Lazarus Group Ties to Hyperliquid Emerge Amid US Market Entry Plans
Crypto wallets linked to the North Korean state-affiliated hacker collective Lazarus Group moved $30 million in digital assets through the decentralized exchange Hyperliquid. This is according to blockchain data shared by Arkham analyst Emmett Gallic, which shows that the Lazarus-tagged wallets sent funds to Hyperliquid and HyperUnit via Bitcoin (BTC), traded them into Ether (ETH) or Solana (SOL), and bridged them out to Tron, Solana, or the Ethereum network. The transfers ultimately ended up on crypto exchanges KuCoin and Kraken, as well as Lbank, with several unlabeled services based on the Tron network also receiving funds.
The Lazarus Group is suspected in some of the largest-ever cryptocurrency hacks, including the $1.4 billion hack of Bybit exchange in 2025. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April. This latest move through Hyperliquid occurred weeks after US President Donald Trump said that Commodity Futures Trading Commission (CFTC) Chair Michael Selig was working on a regulatory pathway to introduce Hyperliquid into US markets.