Lazarus-Linked Wallets Move Over $30M Through Hyperliquid as U.S. Explores Regulated Entry Arkham researcher Emmett Gallic said addresses linked to the OFAC-sanctioned North Korean hacking group Lazarus Group have recently moved more than $30 million through Hyperliquid, with activity continuing through Aug. 31. The funds entered Hyperliquid as BTC, were then converted into ETH and SOL, bridged to Tron, Solana and Ethereum, and ultimately sent to KuCoin, LBank, Kraken and several unlabeled Tron-based services. The activity comes as U.S. policymakers explore a regulated path for Hyperliquid to enter the U.S. market. President Donald Trump said earlier in August that CFTC Chairman Mike Selig was working on a pathway to bring Hyperliquid into the U.S. in a compliant and legal manner. Separately, Kraken parent Payward is in advanced talks with Hyperliquid Labs on a structure that could allow U.S. users to trade a subset of Hyperliquid-linked perpetual futures through regulated exchange and clearinghouse Bitnomial, subject to regulatory approval.

North Korea’s Lazarus Group cashes out $30M+ on Hyperliquid, Trump Jr. leads a $1B Polymarket raise, and Cronos halts its chain after a $75M exploit drains Tectonic. @jennsanasie has what you need to know.

🚨ALERT: North Korea-linked Lazarus Group wallets moved $30 MILLION in crypto through Hyperliquid, per Arkham data. The funds were converted from Bitcoin into ETH or SOL, bridged across several networks and ultimately deposited into KuCoin, Kraken, LBank and unidentified Tron-based services. Lazarus is suspected of carrying out the record $1.4 BILLION exchange hack in 2025.

North Korea's Lazarus Group and other bad actors thrive on gaps in our financial rules. The Clarity Act gives Treasury new sanctions authority and a safe harbor for companies to freeze suspicious transactions before the money moves.

KNOW YOUR ENEMY: LAZARUS GROUP North Korea’s state-backed hacking syndicate has stolen over $6B in crypto since 2017, using exploits, fake job offers, malware, OTC desks, mixers and bridges to launder funds. Our research team mapped their on-chain footprint. Check it out below:

The stolen funds from the Humanity Protocol and Kelp DAO exploits have now commingled on the Bitcoin network. Around 17 hours ago, the Humanity Protocol attacker transferred the remaining stolen funds 15,403 ETH ($23.6M) to a fresh address: 0xCCD5431EA669568464BAD1E0646bFf974020f003 About an hour ago, part of the funds commingled with funds linked to the Kelp DAO exploit, which was carried out in April 2026 and has been attributed to the Lazarus Group. So far, the Humanity Protocol attacker has laundered more than $8M of the stolen funds. Thanks to @zachxbt for the hat tip. Stay Smart