On Sep 1, 2026, wallets tagged to OFAC-sanctioned North Korea's Lazarus Group moved $30M in digital assets through Hyperliquid, a derivatives exchange running on its own blockchain. Per Arkham on-chain data shared by analyst Emmett Gallic on X, the wallets sent BTC to Hyperliquid and HyperUnit, traded into ETH or SOL, bridged out to Tron, Solana or Ethereum, and deposited at exchanges KuCoin, Kraken and LBank, plus unlabeled Tron services.
The timing matters. The flows come weeks after an Aug 16 White House event where the US said CFTC Chair Michael Selig is working on a regulatory pathway to introduce Hyperliquid to US markets.
Lazarus is the prime suspect in the largest crypto hacks, including the ~$1.4B Bybit breach in 2025. Arkham-linked data connects the group to $578M of the $634M stolen in April 2026 incidents.
Why it matters: the movement tests how sanctioned activity shows up in and out of a venue the US is considering for domestic markets. DEX flows that bridge across chains and land at multiple exchanges make attribution and freezing harder than flows that stay inside one venue.
Cointelegraph (Sep 1, 2026); Arkham blockchain data via analyst Emmett Gallic