Lazarus Group Moves $30M In Crypto Through Hyperliquid To Major Exchanges

Wallets linked to North Korea’s Lazarus Group, a hacking syndicate sanctioned by the U.S. Office of Foreign Assets Control (OFAC), have moved approximately $30 million in cryptocurrency through the decentralized trading platform Hyperliquid, according to a report by Wu Blockchain citing analysis from Arkham analyst Emitt Galili.

How the Funds Were Moved

Arkham’s analysis indicates that the funds entered Hyperliquid as Bitcoin, were then swapped into Ethereum and Solana, and subsequently bridged to the Tron, Solana, and Ethereum networks. From there, the assets were transferred to several exchanges, including KuCoin, LBank, Kraken, and multiple unidentified Tron-based services.

This laundering pattern is consistent with Lazarus Group’s known tactics, which often involve rapid cross-chain swaps and the use of decentralized platforms to obscure the trail before converting assets to fiat or other cryptocurrencies.

Background on Lazarus Group

The Lazarus Group has been linked to numerous high-profile cyberattacks, including the 2014 Sony Pictures hack and the 2017 WannaCry ransomware outbreak. More recently, the group has been accused of stealing over $1.7 billion in cryptocurrency in 2022 alone, with attacks on Axie Infinity’s Ronin Bridge and Harmony’s Horizon bridge. The U.S. Treasury has repeatedly sanctioned the group, and law enforcement agencies worldwide have been tracking its laundering methods.