Attacker wallet pre-strike probe (low-gas failing txs)

Evidence summary #

Hyperliquid's core contracts (HyperCore) are L1-native binary — no EVM contracts are exposed on Ethereum or Arbitrum for mempool probing via failing/low-gas transactions. Bridge2 on Arbitrum could theoretically be probed, but no failing-transaction pattern from DPRK-attributed wallets targeting Bridge2 specifically is documented in public sources. The DPRK trading activity was on-platform (L1 positions), not Bridge2 contract probes. Structural non-applicability to L1 surface; Bridge2 mempool probes not documented.

Sources #

Methodology #

Detect whether a wallet in a threat-actor cluster is sending low-gas or intentionally-failing transactions to this protocol (pre-strike reconnaissance pattern).

See the full factor methodology and distribution across all protocols →