Written by Zoltan Vardaistaff writerReviewed by Robert Lakinstaff editorLazarus Group-linked addresses move $30M through Hyperliquid
Latest NewsPublishedSep 1, 2026
Crypto wallets linked to the OFAC-sanctioned Lazarus Group moved $30 million in digital assets through Hyperliquid, weeks after regulators said they were working on a path to introduce the exchange into US markets.
Crypto wallet addresses linked to the North Korean state-affiliated hacker collective Lazarus Group moved $30 million in digital assets through the decentralized exchange Hyperliquid.
The Lazarus-tagged wallets sent funds to Hyperliquid and HyperUnit via Bitcoin (BTC), traded them into Ether (ETH) or Solana (SOL) and bridged them out to Tron, Solana or the Ethereum network, according to blockchain data shared by Arkham analyst Emmett Gallic in a Monday X post.
Ultimately, the deposits were sent to crypto exchanges KuCoin and Kraken, as well as Lbank, along with several unlabeled services based on the Tron network.
The transfers occurred weeks after US President Donald Trump said that Commodity Futures Trading Commission (CFTC) Chair Michael Selig was working on a regulatory pathway to introduce Hyperliquid into US markets, according to a speech during a White House event on Aug. 16.
The Lazarus Group is the main suspect in some of the largest-ever cryptocurrency hacks, including the $1.4 billion hack of Bybit exchange in 2025, the industry’s largest so far.
North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April.
Related: Humanity Protocol’s $36M loss tied to suspected North Korean hackers: Quantstamp
Subscribe to daily byte-sized crypto news from Cointelegraph
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
More on the subject
