Wallets linked to North Korea’s Lazarus Group—currently under US OFAC sanctions—moved over $30 million through the Hyperliquid decentralized exchange, according to Arkham analyst Emmett Gallic. Gallic reports that these transfers continued at least until August 30, 2026.

Key Details

Gallic confirmed that the wallets in question have been attributed to Lazarus. He referenced blockchain sleuth ZachXBT’s 2024 research, which originally identified these addresses and tied them to $61 million in stolen crypto. Gallic’s post mentions the term HyperUnit, pointing to the Hyperliquid ecosystem. By the end of August, the total funds moved topped $30 million.

Timeline

According to Gallic, these wallets remained active through at least August 30. His summary of the on-chain activity was published publicly on August 31, 2026.

DeFi Context

The spotlight here is on how Lazarus-linked, sanctioned wallets leveraged Hyperliquid’s decentralized infrastructure to move funds. The researcher documented the event, but beyond the amounts, wallet attribution, and timestamps, no further technical details were provided in the public statement.