Lazarus Group-linked wallets move $30M in crypto through Hyperliquid

Wallet addresses linked to the Lazarus Group, a North Korean state-affiliated hacking collective, moved $30 million in digital assets through Hyperliquid, a decentralized exchange. A decentralized exchange is a platform that lets users trade crypto directly without a central authority.

How the funds were moved

The wallets sent Bitcoin (BTC) to Hyperliquid and its token, HyperUnit, then swapped the funds into Ether (ETH) or Solana (SOL). The assets were later bridged to other networks, including Tron, Solana, and Ethereum, according to blockchain data shared by Arkham analyst Emmett Gallic. Finally, the funds were sent to crypto exchanges KuCoin, Kraken, and Lbank, as well as several unlabeled services on the Tron network.

Regulatory context

The transfers happened weeks after U.S. President Donald Trump stated that the Commodity Futures Trading Commission (CFTC) Chair was working on a regulatory path to introduce Hyperliquid into U.S. markets. Trump made the comment during a White House event on August 16.

Why this matters

The Lazarus Group is suspected of carrying out some of the largest crypto hacks, including the $1.4 billion Bybit exchange hack in 2025, the biggest in the industry so far. North Korea-linked actors were also tied to at least $578 million of the $634 million stolen in crypto-related incidents in April 2026.

Sources

• Cointelegraph