Image Credit: Shutterstock
Wallets previously linked to North Korea’s Lazarus Group moved more than $30 million in Bitcoin through Hyperliquid over the past three weeks, converting the funds into Ether and Solana before sending them across multiple networks.
Arkham analyst Emmett Gallic identified the activity using addresses previously attributed to Lazarus by blockchain investigator ZachXBT. Hyperliquid itself was not exploited in the transactions.
Bitcoin Was Converted Into ETH and SOL Through HyperUnit
The identified wallets deposited Bitcoin into Hyperliquid through Unit, the protocol connecting assets on Bitcoin, Ethereum and Solana with Hyperliquid’s spot markets. The BTC was sold after entering Hyperliquid and the proceeds were used to acquire ETH and SOL. Those assets were later withdrawn across Ethereum, Solana and Tron.
Four Bitcoin outflows identified in the transaction trail included transfers of 244 BTC, 262 BTC, 136 BTC and 121 BTC. Activity continued through August 31. Some resulting funds were also traced to addresses associated with centralized exchanges including Kraken, KuCoin and LBank, along with unidentified services operating on Tron.
Seven Addresses Were Linked to 891 BTC in 2024
The Lazarus attribution predates the latest Hyperliquid activity. ZachXBT identified seven Bitcoin addresses in May 2024 holding 891 BTC, worth about $61 million at the time, and linked them to proceeds from hacks attributed to Lazarus.
The US Treasury has sanctioned Lazarus over its connection to North Korea’s Reconnaissance General Bureau and cyberattacks used to generate revenue for the country.
Unit Sanctions Screening Leaves Wallet Status Unresolved
Unit’s documentation says deposits undergo validation that includes checks for sanctioned addresses before assets are credited to Hyperliquid.
It remains unclear whether the depositing addresses were directly covered by applicable sanctions lists or how Unit’s screening treated the wallets identified by researchers as Lazarus-linked.
Hyperliquid and Unit have not publicly detailed any action taken against the addresses. It is also unclear whether downstream exchanges have frozen funds connected to the transfers.
Most of the ETH and SOL has now moved away from Hyperliquid, including funds traced to exchange-associated addresses and unidentified services on Tron.
