North Korea-linked Lazarus Group has sold more than $30 million in Bitcoin through Hyperliquid over three weeks, according to Arkham data. The wallets used proceeds from Bitcoin sales to purchase Ethereum and Solana before transferring the assets to centralized exchanges including Kraken, LBank, and KuCoin. As reported by AMBCrypto, blockchain researcher Emmett Gallic caught attention with recent on-chain tracking showing four outflows of Bitcoin: 244 BTC, 262 BTC, 136 BTC, and 121 BTC. These Bitcoins were then moved into the Hyperliquid ecosystem and subsequently converted into Ethereum and Solana, with assets bridged across different networks including Ethereum, Solana, and Tron before portions were sent to centralized exchanges and unidentified Tron-based services. The activity builds on ZachXBT's earlier identification of seven Bitcoin addresses holding about 891 BTC worth approximately $61.8 million in May 2024, as part of his broader investigation tracing more than $200 million in stolen cryptocurrency from 25+ hacks.
Major exchanges have implemented varying compliance approaches regarding the reported Lazarus activity. Kraken stated that compliance sits at the center of its operations and continuously monitors blockchain activity with support from analytics providers, with controls designed to identify and block assets connected to sanctioned wallets. LBank described illicit transfers across platforms as an industry problem that no single company can independently detect or resolve, using industry-standard compliance tools for continuous monitoring. KuCoin declined to confirm the reported activity without reviewing underlying wallet data, noting that public blockchain records don't show every step after assets arrive at centralized platforms, including account restrictions and regulatory reports. The recent activity has raised questions about whether platforms have adequate systems to detect and restrict sanctioned wallets, particularly given Lazarus's status under U.S. sanctions.
The Lazarus Group activity comes amid ongoing legal proceedings related to the $1.5 billion Bybit theft. As reported by crypto.news, Bybit sued North Korea and Lazarus Group in a Washington, D.C., federal court on August 7, seeking to recover assets tied to the exchange's theft. The lawsuit also named North Korea's Reconnaissance General Bureau, which the U.S. Treasury identifies as the country's main intelligence agency. The reported transfers carry a direct U.S. angle because the Treasury Department has sanctioned Lazarus Group and identified it as a cyber organization controlled by North Korea's government. U.S. authorities have linked Lazarus to several digital-asset thefts, including the $625 million Ronin Network attack in 2022.
The Lazarus activity occurs as Hyperliquid continues to dominate decentralized perpetual trading markets, with HYPE's price remaining relatively strong at around $83.12 after a hike of almost 60% in a month. This suggests that traders had not yet viewed the wallet activity as a major threat to Hyperliquid. The discovery of Lazarus-linked wallets moving millions through Hyperliquid could become a compliance concern because Lazarus is under U.S. sanctions by the Office of Foreign Assets Control (OFAC). This coincides with Binance recently announcing that it would gradually restrict transfers involving 16 crypto and payment platforms following recent U.S. sanctions targeting Iranian- and Russian-linked services. The reactivation of dormant wallets remains closely watched due to Lazarus Group's history of cybercrime and laundering attempts.
While Lazarus operates through decentralized venues, Payward is exploring regulated access to Hyperliquid for U.S. traders. According to Bloomberg reports, Payward is in advanced discussions with Hyperliquid Labs over offering selected perpetual contracts to American traders through Bitnomial, its CFTC-regulated derivatives business. People familiar with the talks told Bloomberg that Payward had presented the Commodity Futures Trading Commission with an outline of the proposed structure, though any agreement would still require regulatory approval. President Trump brought the possible U.S. entry into public view during an August 19 White House event, referring to CFTC Chair Michael Selig and stating he understood that the regulator was working to bring Hyperliquid into the United States in a "fully compliant and legal fashion."
