Wallets linked to the Lazarus Group, a hacking collective sanctioned by the U.S. Treasury's Office of Foreign Assets Control, moved more than $30 million through Hyperliquid, according to blockchain researcher Emmett Gallic. The transfers occurred through the platform's HyperUnit service as recently as August 31.
The identified addresses converted Bitcoin into Ethereum and Solana before bridging assets across Tron, Solana, and Ethereum networks. From Hyperliquid, the converted assets moved to centralized exchanges including KuCoin, LBank, and Kraken, as well as unlabeled Tron-based services.
Researcher ZachXBT previously flagged the same wallet cluster in 2024, linking the addresses to $61 million in stolen funds. Gallic cited this earlier identification as the basis for attributing the wallets to the Lazarus Group.
The disclosure comes as Hyperliquid pursues formal access to U.S. markets. President Donald Trump announced in August that CFTC Chairman Mike Selig was working on a compliant pathway for the platform. Kraken's parent company Payward is reportedly in advanced talks with Hyperliquid Labs to allow U.S. users to trade a subset of Hyperliquid-linked perpetual futures, with regulated exchange and clearinghouse Bitnomial supporting the structure subject to regulatory approval.
A test deployment reportedly appeared on Hyperliquid's testnet featuring permission controls designed to support U.S. compliance needs.
