Lazarus Group Leverages Hyperliquid for $30M Crypto Asset Transfer

The North Korean hacking group Lazarus Group has used the decentralized exchange Hyperliquid to move approximately $30 million in digital assets, according to data from blockchain analytics platform Arkham. The funds were deposited into Hyperliquid and HyperUnit in Bitcoin and then exchanged for Ethereum or Solana.

These digital assets were bridged out to various networks, including Tron, Solana, and Ethereum. Some of the assets were eventually sent to crypto exchanges KuCoin, Kraken, and LBank, as well as several unidentified services on the Tron network.

Lazarus Group has been linked to some of the largest attacks in the crypto industry, including the Bybit exchange hack in 2025, which resulted in the theft of about $1.4 billion. They were also involved in crypto-related attacks in April that stole at least $578 million out of $634 million.

The use of Hyperliquid and HyperUnit by Lazarus Group is likely driven by the capabilities of HyperUnit, which allows users to deposit Bitcoin, Ethereum, and Solana directly and trade them on Hyperliquid's spot market. This structure makes it possible to convert BTC into ETH and SOL within a single infrastructure and distribute assets across several blockchains.

For hackers, such a structure can be useful because adding more assets and networks to the transaction chain makes subsequent fund movements harder to trace. However, Unit screens transactions for links to sanctioned addresses and uses geoblocking tools, which may raise questions about the effectiveness of these controls in this case.