Crypto wallets tied to North Korea’s cybercrime syndicate, Lazarus Group, have liquidated more than $30 million worth of Bitcoin through the decentralized exchange Hyperliquid. This offloading pattern occurred repeatedly over the past three weeks. Rather than leaving the proceeds idle, the group immediately converted the Bitcoin into two major alternative assets, Ethereum and Solana. These newly acquired tokens were then routed to three major centralized exchanges: Kraken, LBank, and KuCoin.
The tracking of these funds was not a sudden discovery. The network of transaction addresses used by the group was first exposed to the public by on-chain investigator ZachXBT in early 2024. Blockchain analytics firm Arkham subsequently followed up on the findings, verified the on-chain data, and officially tagged the addresses as controlled by Lazarus. The group carries a long and notorious track record: operating as a state-sponsored cyber outfit under North Korean government control, it is directly sanctioned by the US Department of the Treasury and was implicated in the $625 million Ronin Network heist in 2022.
The Worst Timing for US Lobbying
As a decentralized platform, Hyperliquid handles daily trading volumes topping $4 billion and operates entirely through crypto wallets without imposing standard KYC requirements. The movement of sanctioned funds through such an environment does not inherently prove that Hyperliquid intended to assist or was even aware of the hacker’s transactions.
Nevertheless, the arrival of Lazarus’s illicit capital coincides directly with Hyperliquid’s ongoing advanced negotiations alongside Kraken and Payward with regulators. The firms have been actively lobbying authorities to establish a compliant pathway for the decentralized exchange in the United States market. Having transaction trails from a state-sponsored actor like North Korea pass through their infrastructure makes the US licensing and approval process significantly more complex.
Defenses at Exchange Gates
While regulatory determinations hang in the balance, destination exchanges are stepping up their surveillance. Kraken, which served as one of the end destinations for the laundered Ethereum and Solana transfers, reinforced its posture. The exchange stated that it actively monitors anomalous blockchain activity and that its systems are designed to freeze assets flowing from sanctioned addresses before they can be cashed out.
For Lazarus, swapping Bitcoin into altcoins and distributing the balances across multiple venues remains a routine tactic to obfuscate transaction trails. Yet for platforms striving to achieve formal legal standing, such illicit flows represent the steepest hurdle in demonstrating that their infrastructure meets the rigorous standards of financial regulators.
Reported via crypto.news.
Also read: SEC Submits Crypto Custody Draft to White House - Digital Asset Custody Rules Set to Shift
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
