Lazarus Group moves $30 million via Hyperliquid

Wallets attributed to the North Korean hacker group Lazarus Group have moved more than $30 million in Bitcoin through the DeFi platform Hyperliquid over the past few weeks. This is reported by Arkham researcher Emmett Gallic. The activity coincides with plans by US policymakers to offer Hyperliquid regulated access to the American market.

In brief:

• Lazarus Group wallets moved over $30 million via Hyperliquid, with transactions running up to 31 August 2026.
• The funds arrived as Bitcoin and were then converted into Ethereum and Solana, subsequently channelled to exchanges including KuCoin and Kraken.
• At the same time, US regulators are working on a legal access route for Hyperliquid to the American market.

Bitcoin channelled to multiple exchanges

According to Gallic, the addresses were already identified in 2024 by blockchain researcher zachxbt as wallets linked to $61 million in stolen funds. The most recent transaction dates from 28 August, involving the transfer of over 244 Bitcoin worth $19.42 million.

The funds entered Hyperliquid as Bitcoin and were then converted into Ethereum and Solana. From there, they were sent via bridges to the Tron, Solana and Ethereum networks. Ultimately, the funds ended up at exchanges such as KuCoin, LBank and Kraken, as well as at several unidentified services on the Tron network.

Regulated US access and talks with Kraken

The Lazarus Group is on the sanctions list of the US OFAC, the agency responsible for enforcing financial sanctions. The fact that US wallets on Hyperliquid remain accessible to this group comes at a sensitive time. President Donald Trump said earlier this month that CFTC chairman Mike Selig is working on a route that would allow Hyperliquid to enter the American market in a legal and regulated manner.

At the same time, Payward, the parent company of Kraken, is in advanced talks with Hyperliquid Labs about a structure in which US users could trade a limited offering of Hyperliquid-linked perpetual futures through the regulated exchange and clearinghouse Bitnomial. That structure still requires approval from regulators.

The combination of active sanctions evasion and ongoing talks about regulation is putting pressure on the access plans for Hyperliquid in the US.