TL;DR
- Lazarus-linked wallets moved roughly $30 million through Hyperliquid and HyperUnit, converting Bitcoin into Ether or Solana before bridging funds onto other networks.
- Tracked assets later reached KuCoin, Kraken, Lbank and unidentified Tron-based services, showing how sanctioned funds can pass through multiple tokens, chains and platforms.
- The transfers came weeks after U.S. officials discussed a regulatory pathway for Hyperliquid, while Lazarus remains linked to major thefts including Bybit’s $1.4 billion breach.
Crypto wallets linked to the OFAC-sanctioned Lazarus Group moved roughly $30 million in digital assets through Hyperliquid, according to blockchain data shared by Arkham analyst Emmett Gallic. The addresses sent Bitcoin to Hyperliquid and HyperUnit, swapped funds into Ether or Solana, and then bridged assets out to the Tron, Solana or Ethereum networks. The movement stands out because funds tied to a heavily sanctioned North Korean hacking collective passed through a major decentralized trading ecosystem before reaching additional destinations. The transaction path shows how rapidly assets can move across chains, tokens and venues.
Addresses linked to OFAC Sanctioned Lazarus Group (North Korea) have been actively moving $30M+ through Hyperliquid (HyperUnit) as recent as yesterday.@zachxbt identified these addresses as Lazarus Group in 2024 linked to $61M in stolen fundshttps://t.co/RNJ4NMBrxA pic.twitter.com/CvivPLVnEL
— Emmett Gallic (@emmettgallic) August 31, 2026
Lazarus Transfers Highlight Cross-Chain Tracking Challenges
The transfers did not stop after the onchain swaps. According to the tracking, assets were ultimately sent to crypto exchanges KuCoin, Kraken and Lbank, alongside several unlabeled services operating on the Tron network. The route illustrates the complexity investigators face when following funds that move through multiple assets, bridges, exchanges and unidentified services. Bitcoin served as an entry point into Hyperliquid and HyperUnit, while Ether and Solana became intermediate assets before funds moved onto other networks. That sequence gives blockchain analysts multiple visible stages, but also expands the number of platforms involved.
The timing adds another layer of attention around Hyperliquid. The transfers occurred only weeks after U.S. President Donald Trump said Commodity Futures Trading Commission Chair Michael Selig was working on a regulatory pathway to introduce Hyperliquid into U.S. markets. That coincidence places illicit-finance scrutiny beside an ongoing discussion about how the decentralized exchange could fit within regulated American markets. The reported movement does not establish wrongdoing by Hyperliquid itself, but it demonstrates the compliance challenge surrounding open blockchain venues, where sanctioned actors may attempt to route funds through publicly accessible infrastructure while regulators consider broader market access.
Lazarus Group already carries a record within crypto cybercrime. The North Korean state-affiliated collective is the main suspect in some of the industry’s largest hacks, including the $1.4 billion Bybit breach in 2025, described as the sector’s largest to date. North Korea-linked threat actors were also tied to at least $578 million of the $634 million stolen in crypto-related incidents during April. Against that history, the latest $30 million transfer matters less for its size than for what it reveals about persistent fund movement after thefts. Blockchain tracing can expose routes, even as assets keep changing form.
