Hyperliquid Labs debunks DPRK links, but experts are unsure

Hyperliquid Labs, the team behind HYPE’s $28 billion FDV token, has denied claims that North Korean hackers infiltrated its layer-1 protocol.

Hyperliquid Labs (HYPE) shared an announcement refuting any connection between whale activities and a possible exploit planned by hackers in the Democratic People’s Republic of Korea. According to a message posted on the project’s Discord server, “no vulnerabilities have been shared by any party,” and white hats can submit bug reports as part of a “generous bug bounty program.”

On December 23, a HYPE whale sold 1 million tokens amid speculation that North Korean hackers were actively trading on the layer 1 blockchain. Security veterans such as MetaMask developer Taylor Manohan have noted that hackers, possibly part of the infamous Lazarus Group, may be looking for the vulnerability.

North Korea’s business career…uh….goes…..🙈

tbh, if I were the guy running Hyperliquid’s 4 validators (or those damn ghetto ass binaries on gh) I’d be shitting my pants right now.

The Hyperliquid guys don’t seem worried at all, so I’m sure he’s fine. 🫠 pic.twitter.com/JrrU7t1sJe

— Tay 💖 (@tayvano_) December 22, 2024

The data showed that wallets labeled North Korea conducted on-chain swaps and lost approximately $700,000. “Yes, North Korea does not trade. As community members search for answers, Taiwano, as Manohan is known online, is testing North Korea.

We know that reports are circulating regarding the activities of so-called North Korean addresses. There has been no exploitation of Hyperliquid in North Korea, or any abuse for that matter. All user funds are accounted for. Hyperliquid Labs takes opsec seriously.

Hyperliquid Labs via Discord

The hyperfluid fiasco

The issue escalated on social media when HYPE owners criticized Manohan for spreading FUD, an acronym for “fear, uncertainty, doubt” around Hyperliquid.

But industry leaders like Polygon CISO Mudit Gupta, Coinbase director Conor Grogan, and podcaster Laura Shin backed Manohan, highlighting the benefits of his security advice. Specifically, Gupta echoed Manoha’s recommendation to tighten security by decentralizing multi-signature permissions and addressing central points of failure.

The Hyperliquid bridge is controlled by two 3/4 hot wallet multisignatures managed by a single binary system.

I would advise them to increase this threshold and eliminate the single point of failure rather than attacking security researchers.

If they need help, the SEAL will still be happy to help.

— Mudit Gupta (@Mudit__Gupta) December 23, 2024

North Korean hackers stole nearly $2 billion from crypto users and protocols this year alone. The FBI warned in September that Lazarus was aggressively targeting digital asset trading venues, and bad actors in North Korea are suspected of siphoning over $4 billion in cryptocurrency over the years.

There are no more than 4 validators and they all run the same code, probably located in the same location. Centralized infrastructure, building systems, etc. are maintained and accessed by an unknown number of founders, senior managers, and engineers; These people use the same devices they use to talk to access the systems in question…

— Tay 💖 (@tayvano_) December 23, 2024