Lazarus Group-linked wallets move $30M through Hyperliquid

Crypto wallets associated with the North Korean state‑affiliated hacker collective Lazarus Group transferred roughly $30 million in digital assets through the decentralized exchange Hyperliquid.

Transaction flow

The addresses first sent Bitcoin (BTC) to Hyperliquid and its related service HyperUnit, where the funds were swapped for Ether (ETH) or Solana (SOL). The converted assets were then bridged to the Tron, Solana, or Ethereum networks before being moved to other platforms.

Final destinations

After bridging, the assets were deposited on several centralized exchanges, including KuCoin, Kraken, and Lbank, as well as on unnamed services operating on the Tron network.

Regulatory context

The transfers occurred shortly after U.S. officials indicated that the Commodity Futures Trading Commission was exploring a regulatory pathway to allow Hyperliquid to operate in U.S. markets.

Background on Lazarus Group

Lazarus Group is linked to some of the largest cryptocurrency thefts, notably the $1.4 billion hack of the Bybit exchange in 2025. In April, North Korea‑linked actors were associated with at least $578 million of the $634 million stolen in crypto‑related incidents.