The tweet was deleted by the author.
But we saved everything 🙂.
Lazarus hackers use Hyperliquid to move $30 million
Crypto wallets linked to the North Korean hacking group Lazarus Group moved about $30 million in digital assets through the decentralized exchange Hyperliquid, according to data from blockchain analytics platform Arkham.
The funds were deposited into Hyperliquid and HyperUnit in Bitcoin. They were then exchanged for Ethereum or Solana and bridged out to the Tron, Solana and Ethereum networks.
View post on X Loading...
Some of the assets were eventually sent to crypto exchanges KuCoin, Kraken and LBank, as well as several unidentified services on the Tron network.
What Lazarus Group is known for
Lazarus Group has been linked to some of the largest attacks in the crypto industry. In particular, the group is considered the main suspect behind the Bybit exchange hack in 2025, which resulted in the theft of about $1.4 billion.
North Korean hackers were also linked to at least $578 million of the $634 million stolen in crypto-related attacks in April.
Why Lazarus chose Hyperliquid
The choice of Hyperliquid was likely driven primarily by the capabilities of HyperUnit. The protocol allows users to deposit Bitcoin, Ethereum and Solana directly, trade them on Hyperliquid’s spot market and withdraw them back to their respective networks. In the case of Lazarus, this made it possible to convert BTC into ETH and SOL within a single infrastructure and then distribute the assets across several blockchains.
For hackers, such a structure can be useful because adding more assets and networks to the transaction chain makes subsequent fund movements harder to trace. At the same time, Unit says it screens transactions for links to sanctioned addresses and uses geoblocking tools. The fact that wallets linked to Lazarus were still able to use HyperUnit for transactions involving tens of millions of dollars may therefore raise additional questions about the effectiveness of these controls.
Lazarus Group was also linked to the largest DeFi exploit of 2026.
This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Subscribe to TU news
Did you like the article?
Latest Hyperliquid News
Top News
Top 5 companies for you
United States
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
Live News
