According to CoinMeta, researcher Emmett Gallic stated that addresses associated with the North Korean hacking group Lazarus Group, which has been listed on the sanctions list by OFAC, recently transferred over $30 million through HyperLiquid. As of yesterday, there were still related activities. The funds first entered HyperLiquid via BTC, and were then exchanged for ETH and SOL. They were then transferred across chains to Tron, Solana, and Ethereum, and ultimately flowed to KuCoin, LBank, Kraken, and several unmarked Tron services. Approximately $30 million of this amount can be traced back to addresses that had previously been marked as Lazarus. Another about $5 million came from a different set of addresses. The dormancy period of these funds, the type of addresses, and the behavior of the transaction counterparts are similar to those of the already marked Lazarus wallets, but so far, no association with Lazarus has been confirmed.