Crypto wallets linked to the OFAC-sanctioned Lazarus Group moved $30 million in digital assets through Hyperliquid, weeks after regulators said they were working on a path to introduce the exchange into US markets.
Crypto wallet addresses linked to the North Korean state-affiliated hacker collective Lazarus Group moved $30 million in digital assets through the decentralized exchange Hyperliquid.
The Lazarus-tagged wallets sent funds to Hyperliquid and HyperUnit via Bitcoin (BTC), traded them into Ether (ETH) or Solana (SOL) and bridged them out to Tron, Solana or the Ethereum network, according to blockchain data shared by Arkham analyst Emmett Gallic in a Monday X post .
Ultimately, the deposits were sent to crypto exchanges KuCoin and Kraken, as well as Lbank, along with several unlabeled services based on the Tron network.
The transfers occurred weeks after US President Donald Trump said that Commodity Futures Trading Commission (CFTC) Chair Michael Selig was working on a regulatory pathway to introduce Hyperliquid into US markets, according to a speech during a White House event on Aug.
The Lazarus Group is the main suspect in some of the largest-ever cryptocurrency hacks, including the $1.4 billion hack of Bybit exchange in 2025, the industry’s largest so far.