Lazarus-Linked Wallets Route $30M+ in Bitcoin Through Hyperliquid

Wallets tied to North Korea’s Lazarus Group moved more than $30 million in Bitcoin through Hyperliquid over the past three weeks, converting the funds into ether and solana before routing assets across multiple networks and toward centralized exchanges.

Lazarus-linked funds move through HyperUnit

Arkham analyst Emmett Gallic flagged the activity on August 31. One cluster responsible for roughly $30 million of inbound volume traced directly to addresses Arkham already labels as Lazarus-linked. Gallic separately identified about $5 million of activity from another cluster with similar dormancy, address and counterparty patterns, but stopped short of giving that second group the same confirmed attribution.

The known addresses were previously identified by investigator ZachXBT in 2024 as part of a group of wallets holding more than $61 million in Bitcoin linked to Lazarus thefts.

The recent transactions used HyperUnit, Hyperliquid’s cross-chain infrastructure, to move Bitcoin into the ecosystem before swapping it for ETH and SOL. The resulting assets were then routed across Ethereum, Solana and Tron, with funds reaching addresses associated with Kraken, LBank and KuCoin, according to on-chain tracing.

Blockchain records alone do not establish who controlled the receiving exchange accounts or what compliance measures were applied after deposits arrived.

Transfers renew sanctions questions around Hyperliquid

Lazarus has been under U.S. sanctions since 2019, when the Treasury Department designated the group and said it was controlled by North Korea’s Reconnaissance General Bureau.

The transfers come as Hyperliquid faces growing attention over a possible U.S. expansion. President Donald Trump said in August that the CFTC was working toward a compliant route for the platform to enter the United States, a development that previously sent HYPE sharply higher as details of a potential U.S. path emerged.

Sanctions exposure is already documented in regulated products tied to HYPE. A Bitwise SEC filing notes that Hyperliquid’s decentralized applications generally do not perform customer identification, KYC or AML checks and that developers cannot compel users to undergo sanctions screening.

Hyperliquid had not publicly addressed the Lazarus-linked transfers as of publication.