Crypto Exploit News: Lazarus Funds Flow Through Hyperliquid

Crypto Exploit News: Lazarus Trail Exposes $30M Hyperliquid Fund Flow

Crypto exploit news this week centers on fresh on-chain evidence showing wallets linked to North Korea's Lazarus Group actively moving tens of millions of dollars through the Hyperliquid platform. 

Blockchain intelligence firm Arkham traced the flow of funds, converting Bitcoin into ETH and SOL before bridging across multiple networks and ultimately landing on several centralized exchanges.

What The New Onchain Data Actually Shows

According to addresses linked to the OFAC-sanctioned group, more than $30M moved through the platform's HyperUnit infrastructure, which acted as the entry point for Bitcoin before conversion. 

Source: Coin Bureau on X

Showing that funds first arrive as Bitcoin, get swapped into ETH and SOL, and then get bridged out across Tron, Solana, and Ethereum before finally reaching exchange deposit addresses. 

Source: Emmett Gallic

Onchain records from Arkham list four separate outbound transfers from labeled Lazarus-linked wallets between late July and late August, moving between roughly 122 and 244 Bitcoin per transaction.

Where The Funds Eventually Landed

Once bridged, the money did not stay in one place for long. Gallic's research shows deposits eventually landing at KuCoin, LBank, Kraken, and a number of unlabeled Tron-based services, rather than concentrating on a single platform. 

Deposit records tied to this trail show dozens of smaller transfers moving through LBank and Kraken over just a few days in mid-August, each ranging from roughly 50 to 250 SOL. 

Key figures from the traced route include:

• Roughly $30M moved through Hyperliquid's HyperUnit infrastructure

• Four major Bitcoin transfers totaling well over 700 BTC across five weeks

• Funds converted from Bitcoin into ETH and SOL before further bridging

• Deposits eventually confirmed at KuCoin, LBank, Kraken, and Tron-based services

• A second smaller cluster showing roughly $5M in similar activity patterns

Fund Movement Snapshot

Source: Emmett Gallic on X

How These Wallets Were First Identified

The wallets at the center of this Crypto Exploit News story were not newly discovered. 

The investigator flagged a related cluster back in May 2024, after publishing research covering 25 separate Lazarus Group hacks that together resulted in more than $61M being tracked across several previously unidentified wallets. 

That earlier research helped establish the wallet-labeling framework analysts are now using to trace this newest round of activity, connecting older stolen funds to fresh movement through the same trading venue more than a year later.

Why This Crypto Exploit News Matters For The Broader Industry

Lazarus Group remains one of the most closely watched threat actors in crypto and is widely suspected of carrying out the record-breaking $1.4B exchange hack in 2025. 

This latest activity is notable less for its size relative to that earlier incident and more for what it reveals about how sanctioned funds continue moving through decentralized infrastructure before reaching regulated exchanges. 

The pattern also arrives at a sensitive moment, given ongoing discussions around bringing platforms like this one further into a regulated onshore framework in the United States.

Conclusion

This round of crypto exploit news reinforces just how persistently Lazarus-linked wallets continue cycling funds through decentralized platforms years after the underlying hacks originally occurred. 

With Arkham's tracking data and independent analyst research both pointing to the same wallet clusters, this latest $30M movement through Hyperliquid adds fresh detail to a laundering trail that investigators have now been following since 2024.

Disclaimer

This content covers financial markets and is for general information only. It is not financial, investment, trading, or legal advice. Crypto assets are volatile and can lose value fast. Always do your own research. Speak with a licensed financial advisor before making investment decisions.