SKN | Lazarus-Linked Wallets Move $30 Million Through Hyperliquid, Raising US Market Concerns

• Wallets linked to the North Korea-affiliated Lazarus Group moved about $30 million in digital assets through Hyperliquid and HyperUnit.
• The funds were converted between Bitcoin, Ether and Solana before being bridged to Tron, Solana and Ethereum and ultimately sent to centralized exchanges.
• The activity comes weeks after US officials indicated that regulators were exploring a pathway for Hyperliquid to enter regulated US markets.

Wallets linked to the North Korea-affiliated Lazarus Group moved approximately $30 million in digital assets through Hyperliquid, adding a new compliance challenge for the decentralized exchange as US regulators consider pathways that could expand its access to American markets. The transfers illustrate the difficulty of balancing open blockchain infrastructure with the increasingly stringent sanctions and anti-money-laundering expectations facing platforms seeking institutional and regulated-market participation.

According to blockchain data shared by Arkham analyst Emmett Gallic, the Lazarus-tagged addresses sent funds through Hyperliquid and HyperUnit, converting Bitcoin into Ether or Solana before moving the assets across several blockchain networks.

Funds moved across multiple blockchains

The transactions followed a multi-stage path designed around asset conversion and cross-chain transfers. Bitcoin was deposited into the Hyperliquid ecosystem, where the funds were traded into Ether or Solana. The assets were then bridged to Tron, Solana or Ethereum.

The funds ultimately reached several centralized exchanges, including KuCoin, Kraken and LBank, alongside multiple unidentified services operating on the Tron network.

Such movements demonstrate why blockchain tracing remains central to crypto compliance. Although transactions on public networks are visible, sophisticated actors can move assets through different tokens, bridges and chains, creating a fragmented trail that requires specialized analytics to reconstruct.

For exchanges and infrastructure providers, the issue is particularly significant because exposure to sanctioned entities can create regulatory and reputational risks even when a platform does not directly control the wallets initiating transactions.

Hyperliquid faces heightened scrutiny

The transfers are especially notable because they occurred only weeks after US officials signaled potential regulatory access for Hyperliquid.

President Donald Trump said on Aug. 16 that Commodity Futures Trading Commission Chair Michael Selig was working on a regulatory pathway that could allow Hyperliquid to enter US markets. The timing places the Lazarus-linked transactions against a backdrop of increasing attention on the platform’s ability to meet compliance expectations associated with broader US participation.

The presence of sanctioned-wallet activity does not, by itself, establish wrongdoing by Hyperliquid or demonstrate that the platform intentionally facilitated sanctions evasion. However, it could intensify questions over transaction screening, wallet controls and the responsibilities of decentralized infrastructure as regulators assess how such platforms should operate within regulated markets.

Lazarus remains a major crypto threat

The Lazarus Group has been linked to some of the largest cryptocurrency thefts on record. North Korea-affiliated actors were identified as the principal suspects behind the $1.4 billion Bybit hack in 2025, the largest crypto exchange theft reported to date.

North Korea-linked hackers were also associated with at least $578 million of the $634 million stolen in crypto-related incidents during April, underscoring the scale of the threat posed by state-linked cyber operations.

The latest transfers therefore carry significance beyond the $30 million involved. They demonstrate how stolen or illicitly obtained assets can be moved across multiple blockchain environments and potentially converted into liquid assets through centralized venues.

For Hyperliquid, the episode could become an important test of its readiness for deeper engagement with US-regulated markets. Regulators and institutional participants are likely to focus not only on the platform’s trading capabilities but also on how effectively illicit flows can be detected, contained and reported. As crypto infrastructure becomes more integrated with traditional finance, the ability to demonstrate credible compliance controls may become as important as liquidity and technological performance.