Lazarus Group Moves $30M in Crypto Through Hyperliquid to Major Exchanges

Wallets linked to North Korea’s Lazarus Group, a hacking syndicate sanctioned by the U.S. Office of Foreign Assets Control (OFAC), have moved approximately $30 million in cryptocurrency through the decentralized trading platform Hyperliquid, according to a report by Wu Blockchain citing analysis from Arkham analyst Emitt Galili.

How the Funds Were Moved

Arkham’s analysis indicates that the funds entered Hyperliquid as Bitcoin, were then swapped into Ethereum and Solana, and subsequently bridged to the Tron, Solana, and Ethereum networks. From there, the assets were transferred to several exchanges, including KuCoin, LBank, Kraken, and multiple unidentified Tron-based services.

This laundering pattern is consistent with Lazarus Group’s known tactics, which often involve rapid cross-chain swaps and the use of decentralized platforms to obscure the trail before converting assets to fiat or other cryptocurrencies.

Background on Lazarus Group

The Lazarus Group has been linked to numerous high-profile cyberattacks, including the 2014 Sony Pictures hack and the 2017 WannaCry ransomware outbreak. More recently, the group has been accused of stealing over $1.7 billion in cryptocurrency in 2022 alone, with attacks on Axie Infinity’s Ronin Bridge and Harmony’s Horizon bridge. The U.S. Treasury has repeatedly sanctioned the group, and law enforcement agencies worldwide have been tracking its laundering methods.

The use of Hyperliquid, a relatively newer decentralized exchange, highlights the evolving nature of crypto laundering. Unlike centralized exchanges, which often have KYC requirements, decentralized platforms can be exploited for faster, less transparent transfers.

Implications for the Crypto Industry

This incident underscores the ongoing challenges that regulators and exchanges face in combating illicit finance. While some exchanges like KuCoin and LBank have yet to publicly respond, the transfers may prompt increased scrutiny and stricter compliance measures. For users, it serves as a reminder that even decentralized platforms are not immune to being used by malicious actors.

The movement of funds also raises questions about the effectiveness of blockchain analytics in tracking such activities. Arkham’s ability to trace these transactions demonstrates that while laundering is possible, it is not entirely invisible.

Conclusion

The $30 million transfer via Hyperliquid is a significant development in the ongoing battle against crypto-related crime. It highlights the need for continued vigilance from exchanges, regulators, and the broader crypto community. As investigations unfold, more details may emerge about the ultimate destination of these funds and the methods used to launder them.

FAQs

Q1: What is the Lazarus Group?
The Lazarus Group is a cybercrime organization believed to be sponsored by the North Korean government. It has been responsible for numerous cyberattacks, including cryptocurrency heists, and is sanctioned by the U.S. Treasury.

Q2: How did the $30 million get moved?
According to Arkham analysis, the funds entered Hyperliquid as Bitcoin, were swapped to Ethereum and Solana, then bridged to other networks and transferred to several exchanges, including KuCoin and Kraken.

Q3: What can exchanges do to prevent such transfers?
Exchanges can enhance their compliance protocols by using advanced blockchain analytics to detect and freeze funds linked to sanctioned entities, as well as implementing more rigorous KYC procedures and cooperating with international law enforcement.