Wallet addresses associated with the North Korean Lazarus Group moved $30 million in cryptocurrency through the decentralized exchange Hyperliquid, as tracked by blockchain data shared by Arkham analyst Emmett Gallic on X. The assets were originally held in Bitcoin and were swapped for Ether or Solana before being bridged to Tron, Solana or the Ethereum network, according to the post. Final destinations included the exchanges KuCoin, Kraken, Lbank and several unnamed services operating on the Tron network.

The transfers took place weeks after U.S. President Donald Trump indicated that CFTC Chair Michael Selig was developing a regulatory framework to permit Hyperliquid to operate in the United States, a comment made during a White House event on August 16. The Lazarus Group is known for involvement in major cryptocurrency thefts, including a $1.4 billion hack of the Bybit exchange in 2025, which remains the largest reported incident to date. North Korean-linked actors were associated with at least $578 million of the $634 million stolen in crypto-related incidents in April, according to Quantstamp.

Cointelegraph is committed to independent, transparent journalism and adheres to its editorial policy.