Wallet addresses tied to the OFAC-sanctioned Lazarus Group transferred $30 million in digital assets through Hyperliquid, according to blockchain intelligence shared by Arkham analyst Emmett Gallic on Monday.
The North Korean state-backed hacking collective routed Bitcoin into Hyperliquid and HyperUnit, converted the proceeds to Ether or Solana, then bridged them across the Tron, Solana and Ethereum networks, Arkham data shows.
Final destinations included the exchanges KuCoin, Kraken and Lbank, alongside several unidentified services operating on Tron.
The movement came weeks after President Donald Trump disclosed on Aug. 16 that Commodity Futures Trading Commission Chair Michael Selig was preparing a regulatory framework to grant Hyperliquid access to US markets.
Lazarus remains the leading suspect behind the $1.4 billion theft from Bybit in 2025, the largest cryptocurrency exchange hack on record.
In April alone, North Korea-linked actors accounted for at least $578 million of the $634 million stolen across all crypto-related incidents that month.
Source: cointelegraph.com