North Korea-Linked Lazarus Group Moves $30 Million in Crypto Through Hyperliquid

North Korea-linked Lazarus Group wallets moved approximately $30 million in cryptocurrency through Hyperliquid, with the funds converted from Bitcoin into Ethereum or Solana before being transferred across multiple blockchain networks and deposited with several cryptocurrency exchanges and unidentified Tron-based services, according to Arkham data cited by @coinbureau post on X.

The movement adds to ongoing scrutiny of cryptocurrency transactions associated with the Lazarus Group, which has been linked to a series of major digital asset thefts.

Lazarus-Linked Funds Moved Across Multiple Networks

According to the data referenced in the post by @coinbureau, wallets associated with the Lazarus Group moved $30 million in crypto through Hyperliquid. The funds were initially held in Bitcoin before being converted into either ETH or SOL.

The assets were subsequently bridged across several blockchain networks, creating a transaction trail spanning multiple ecosystems. The funds ultimately reached KuCoin, Kraken, LBank and unidentified services operating on the Tron network.

Cross-chain transfers allow digital assets to move between different blockchain networks. While such transactions can create more complicated trails for investigators to follow, activity on public blockchains remains accessible for analysis.

Arkham was cited as the source of the transaction data. The blockchain intelligence platform provides tools for tracking cryptocurrency wallets, transactions and asset movements across different networks.

The identification of a particular exchange or service in a transaction trail does not by itself indicate involvement in illicit activity. Cryptocurrency platforms can receive assets from wallets whose broader transaction history may not be immediately known.

Lazarus Group Faces Continued Scrutiny

The Lazarus Group has been associated with North Korea and has repeatedly been linked by authorities and blockchain investigators to cryptocurrency-related cyber operations.

The latest movement is notable because the funds reportedly passed through multiple cryptocurrencies and blockchain networks before reaching centralized exchanges and other services. Transaction patterns involving several assets and networks are closely monitored by blockchain analytics companies and cryptocurrency firms.

The post by @coinbureau also referenced the group's suspected involvement in the record $1.4 billion exchange hack in 2025.

The $1.4 billion figure represents one of the largest reported cryptocurrency thefts and has intensified scrutiny of the methods used by North Korea-linked groups to move digital assets following major hacks.

Crypto Exchanges and Blockchain Tracking

The identification of KuCoin, Kraken and LBank in the reported transaction trail highlights the role centralized exchanges can play in the movement of cryptocurrency. Exchanges generally operate transaction-monitoring and compliance systems designed to detect suspicious activity and meet applicable regulatory requirements.

The reported use of several blockchain networks also demonstrates how cryptocurrency can be transferred across different ecosystems through bridges and other infrastructure. These mechanisms can produce transaction paths involving multiple assets, wallets and networks.

Blockchain intelligence firms analyze publicly available transaction records to reconstruct such movements and, where possible, associate wallet addresses with known entities or services.

The reported $30 million movement does not establish that the funds were ultimately converted into fiat currency or withdrawn from the identified exchanges. Further blockchain monitoring would be required to determine the subsequent movement of the assets.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.