI46V2O00g

— Wu Blockchain (@WuBlockchain) December 23, 2024

The platform highlighted its robust security framework. This includes a bug bounty program and adherence to best practices in blockchain analytics.

Hyperliquid Labs also addressed allegations of unprofessional interactions with a security advisor. They stated that the advisor’s conduct prompted the team to consult trusted partners instead.

The allegations and subsequent market uncertainty immediately impacted Hyperliquid’s native token, HYPE.

The token dropped over 25%, from $34 on Sunday to a low of $25 on Monday. However, according to DexScreener, the price has since rebounded and is trading at $27.

Despite the controversy, Hyperliquid continues gaining traction. According to Dune Analytics, the platform accounts for over 55% of the trading volume of on-chain perpetual futures.

North Korean Hackers Steal Over $1.3 Billion in Crypto, Doubling 2023’s Theft Total

According to Chainalysis, North Korean hackers doubled their crypto thefts from 2023 to 2024, stealing over $1.3 billion.

In its Dec. 19 report, the firm revealed that these hackers were responsible for 47 incidents, accounting for 61% of all crypto thefts in 2024. This marked a sharp increase from $660 million stolen in 2023.

Chainalysis noted an increase in the size of individual heists. Attacks between $50 and $100 million and those exceeding $100 million were more common in 2024. The firm said the DPRK is improving at executing larger and faster exploits.

North Korean hackers have been linked to some of the most significant breaches in the crypto industry. U.S. authorities frequently sanction entities involved in the country’s laundering operations.

Despite the rise in DPRK-related hacks, global crypto hacking activity declined in the third and fourth quarters of 2024.

Chainalysis suggested North Korea may rely less on crypto theft due to closer ties with Russia. However, it warned of potential changes by year’s end, noting hackers often strike during holidays.

The timing of reduced activity after July 1 coincided with Russian President Putin’s visit to Pyongyang, though Chainalysis stated the connection remains unclear.