Lazarus Group-linked addresses move $30M through Hyperliquid
Summary
Wallets linked to North Korea’s Lazarus Group moved about $30 million in crypto through Hyperliquid and HyperUnit. The funds were routed from Bitcoin into Ether or Solana, then bridged to Tron, Solana, or Ethereum before ending up at exchanges including KuCoin, Kraken, and Lbank, plus several Tron-based services. The activity came weeks after comments that US regulators were exploring a path for Hyperliquid to enter US markets. Lazarus remains a major crypto security threat and is tied to some of the largest hacks, including the $1.4 billion Bybit breach in 2025. North Korea-linked actors were also connected to most of the crypto stolen in April.
