Wallet addresses tagged to the OFAC-sanctioned Lazarus Group moved approximately $30 million in digital assets through the decentralized exchange Hyperliquid, according to on-chain tracing data published by Arkham analyst Emmett Gallic on Monday. The finding was corroborated by independent coverage from Cointelegraph and CoinDesk.
The attribution remains "linked" and "tagged" rather than confirmed: Arkham's labeling ties the addresses to the North Korea-affiliated collective, which US authorities have sanctioned but which has never been formally adjudicated for these specific transfers.
The Laundering Route
According to the Arkham data, the wallets sent funds to Hyperliquid and HyperUnit in Bitcoin, traded into Ether or Solana, and bridged the proceeds out to Tron, Solana or the Ethereum network. The funds ultimately reached the centralized exchanges KuCoin, Kraken and LBank, along with several unlabeled services on Tron.
The pattern is consistent with previously documented Lazarus laundering behavior: assets are converted through decentralized venues with no know-your-customer checks, split across networks, and consolidated at exchange deposit addresses where off-ramps begin.
Timing Meets US Onshoring Push
The transfers occurred weeks after President Donald Trump said at an Aug. 16 White House event that CFTC Chair Michael Selig was working on a regulatory pathway to introduce Hyperliquid into US markets.
The juxtaposition is uncomfortable for a platform seeking US entry. A venue that processes sanctioned-entity flows without gatekeeping now has a documented case study attached to its name while regulators weigh its domestic availability. Neither Hyperliquid nor the CFTC has publicly commented on the tracing.
Track Record
The Lazarus Group is the main suspect in some of the largest cryptocurrency thefts on record, including the $1.4 billion Bybit exchange hack in February 2025, still the industry's largest. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April 2026 alone.
No funds moving through Hyperliquid in this cluster have been tied to a specific theft, and no seizure has been announced. The $30 million figure represents traced movement, not a new incident.
What It Means
For decentralized exchanges, the case reinforces a structural exposure: permissionless front-ends cannot screen depositors, but the downstream exchanges receiving bridged funds will ask questions. The KuCoin, Kraken and LBank deposit addresses in the Arkham data are now flagged attribution points, and the freeze-or-return decision sits with those custodians.
TrustGrade tracks exchange and protocol security posture in its public registry, where entities such as Hyperliquid can be reviewed alongside their incident and attribution history.