Blockchain data reviewed by CoinDesk shows wallets tied to North Korea’s Lazarus Group sold more than $30 million in bitcoin on the platform in the last three weeks alone.
A two-minute price shock in a Hyperliquid market tied to South Korea’s SK Hynix has put the mechanics and oversight of equity-linked perpetuals under scrutiny.
SKHX, a TradeXYZ-operated perpetual on Hyperliquid that tracks the US dollar value of one Korean SK Hynix share, briefly sank to $927 during South Korea’s pre-market window before recovering within roughly two minutes, according to local media.
A later DefiLlama snapshot put open interest at $407 million, down 20% over 24 hours, while 24-hour trading volume reached $959 million. Open interest measures the rolling value of outstanding positions, incorporating changes in both position size and price.
The underlying market was already under severe pressure. South Korea’s KOSPI closed 10.84% lower after a 20-minute marketwide circuit breaker, while SK Hynix’s Korean shares finished down 14.65% at 1.55 million won, Yonhap reported.
TradeXYZ’s contract specification defines SKHX as the dollar value of one SK Hynix common share, calculated by converting the Korean share price at the prevailing USD/KRW rate. TradeXYZ documents an external-pricing window from 8:00 a.m. to 8:50 a.m. Korean time. SKHX is separate from the company’s US-listed depositary receipt and from tokenized shares.
From price input to liquidation
Hyperliquid’s HIP-3 specification gives a market deployer control over its oracle definition, oracle prices, leverage limits and settlement. The deployed market uses HyperCore’s order books and margin system.
TradeXYZ says its relayers compute and transmit the XYZ market’s oracle, mark and external prices about every three seconds. HyperCore handles matching, margining, liquidations and auto-deleveraging. In the documented design, TradeXYZ supplies the bespoke price inputs and HyperCore applies its risk machinery to the resulting mark.
The HIP-3 deployer API accepts an oracle price, an external-perpetual price and as many as two deployer-supplied mark-price inputs. HyperCore contributes a local price derived from the best bid, best offer and latest trade. TradeXYZ says the final mark is the median of the oracle, a smoothed oracle-to-market difference, and that local order-book price.
The rulebook shows how SKHX pricing is meant to work. The plunge to $927 is still a black box, with the raw observations and mark-price ingredients absent from the public record. DefiLlama names Pyth Lazer as the oracle provider. TradeXYZ says its relayer and updater carry prices into HyperCore. The incident-level handoff between those systems remains the missing piece.
BlockMedia reported at 18:41 Korean time that Hyperliquid said TradeXYZ was investigating and planned an update after reaching a conclusion. At that cutoff, the reviewed sources contained no official incident report or event-specific account of compensation, insurance impact, a halt, a cap change, or slashing.
HIP-3’s allocation of controls is clear even as responsibility for this price shock remains open: the deployer operates the oracle settings, and HyperCore executes the market and risk functions. TradeXYZ’s findings will determine whether the episode reflected the published design under extreme conditions or a price-feed safeguard that needs revision.
A malicious attachment delivered through a phishing email points to the involvement of North Korea-linked threat actors in Humanity Protocol’s recent hack, according to blockchain security company Quantstamp.
The decentralized identity company said a compromised employee’s laptop enabled attackers to steal $36 million in Humanity (H) tokens on Monday.
The malicious attachment was disguised as a token lockup schedule update from South Korean cryptocurrency exchange Bithumb. It installed malware that gave attackers full remote access to the laptop, Quantstamp said in its incident response.
The phishing email that led to the Humanity Protocol compromise. Source: Quantstamp
Quantstamp added that the malware was signed with a South Korean Hancom digital certificate, a pattern it described as “characteristic of DPRK intrusions.” The malware enabled attackers to copy Humanity Protocol director Chong Yee Wai’s MetaMask wallet credentials and private keys.
The suspected North Korean link would add to a series of major crypto thefts attributed to the country. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April.
North Korean hackers tied to some of the largest crypto hacks
According to a May report by blockchain security company CertiK, the same actors have been linked to about $2 billion of the $3.4 billion lost to crypto exploits in 2025, while accounting for 12% of total incidents. CertiK said the figures reflect a focus on “precision and scale.”
Over the past decade, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents, the report said.
Related: CZ sounds alarm as ‘SEAL’ team uncovers 60 fake IT workers linked to North Korea
CertiK added that North Korea has “industrialized” crypto theft into a core state revenue mechanism, making these operations a substantial share of the regime’s external income.
Total DPRK crypto theft over the years. Source: CertiK/Skynet
North Korea rarely responds to cybercrime allegations, but on May 3, a Foreign Ministry spokesperson rejected them in a statement carried by the Korean Central News Agency, the country’s state media.
The spokesperson accused the US of spreading “incorrect” narratives about the “non-existent ‘cyber threat’” from North Korea.
Magazine: Coinbase hack shows the law probably won’t protect you — Here’s why
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Make preferred on
South Korea’s Kbank has signed a strategic partnership with Ripple to test blockchain-based overseas remittances, placing a bank with a central role in Upbit’s KRW account access beside one of crypto’s longest-running payments infrastructure firms.
Local reports describe the work as a technical verification, or proof-of-concept, focused on whether Ripple’s infrastructure can improve the speed, cost, and transparency of overseas remittances. ZDNet Korea separately described the test as part of a phased push around bank-linked overseas remittance infrastructure.
For now, the commercial pieces remain open: launch date, customer access, fees, live volume, and the exact settlement asset.
Kbank already sits inside South Korea’s crypto market through Upbit’s real-name account system. Its Ripple pilot, therefore, lands as more than a remittance experiment: it tests whether bank-side crypto infrastructure can move from exchange access toward ordinary cross-border payments while the product design and rulebook remain unfinished.
What Kbank and Ripple are testing
The Kbank-Ripple agreement points to bank integration rather than a standalone crypto app. Local reports said Kbank CEO Choi Woo-hyung and Ripple APAC head Fiona Murray attended a signing ceremony at Kbank’s Seoul headquarters, with the companies discussing a Ripple digital-wallet proof-of-concept, support for Kbank’s overseas remittance model, and broader digital-asset cooperation.
The sequence starts with a separate app-based remittance structure. The next step virtually links customer accounts and internal systems to test remittance stability, checking whether blockchain remittance rails can be mapped onto account and operations layers that resemble the systems a regulated bank would actually use.
That second phase also reportedly tests on-chain transfers involving corridors such as the UAE and Thailand. The corridor detail makes the PoC more operationally specific than a generic partnership announcement while keeping the commercial model open.
Palisade brings the wallet and custody layer into the test. Global Economic said the second phase uses or evaluates Ripple’s SaaS-based digital wallet Palisade, while Ripple’s own Palisade acquisition announcement describes the platform as wallet-as-a-service and custody tooling with features aimed at institutional digital-asset operations.
That makes the test a wallet and key-management exercise as much as a transfer-speed exercise. Production deployment by Kbank remains unannounced.
The technical focus is still meaningful. A bank remittance product has to solve compliance, custody, account linkage, settlement, and broader regulatory requirements. The PoC appears to test parts of that stack, while the full commercial design remains open.
Why Upbit changes the stakes
Kbank’s role in Upbit’s fiat access gives the Ripple test its market-structure relevance. The bank was moving to extend its real-name deposit and withdrawal account partnership with Upbit through October 2026, according to ChosunBiz.
Upbit’s own real-name account verification guide says deposit and withdrawal account verification is possible only with Kbank.
Taken together, the partnership report and Upbit’s guide make Kbank the bank behind Upbit’s KRW real-name deposit and withdrawal account verification rail. They do not show Upbit participating in the Ripple PoC or Kbank running the test on Upbit’s behalf.
The size of the Upbit relationship explains why the context has force. Upbit-linked funds accounted for about 24% of Kbank’s 30.4 trillion won deposit balance as of the third quarter of 2025, according to Korea JoongAng Daily.
The same report quoted Choi discussing Kbank’s need to reduce reliance on Upbit while positioning stablecoins and cross-border payments as future opportunities.
Kbank’s crypto-linked banking role has been built around exchange access. The Ripple test examines whether similar bank-side plumbing can be used for payments.
The first use case is account access for trading. The next possible use case is cross-border money movement. Between those two sits the unresolved question of regulation.
That context should not be stretched into Upbit participation. Upbit explains why Kbank’s banking role matters to South Korea’s crypto rails; the Ripple agreement remains a Kbank-side remittance PoC.
CryptoSlate’s prior coverage helps define the surrounding terrain. A June 2025 article covered South Korean banks pursuing a won-backed stablecoin push, while an April 2026 CryptoSlate report on Ripple’s RLUSD in Japan showed how bank trust can shape Asian stablecoin adoption.
Regulation keeps the test provisional
South Korea’s bank-led stablecoin debate gives the remittance test a policy edge. The Kbank pilot is already being tied to South Korea’s stablecoin rulemaking debate, while Seoul Economic Daily reported that delayed digital-asset legislation has kept some Korean blockchain and remittance infrastructure from moving into actual operations.
Banks can test the mechanics before they know the final rulebook. They can examine wallet architecture, account linkage, compliance controls, and cross-border flows. They can also build optionality without committing to a product launch.
Note: Kbank, the South Korean internet-only bank in the Ripple partnership, should be kept separate from Thailand’s KASIKORNBANK, often branded KBank.
KASIKORNBANK has appeared in related Korea-Thailand digital-asset remittance discussions, including a February cooperation announcement with Orbix and BPMG. The connection is corridor context and naming clarity, while the South Korean Kbank and Thailand’s KASIKORNBANK remain separate institutions.
The practical split is straightforward: what the pilot tests, what remains undecided, and why Kbank’s Upbit rail gives the work market weight.
| Confirmed | Still open | Operational implication |
|---|---|---|
| Kbank and Ripple signed a strategic partnership for remittance technical verification. | No production launch date or customer rollout has been confirmed. | The work remains a bank-side PoC before customer rollout. |
| The current phase virtually links customer accounts and internal systems and tests UAE/Thailand on-chain transfers. | The exact settlement asset, fee model, and live transaction volume remain undisclosed. | The test targets bank integration, but the commercial model is still undefined. |
| Upbit account verification for deposits and withdrawals is available only with Kbank, according to Upbit’s guide. | Upbit has not been identified as a participant in the Ripple PoC. | Kbank’s exchange-rail position gives the test relevance while exchange integration remains unsupported. |
| South Korea is still working through stablecoin and digital-asset payment rules. | The final rule set for bank-led digital remittances remains unsettled. | Regulation is a key gate between technical readiness and commercial launch. |
The next test is commercial proof
Kbank is now sitting between two roles. One is already visible: banking access for Upbit’s KRW deposit and withdrawal verification.
The other is being tested: blockchain-based overseas remittances that connect with bank accounts and internal systems.
That bridge has strategic value because South Korea’s crypto market already depends on tightly controlled bank-account rails. If a bank tied to those rails can also make blockchain remittances operational, the boundary between exchange access and payment infrastructure becomes less fixed.
The same compliance-heavy banking layer could become a place where crypto-linked infrastructure moves from trading access into cross-border money movement.
For now, the PoC covers testing, corridors, account-system simulation, and Palisade evaluation. It does not yet provide the commercial pieces that would turn the work into a live remittance business.
The next threshold is concrete: a named product, a live customer flow, a settlement asset, a fee model, and regulatory clearance.
Until those pieces arrive, Kbank’s Ripple partnership is best read as a readiness test with unusually important surroundings. It shows that one of South Korea’s key crypto-linked banking rails is examining the payments infrastructure.
It also shows how much still depends on regulation before a technical pilot can become a real remittance business.
Over the weekend, hackers stole more than $290 million in cryptocurrency from Kelp DAO, a protocol that allows users to earn yields on idle crypto investments.
By Monday, LayerZero, one of the projects affected by the hack, accused North Korea of carrying out the heist. The hack is now the largest crypto theft of the year so far, following an earlier hack at crypto exchange Drift in April that netted hackers around $285 million.
Per its post on X, LayerZero said the hackers exploited Kelp DAO via its LayerZero bridge, which allows different blockchains to send instructions to each other. The hackers then took advantage of Kelp’s own security configuration, which did not require multiple verifications before approving transactions. That allowed the hackers to siphon off the funds with fraudulent transactions.
The company cited “preliminary indicators” that point to North Korea as the culprit, in particular its hacking group that targets crypto known as TraderTraitor.
Kelp DAO responded to LayerZero blaming it for the theft instead.
In the last few years, North Korean hackers working for Kim Jong Un’s regime have become highly successful at stealing crypto. Last year, North Korean hackers stole more than $2 billion in crypto. Overall, since 2017, the total amount of stolen crypto by North Korea is said to be around $6 billion.
- Shin Hung-song has left his Bank for International Settlements role.
- South Korean tech firms await green light to launch stablecoins.
- Shin has warned South Korean stablecoins may spark capital outflow.
South Korea’s incoming central bank chief is a crypto-sceptic who could derail industry leaders’ and lawmakers’ hopes of launching won-pegged stablecoins.
So say media outlets in the East Asian nation, after President Lee Jae-myung nominated the Bank for International Settlements’ Monetary Economy Bureau chief Shin Hung-song for the governorship of the Bank of Korea on March 22.
“Won-denominated stablecoins are a shortcut to effectively neutralising existing foreign exchange regulations,” Shin said in August, South Korean news agency Yonhap reported. “By exchanging stablecoins for dollar-denominated cryptocurrencies on blockchain protocols, [South Korea] could open a channel for capital outflow.”
Some of South Korea’s biggest, stablecoin-keen firms have been left in the lurch for months as government officials talk up imminent stablecoin legislative developments.
Pre-election promises
Shin “will step back from his duties with immediate effect” following his selection as BOK nominee, the BIS wrote in a statement.
Observers are waiting to see if Shin will change his tune on stablecoins after taking the helm at the BOK, Yonhap wrote.
Lee made won-pegged stablecoin issuance a key manifesto issue ahead of his election last year. But so far, the BOK has resolutely stood in the way of his governing party’s attempts to launch legislation.
Unnamed industry insiders said it was “a matter of great interest” to see what stance he would take on stablecoins.
A BIS report, published last year, warned that “stablecoins do not fulfil the role of stable currency.”
“Due to a lack of regulation, they could pose risks to financial stability and monetary sovereignty,” the report’s authors wrote.
South Korea’s top tech firms want to issue won-denominated coins to help them boost cross-border trade.
But the BOK says that allowing them to do so could undermine its efforts to control fiscal policy.
Crypto market movers
- Bitcoin is trading at $68,306 on Sunday, down by over 3% in the past 24 hours.
- Ethereum prices have fallen to $2,073 in the past day, a 24-hour drop of almost 4%.
What we’re reading
Tim Alper is a News Correspondent at DL News. Got a tip? Email him at tdalper@dlnews.com.
A South Korean crypto criminal begged for a shorter sentence. The judge doubled it instead – DL News
- A South Korean man received a suspended sentence from the district court.
- The High Court handed him a four-year jail term instead.
- Defendant used crypto to launder $68,000 from victims of voice phishing.
A man’s bid to reduce his sentence for using crypto to launder $68,000 for a voice phishing gang has failed spectacularly — with an appeals court sending him to jail.
The unnamed man, aged in his 30s, was sentenced to four years of probation by a district court in 2024, the South Korean newspaper Kyeonggi Shinmun reported.
The same court also sentenced him to two and a half years in jail, but eventually suspended the sentence for four years.
A probationary period means he would need to check in with a probation officer on a regular basis. Under suspension, if he were to commit another crime during that time, he would be sent to prison.
Unhappy with this verdict, the man appealed to the Suwon High Court in the hope of reducing his sentence.
That backfired.
Instead of cutting his sentence, the court reversed the suspension order and jailed the man for four years.
The appeals court ruled that the defendant was “not merely a participant” in the voice phishing ring, but said he’d “played a key role” and that it couldn’t accept the district court’s decision to suspend the sentence.
Criminal may strike again
The man worked with a South Korean voice phishing ring, converting victims’ funds into an unnamed cryptocurrency before sending them to an address in China, prosecutors told the court.
The ring’s members posed as public prosecutors and called victims to warn them that criminals had stolen their identities and opened bank accounts in their names.
They then warned victims that their assets were at risk, advising them to withdraw their funds and send them to “safe” bank accounts.
These accounts, however, were under the ring’s control, and they were emptied as soon as they received the victims’ money.
The defendant’s legal team told the court he had agreed to compensate the victims for their losses.
The court was unimpressed, noting that the man was a repeat offender with prior links to voice phishing scams.
“The court has seen evidence that the defendant referred to himself as ‘a person in charge.’ He received daily reports on the ring’s operations and played a key role in the voice phishing crimes,” said the judge.
“He gave orders to other members of the organisation.”
The judge said it had no choice but to issue “a severe punishment commensurate with the defendant’s degree of involvement.”
The court concluded that the man had clearly not learned from his prior mistakes.
“Even though he was fully aware of the illegality and social harm of his actions, he reoffended,” the judge concluded. “As such, there is a high possibility he will commit further crimes of this nature.”
Under South Korean law, the man retains the right to appeal to the Supreme Court, which has the power to extend his sentence if it rejects his appeal.
Tim Alper is a news correspondent at DL News. Got a tip? Email him at tdalper@dlnews.com.
In brief
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
