Written by Zoltan Vardaistaff writerReviewed by Robert Lakinstaff editor

Written by Zoltan Vardaistaff writer

Reviewed by Robert Lakinstaff editor

Lazarus Group-linked addresses move $30M through Hyperliquid

Latest NewsPublishedSep 1, 2026

Crypto wallets linked to the OFAC-sanctioned Lazarus Group moved $30 million in digital assets through Hyperliquid, weeks after regulators stated they were working on a path to introduce the exchange into US markets.

Crypto wallet addresses linked to the North Korean state-affiliated hacker collective Lazarus Group moved $30 million in digital assets through the decentralized exchange Hyperliquid.

The Lazarus-tagged wallets sent funds to Hyperliquid and HyperUnit via Bitcoin (BTC), traded them into Ether (ETH) or Solana (SOL) and bridged them out to Tron, Solana or the Ethereum network, as reported by blockchain data shared by Arkham analyst Emmett Gallic in a Monday X post.

Ultimately, the deposits were sent to crypto exchanges KuCoin and Kraken, as well as Lbank, along with several unlabeled services based on the Tron network.

The transfers occurred weeks after US President Donald Trump stated that Commodity Futures Trading Commission (CFTC) Chair Michael Selig was working on a regulatory pathway to introduce Hyperliquid into US markets, as reported by a speech during a White House event on Aug. 16. 

The Lazarus Group is the main suspect in some of the largest-ever cryptocurrency hacks, including the $1.4 billion hack of Bybit exchange in 2025, the industry’s largest so far.

North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April. 

Related: Humanity Protocol’s $36M loss tied to suspected North Korean hackers: Quantstamp

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Hacks
• Hackers
• Scams
• Cybercrime
• Cybersecurity
• Donald Trump
• Decentralized Exchange
• Scams & Cybercrime

More on the subject

More Markets lending reserve drained for $9.3M: Blockaid

Aug 31, 2026

Zoltan Vardai

Real Trump Coins denies launching GOLD token, blames ‘bad actors’

Aug 30, 2026

Helen Partz

Trump-promoted brand touts GOLD before token collapse

Aug 29, 2026

Helen Partz

More Markets lending reserve drained for $9.3M: Blockaid

Aug 31, 2026

Zoltan Vardai

Real Trump Coins denies launching GOLD token, blames ‘bad actors’

Aug 30, 2026

Helen Partz

Trump-promoted brand touts GOLD before token collapse

Aug 29, 2026

Helen Partz