North Korean Hackers Move $30M Through Hyperliquid

North Korean hackers linked to the OFAC-sanctioned Lazarus Group have moved over $30 million through Hyperliquid's HyperUnit service, according to an August 31 report by Arkham researcher Emmett Gallic.

The funds were routed from addresses associated with the group and entered Hyperliquid as Bitcoin before being converted into Ether and Solana. They were then bridged across multiple chains, including Tron, Solana, and Ethereum, before reaching exchanges like KuCoin, LBank, and Kraken.

This is not the first time Hyperliquid has faced scrutiny over alleged DPRK-linked activity. In December 2024, the platform stated that reports at the time did not reflect an exploit and that no user funds had been lost.