I worked directly on DPRK's biggest bridge hack ever (Ronin), helped track BSC bridge hackers off-chain, and was at Apple in the security team at the time of the Pegasus spyware so I consider myself somewhat of an expert here. I'd recommend the

@HyperliquidX

team to do the following asap: 1) Hop on a call with

@tayvano_

2) Get new laptops + ledgers / AWS Nitro Enclaves (new AWS org & permissions) / HSMs 3) Create new bridge quorum keys from the new laptops and ledgers following the best key management practices 4) Work with Tay and

@_SEAL_Org

to submit the rotation transactions with the new quorum keys 5) Run a full scan of your devices and infra with Mandiant or Crowdstrike 6) Run a few more audits on the DEX and internal infra via

@trailofbits

@dguido

My gut instinct is that DPRK likely already has access to the internal infra and work laptops via 0-day. It could be any form of phishing such as a pdf or any other type of document opened by the team in the last few months, with additional lateral movements which they've done countless times in the past. DPRK is known to spend a lot of time within the victim's infrastructure to maximize the impact of the attack and the efficiency of the withdrawal flow. Happy to hop on a call as well

@chameleon_jeff

but it'd be good to get in touch with Tay here really