ChainCatcher message, on-chain detective ZachXBT criticized Hyperliquid on platform X, stating: "It is outrageous that Hyperliquid officials can manipulate prices at will, but when North Korean hackers use Radiant to steal funds and hold a significant short position on it, they remain indifferent."

ChainCatcher news reports that on-chain detective ZachXBT revealed that during his assistance in freezing Bybit hacker funds, he became acutely aware of the serious issues regarding security vulnerabilities and hacker attacks in the crypto industry. He stated that multiple "decentralized" protocols have recently derived almost 100% of their monthly trading volume and fees from the North Korean hacker group DPRK, yet these projects refuse to take any responsibility.Moreover, centralized exchanges (CEX) are slow to respond, allowing hackers to launder money in just a few minutes, while some CEXs take hours to take action. ZachXBT also criticized the KYT (Know Your Transaction) system for its serious flaws, which are easy to circumvent, and noted that the KYC (Know Your Customer) mechanism poses more of a data leak risk for ordinary users due to account leaks and insider issues, while being nearly ineffective in preventing the flow of illegal funds.He pointed out that North Korean hackers DPRK recently successfully laundered $1.4 billion, fully exposing the compliance and security system vulnerabilities within the industry, and expressed concern that only government-mandated regulations could lead to improvements in the industry.

ChainCatcher news, according to on-chain detective ZachXBT's post on his personal channel, a highly credible investigation into Tornado Cash asset theft shows that on March 11, 2025, after using Tornado Cash for mixing, North Korean hackers used part of the ETH funds to purchase 437.6 billion PEPE, worth 3.1 million dollars. A more detailed analysis reveals that the North Korean hackers encountered asset theft using a compromised Tornado Cash user interface.Previous news, according to Lookonchain monitoring, three wallets made large purchases of 689.79 billion PEPE (total value of approximately 4.3 million dollars), and their funds all came from Tornado Cash.

ChainCatcher news, according to TechCrunch, Aleksej Besciokov, co-founder of the Russian cryptocurrency exchange Garantex, was arrested by local police in Varkala, Kerala, India on March 12. The exchange had previously been sanctioned by the EU and the US government.Indian police confirmed that the arrest was based on a warrant issued by the Patiala House Court in New Delhi, executed at the request of the US government. A spokesperson for the US Department of Justice, Nicole Oxman, confirmed this news to TechCrunch but declined to comment further.Last week, the US Department of Justice charged Besciokov with personally approving transactions on Garantex related to North Korean government hackers and other cybercriminals, and filed criminal charges against him for assisting in money laundering through the cryptocurrency exchange. US authorities have frozen over $26 million in cryptocurrency assets and seized Garantex's website.

ChainCatcher news, Slow Mist founder Yu Xian posted on social media that the theft of 12,000 ETH last year was carried out by the Eastern European hacker group Inferno Drainer, not North Korean hackers. The money laundering methods have some overlap with North Korean hackers, making it very difficult to recover the funds.

ChainCatcher message, Slow Fog Yu Xian posted on platform X stating: "Although there is currently no clear evidence, based on the methods used for Safe multi-signature and the current money laundering techniques, it resembles North Korean hackers. North Korean hackers, if I have wronged you, please correct me, and I will apologize..."

ChainCatcher message, according to lmk.fun (formerly Scopescan) monitoring, the North Korean hacker who previously traded on Hyperliquid has had their $704,000 worth of ETH liquidated and currently holds $2,872.Previously, crypto KOL Tay stated on the X platform that he has monitored multiple flagged North Korean hacker addresses recently trading on Hyperliquid, with total losses exceeding $700,000.

ChainCatcher news, Slow Mist CISO 23pds posted on X: "North Korean hackers have launched a cyber attack named 'Operation 99' against Web3 and cryptocurrency software developers. This operation begins with fake recruiters on platforms like LinkedIn, luring developers with project testing and code reviews.Once the victims are hooked, they are directed to clone a malicious GitLab repository that appears harmless but is filled with disaster. The cloned code connects to a command and control (C2) server, embedding malware into the victim's environment, thereby taking control of the victim's computer."

ChainCatcher message, Slow Mist CISO 23pds posted on X: "The 'JustJoin' login page suspected of North Korean hackers has reappeared."

ChainCatcher news, according to The Block, the South Korean government has imposed sanctions on 15 North Korean individuals and one entity for their involvement in illegal cyber activities, including cryptocurrency theft. According to Chainalysis data, North Korean hackers stole $1.34 billion worth of cryptocurrency in 2024, accounting for 61% of the total stolen that year.The sanctioned individuals are all members of the 313 Bureau under the Ministry of Machine Industry of the Workers' Party of Korea, which has been under United Nations Security Council sanctions since 2016 and is responsible for North Korea's weapons production, including ballistic missile programs. The South Korean Ministry of Foreign Affairs stated that North Korean IT personnel often disguise their identities and travel to countries such as China, Russia, Southeast Asia, and Africa to obtain work orders from global IT companies while also engaging in information theft and cyberattacks.

ChainCatcher message, according to the official announcement, Hyperliquid Labs has stated that it is aware of reports regarding the alleged activities of North Korean hacker addresses. In fact, Hyperliquid has not suffered any attacks from North Korean hackers—nor has any form of attack occurred. All user funds are being managed properly.Hyperliquid Labs takes operational security very seriously. No party has disclosed any vulnerabilities. As always, Hyperliquid Labs offers a generous reward program for vulnerability reports and adheres to industry best standards for blockchain analysis.Previously, someone claimed to be from the security side and attempted to contact Hyperliquid Labs. To clarify, Hyperliquid Labs has never received any allegations regarding an attack on its platform. This party added a scam account to the group chat and subsequently communicated with us using insults and profanity. Given the level of professionalism displayed, Hyperliquid Labs confirmed with trusted parties to ensure that it is following best practices.

ChainCatcher news, according to CoinDesk, the perpetual contract trading platform HyperLiquid experienced a record net outflow of 60 million USDC on December 23.Previous news, according to hacker behavior observer Tay, addresses suspected to be linked to North Korean hackers have incurred losses exceeding 700,000 dollars on the platform, possibly testing the platform's vulnerabilities.

ChainCatcher news, according to a report by Cointelegraph, Radiant Capital stated in an updated investigation report on December 6 that the cybersecurity company Mandiant has assessed with high confidence that the attack was carried out by threat actors affiliated with North Korea (DPRK).The platform mentioned that a Radiant developer received a Telegram message on September 11, which contained a compressed file from a "trusted former contractor," requesting feedback on a new project they were planning. Upon review, this message was suspected to be from threat actors allied with North Korea impersonating the former contractor. "This ZIP file, when shared with other developers for feedback, ultimately delivered malware that facilitated the subsequent intrusion."Radiant Capital believes that the threat actors responsible for the incident are referred to as "UNC4736"—reportedly associated with North Korea's main intelligence agency, the Reconnaissance General Bureau (RGB), and speculated to be a subgroup of the hacking organization Lazarus Group.Previous report stated that the cross-chain lending protocol Radiant Capital suffered a cyber attack, resulting in losses exceeding $50 million.

According to ChainCatcher news reported by Cointelegraph, North Korean hackers appear to have developed malware that can evade Apple's security checks. Researchers at Jamf Threat Labs, who focus on Apple, indicate that these applications seem to be experimental. This is the first time they have seen such technology used to infiltrate Apple's macOS operating system, but it does not run on the latest systems.Researchers found that Microsoft's VirusTotal online scanning service reported these applications as harmless, but they are actually malicious. Variants of these applications are written in Go and Python, utilizing Google Flutter applications. Flutter is an open-source development toolkit used for creating cross-platform applications.Out of six malicious applications, five are signed with developer accounts and have been temporarily notarized by Apple. Researchers wrote, "The domains and techniques in the malware are very similar to those used in other North Korean hacker malware, with indications that the malware was once signed and even temporarily passed Apple's notarization process."

ChainCatcher news, according to The Block, the Federal Bureau of Investigation (FBI) has indicated that North Korean cybercriminals are "actively targeting" employees in the Web3 industry to steal cryptocurrency funds.In a press release issued on Tuesday, the FBI noted that North Korean criminals have deployed sophisticated social engineering strategies to deceive individuals at cryptocurrency and decentralized finance (DeFi) companies, thereby "compromising networks associated with cryptocurrency assets." Such schemes pose a "persistent threat" to entities holding significant amounts of cryptocurrency or related products.The FBI further stated: "In recent months, North Korean malicious cyber actors have researched various targets related to cryptocurrency exchange-traded funds (ETFs). This research includes preparatory work before actions, indicating that North Korean attackers may conduct malicious cyber activities targeting companies associated with cryptocurrency ETFs or other cryptocurrency-related financial products."In addition to researching potential targets, North Korean cybercriminals also impersonate well-known members within companies or fabricate false scenarios (tailored to the victim's background, skills, or business interests) to gain and exploit their trust.

ChainCatcher message, Microsoft cybersecurity researchers have discovered a zero-day vulnerability in the Chromium engine, which powers browsers like Chrome. This vulnerability has been exploited by a North Korean hacker group known as Citrine Sleet, specifically targeting cryptocurrency users. Citrine Sleet has used a rootkit malware called FudModule to create fake cryptocurrency trading platform websites, luring users into downloading malware or weaponized cryptocurrency wallets, thereby gaining remote code execution access to steal the victims' crypto assets. This vulnerability was patched on August 21, and users are urged to update their browsers as soon as possible to ensure safety. This is the third exploited Chromium zero-day vulnerability this year.