Crypto wallet addresses linked to the North Korean state-affiliated hacker collective Lazarus Group moved $30 million in digital assets through the decentralized exchange Hyperliquid. The Laz
Crypto wallet addresses linked to the North Korean state-affiliated hacker collective Lazarus Group moved $30 million in digital assets through the decentralized exchange Hyperliquid.
The Lazarus-tagged wallets sent funds to Hyperliquid and HyperUnit via Bitcoin (BTC), traded them into Ether (ETH) or Solana (SOL) and bridged them out to Tron, Solana or the Ethereum network, according to blockchain data shared by Arkham analyst Emmett Gallic in a Monday X post.
https://x.com/emmettgallic/status/2094529501493383311
Ultimately, the deposits were sent to crypto exchanges KuCoin and Kraken, as well as Lbank, along with several unlabeled services based on the Tron network.
The transfers occurred weeks after US President Donald Trump said that Commodity Futures Trading Commission (CFTC) Chair Michael Selig was working on a regulatory pathway to introduce Hyperliquid into US markets, according to a speech during a White House event on Aug. 16.
The Lazarus Group is the main suspect in some of the largest-ever cryptocurrency hacks, including the $1.4 billion hack of Bybit exchange in 2025, the industry’s largest so far.
North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April.
Related: Humanity Protocol’s $36M loss tied to suspected North Korean hackers: Quantstamp
