Hyperliquid, a Layer 1 blockchain and decentralized exchange, faced sharp declines in its token value and total value locked (TVL) this weekend after reports surfaced of possible involvement by North Korean hackers.
Security expert Taylor Monahan flagged suspicious wallet activity linked to the Democratic People’s Republic of Korea (DPRK) on December 22, leading to a 20% drop in the HYPE token price and TVL.
Monahan, who works with MetaMask, revealed that DPRK-linked addresses had been liquidated for $458,000 on Hyperliquid.
In her posts, Monahan warned that the Democratic People’s Republic of Korea’s activities resembled exploration rather than trade, writing that “The Democratic People’s Republic of Korea does not trade. DPRK tests,” indicating a possible future attack.
Hyperliquid’s TVL fell from $2.56 billion to $2.05 billion, while the HYPE token fell from $34 to $27 before partially recovering.
The Hyperliquid Labs team denied any infringement in an official statement on Discord, saying:
“There has been no DPRK exploitation – or any exploitation whatsoever – of Hyperliquid.”
The team added that a security researcher had contacted them but cited “unprofessional behavior” as a reason for rejecting their assistance and had instead opted to consult with trusted third parties.
Cygaar, a developer and contributor to the Abstract chain, assured the community that measures such as freezing USDC or rolling back the chain could be implemented in the event of an exploit.
He added:
“I wouldn’t completely panic about this at this point; there are guardrails in place should the worst possible outcome happen.”
The incident highlights the ongoing risks of cyberattacks in the DeFi sector, where DPRK-linked hackers are increasingly targeting vulnerabilities to fund state operations.
At the time of writing, Hyperliquid’s HYPE token had largely recovered from the past day’s decline and was trading around $313, after rising 15%.1
