Abnormal gas-price willingness from attacker wallet

Evidence summary #

DPRK-attributed wallets used standard gas prices during their October–December 2024 Hyperliquid trading activity. Activity was exploratory reconnaissance (position testing), not a MEV-race or priority-fee-escalating exploit attempt. No 5× EMA priority-fee spike from attacker wallets documented. Signal does not fire.

Sources #

Methodology #

Detect whether a wallet pays ≥5× median gas priority fee (indicating MEV race or urgency), interacting with this protocol.

See the full factor methodology and distribution across all protocols →