Community Trust ScoreVerified
Thirty million dollars. That’s how much crypto linked to the Lazarus Group just moved through Hyperliquid — and the timing couldn’t be more awkward for U.S. regulators.
Blockchain data tied wallets connected to the sanctioned North Korean hacker collective to a series of transfers routed through Hyperliquid, a decentralized exchange that’s been quietly climbing the ranks of crypto trading platforms. Analyst Emmett Gallic flagged the movement in a recent post, laying out a trail that’s pretty hard to ignore. Funds went into Hyperliquid and HyperUnit via Bitcoin, got converted to Ether or Solana, then bridged out to the Tron, Solana, and Ethereum networks. From there, the deposits landed on exchanges including KuCoin and Kraken, plus Lbank and several other unlabeled services sitting on the Tron network. A lot of stops. A lot of networks. Clearly deliberate.
Not subtle.
The Regulatory Timing Is Brutal
All of this happened shortly after former U.S. President Donald Trump dropped Hyperliquid’s name at a White House event on August 16th. Trump said CFTC Chair Michael Selig was actively exploring a regulatory framework to bring Hyperliquid into U.S. markets. That’s a big deal for any offshore decentralized exchange — basically a green light from the top that Washington is paying attention and maybe wants a piece of the action.
And then, weeks later, wallets tagged to one of the most wanted cybercriminal organizations on the planet start running tens of millions through the same platform. The optics are rough.
It’s unclear whether Hyperliquid had any knowledge of the flagged wallets or what, if anything, the platform can actually do about it given its decentralized structure. No statement from Hyperliquid appeared in the source material. The exchange didn’t respond publicly, at least not in any way that’s been reported so far.
Lazarus Group’s Crypto Theft Record
The Lazarus Group isn’t some fringe operation. It’s a state-affiliated hacking collective with a track record that would make most cybercriminals look like amateurs. The group pulled off a $1.4 billion heist from Bybit in 2025 — probably the single largest crypto theft on record. That alone put them in a different category.
But it didn’t stop there. In April, North Korean-linked threat actors were reportedly behind $578 million of the $634 million stolen across crypto-related incidents that month. One month. Those numbers are staggering, and they paint a picture of an operation that’s growing faster than the industry’s defenses can keep up.
The Lazarus Group’s method here — Bitcoin in, Ether or Solana out, then bridge across multiple chains before hitting centralized exchanges — is basically the playbook for making funds hard to follow. Each hop adds friction for anyone trying to trace the money. By the time assets hit KuCoin or Kraken, they’ve passed through enough networks that reconstructing the original trail takes serious time and resources. That’s the point.
Decentralized exchanges are particularly useful for groups like this because there’s no KYC gate at the front door. Anyone with a wallet can deposit. That’s a feature for regular users who value privacy. For sanctioned actors, it’s something else entirely.
What This Means for Hyperliquid’s Regulatory Future
The bigger question is what happens next for Hyperliquid itself. The CFTC framework that Selig is reportedly working on would, in theory, bring the platform under U.S. oversight — which means compliance requirements, reporting obligations, and probably some version of sanctions screening. That’s exactly the kind of infrastructure that might have caught these transfers earlier, or at least created a paper trail.
But the Lazarus Group’s use of the platform before any of that framework is in place kind of makes the case for why it’s needed. Decentralized doesn’t mean consequence-free, and regulators have been making that argument louder and louder across the industry.
It’s worth noting that moving funds through a platform doesn’t automatically mean the platform is complicit. Blockchain is permissionless by design. What it does mean is that the platform becomes part of a very public, very uncomfortable story at the worst possible moment — right as it’s trying to get Washington’s blessing to operate inside U.S. markets.
Exchanges like KuCoin and Kraken, which received the transferred funds downstream, face their own questions. Both platforms have compliance teams and are subject to sanctions screening requirements. Whether those systems flagged any of the incoming transfers isn’t clear from the available information.
Gallic’s analysis put the full route on record. The funds moved. The wallets are tagged. And the CFTC is watching a platform that just became the latest chapter in the Lazarus Group’s very long, very expensive story.
The $30 million figure is on the smaller end of what the group has moved in recent months — but the destination made it anything but routine.
Frequently Asked Questions
How much did the Lazarus Group move through Hyperliquid?
Wallets linked to the Lazarus Group transferred $30 million in digital assets through Hyperliquid, according to blockchain data flagged by analyst Emmett Gallic.
What regulatory plans involve Hyperliquid and the CFTC?
Former U.S. President Donald Trump said at a White House event on August 16th that CFTC Chair Michael Selig was working on a regulatory framework to bring Hyperliquid into U.S. markets.
What other major hacks is the Lazarus Group linked to?
The Lazarus Group was behind the $1.4 billion Bybit hack in 2025 and was reportedly responsible for $578 million of the $634 million stolen in crypto incidents in April alone.
Why It Matters
The movement of $30 million linked to the Lazarus Group through Hyperliquid underscores ongoing concerns about the use of decentralized exchanges for illicit activities, particularly in light of heightened regulatory scrutiny from the CFTC. This incident not only raises questions about the effectiveness of compliance measures within the decentralized finance space but also highlights the challenges regulators face in balancing innovation with the need for security and oversight in the rapidly evolving crypto landscape. As the market grapples with the implications of such activities, the incident could lead to increased calls for stricter regulations on decentralized platforms.
