On September 1, wallet addresses labeled as Lazarus Group, a North Korea-linked hacking group, transferred roughly $30 million in digital assets through the perp DEX Hyperliquid, according to Arkham on-chain data shared on X by analyst Emmett Gallic.
Specifically, Lazarus wallets deposited funds into Hyperliquid and HyperUnit in Bitcoin, then swapped them into Ether (ETH) or Solana (SOL), before bridging them out to the Tron, Solana, or Ethereum networks. Ultimately, the funds were sent to the KuCoin, Kraken, and LBank exchanges, along with several unlabeled services on the Tron network.
The move came weeks after US President Donald Trump stated that CFTC Chairman Michael Selig was exploring a regulatory pathway to bring Hyperliquid into the US market, during a White House event on August 16.
Lazarus Group is the prime suspect in several of the largest crypto hacks in history, including the $1.4 billion exploit of the Bybit exchange in 2025, the industry’s biggest to date. North Korea-linked groups are also believed to be behind at least $578 million of the $634 million stolen in April.
Hyperliquid prides itself on being a transparent decentralized exchange, and its open nature makes tracking fund flows possible, as Arkham demonstrated. On the flip side, however, that same characteristic makes it a convenient transit hub for organized crime groups looking to launder assets across multiple networks before finally cashing out on centralized exchanges.
From a regulatory perspective, this development raises questions regarding Hyperliquid’s US ambitions: How will an exchange seeking an operating pathway from US regulators answer when sanctioned entities repeatedly use it to move funds? That could become one of the pressures forcing Hyperliquid to consider adding compliance layers, even if doing so runs somewhat counter to the philosophy of decentralization.