More than $30 million in Bitcoin tied to wallets linked to North Korea’s Lazarus Group moved through Hyperliquid over a period of several weeks.
The interesting part is not simply that the money moved.
It is what happened between the first known wallet and the last address researchers could confidently identify.
Bitcoin went in.
Ether and Solana came out.
Then the trail split across several networks, reached exchange-linked addresses, and eventually entered parts of the crypto system where a public blockchain can tell us much less.
At a high level, the route looked like this:
Lazarus-linked BTC → Unit → Hyperliquid → BTC sold → ETH and SOL acquired → multiple networks → exchange-linked and unidentified addresses.
That sequence turns what initially looks like another story about sanctioned hackers moving crypto into something more revealing.
It shows both sides of blockchain transparency at once: how easily value can change form and move across networks, and how much of that movement can still be reconstructed afterward.
These Wallets Were Already Being Watched
The trail did not begin with Hyperliquid.
In May 2024, on-chain investigator ZachXBT identified seven additional Bitcoin addresses that he associated with Lazarus Group activity. At the time, those addresses collectively held roughly 891 BTC.
The important point is that the addresses involved in the more recent activity were not labeled suspicious simply because they interacted with Hyperliquid.
They were part of an already observed wallet cluster.
Wallet attribution usually comes from multiple transactions. Investigators typically combine transaction patterns, counterparties, links to known exploits, address clustering, and off-chain intelligence before associating an address with an entity.
Lazarus itself has been sanctioned by the United States since 2019. The U.S. Treasury’s Office of Foreign Assets Control designated Lazarus Group alongside Bluenoroff and Andariel as North Korean state-sponsored malicious cyber organizations.
Then the old Bitcoin began moving again.
Follow the Money, Not Just the Wallet
Arkham researcher Emmett Gallic flagged the latest activity on Aug. 31.
Blockchain data subsequently reviewed by CoinDesk showed wallets attributed to Lazarus moving more than $30 million in Bitcoin through Hyperliquid over roughly three weeks.
The transaction trail matters because the movement was not simply a transfer from Wallet A to Wallet B.
Bitcoin entered an infrastructure stack that allowed the assets to change form.
The unit connects native blockchain assets such as Bitcoin with Hyperliquid. BTC can enter through the Unit system, become available inside Hyperliquid, and then be traded before assets are withdrawn again onto other networks.
That means a Bitcoin position can be converted into another asset.
And a transaction trail does not have to remain on one blockchain.
For a legitimate trader, that flexibility is useful infrastructure.
For an investigator trying to follow funds across multiple assets and networks, it creates a much more complicated map.
Bitcoin In, ETH and SOL Out
Once inside the broader Hyperliquid ecosystem, the Bitcoin was sold, and the proceeds were used to acquire ETH and SOL.
From there, the trail fragmented.
The transaction data reviewed in the original investigation showed funds moving toward Ethereum, Solana, and Tron, with portions ultimately reaching addresses associated with Kraken, KuCoin, and LBank, as well as services on Tron that were not publicly identified.
This scenario is where wallet analysis can easily become misleading.
An exchange deposit address is not the same thing as proof of a successful cash-out.
Seeing funds arrive at an address associated with Kraken, KuCoin, or LBank does not reveal who controlled the underlying account. It does not tell us whether the exchange credited the deposit, froze it, filed a report, or restricted the account.
And it does not prove that fiat currency was eventually withdrawn.
That boundary is crucial.
A blockchain can show the transfer.
It cannot necessarily show what happened inside the centralized account after the transfer arrived.
In responses to the original reporting, exchanges emphasized exactly that distinction. Compliance actions can occur internally and therefore may never be visible on-chain.
The public trail can lead investigators to the exchange door.
What happened behind that door requires another source of evidence.
The Compliance Problem Is More Complicated Than a Blacklist
There is another layer to the trail that makes it more interesting.
The unit itself has compliance controls.
Its regulatory documentation says Unit Labs uses blockchain analytics and intelligence software to screen wallet addresses interacting with the protocol. Its Guardian validator will not participate in transactions involving addresses that fail its screening, including addresses identified on the U.S. OFAC SDN List.
Yet wallets attributed by blockchain researchers to Lazarus were reportedly still able to move tens of millions of dollars through the broader route.
On the surface, those two facts appear contradictory.
They are not necessarily.
There is an important difference between an address explicitly appearing on an official sanctions list and an address that investigators associate with a sanctioned entity through clustering, behavioral analysis, and historical links.
A sanctions list is finite.
A wallet network is not.
An actor can create new addresses, move funds through intermediary wallets, and interact through addresses whose attribution may be strong enough for an investigator but not equivalent to an explicit government designation.
Nothing in the available evidence establishes that Unit knowingly processed Lazarus funds or that its compliance systems failed.
Instead, the episode exposes a harder problem.
Compliance systems screen addresses.
Sanctioned actors operate networks of addresses.
Those are not always the same thing.
The Trail Becomes a Network
Traditional descriptions of crypto laundering often imply a linear process.
Funds are stolen, transferred several times, and eventually cashed out.
The Lazarus trail looks less like a line and more like a network.
Bitcoin was the starting asset.
Hyperliquid and Unit became part of the transformation layer.
ETH and SOL became new forms of the same underlying value.
The trail could continue in other environments such as Ethereum, Solana and Tron.
Centralized exchanges and unidentified services then became possible endpoints.
Each transition introduces complexity.
Turning BTC to ETH breaks the visual continuity of a simple Bitcoin transfer chain.
Moving SOL onto another network introduces another ledger.
Sending assets to an exchange creates an information boundary between transparent blockchain activity and private account records.
But each step also creates another observable event.
That is the paradox.
The path becomes harder to follow precisely because more things happen.
Yet those same actions produce additional traces.
Crypto’s Feature Is Also Its Problem
The Lazarus trail illustrates an uncomfortable property of permissionless financial infrastructure.
Crypto makes value unusually portable.
Assets can move without the neat institutional path of correspondent banks, settlement intermediaries, and account-based payment systems.
A position can change assets, cross networks, and reach multiple destinations in relatively little time.
That makes enforcement difficult.
But blockchain systems also create records traditional financial movement often does not expose publicly.
The Bitcoin transactions remain visible.
The destination addresses remain visible.
Asset conversions leave traces.
Cross-chain transitions can often be reconstructed.
Counterparties can be clustered and monitored long after the original transactions stop attracting attention.
Lazarus and other sophisticated actors have spent years getting better at moving money through crypto infrastructure.
Those same years have also seen blockchain investigators getting better at reconstructing those movements.
The result is an unusual arms race.
Every additional route provides another place to obscure the trail.
Every public transaction provides another clue.
Where the Blockchain Stops Talking
The strongest conclusion from this wallet trail is also the most limited one.
We can reconstruct a remarkable amount.
Wallets previously attributed to Lazarus moved Bitcoin.
More than $30 million of BTC was reportedly sold through Hyperliquid.
ETH and SOL were acquired.
Funds then moved across several blockchain environments and eventually reached exchange-linked and unidentified addresses.
But the public ledger cannot answer everything.
It cannot establish with certainty who controlled every intermediary address.
It cannot reveal the identity behind every centralized exchange account.
It cannot show every compliance action that occurs inside those exchanges.
And it cannot prove that every asset reaching an exchange was successfully converted into fiat or withdrawn.
Those are not weaknesses in the investigation.
These limitations define the boundary of what the evidence can actually support.
What We Know
Wallets previously attributed to Lazarus moved more than $30 million in Bitcoin through Hyperliquid during the observed period, with proceeds used to acquire ETH and SOL before portions of the funds moved across multiple networks and toward exchange-associated addresses.
What We Don’t Know
Public blockchain data does not establish who controlled the eventual exchange accounts, whether those deposits were credited or frozen, whether all of the funds were successfully moved beyond those platforms, or whether every intermediary address belonged directly to Lazarus.
And that distinction is the real Wallet Story.
The most revealing thing about this $30 million trail is not that Bitcoin became Ether and Solana.
It is that we can watch much of that transformation happen.
Not perfectly.
Not completely.
But far enough to expose crypto’s central contradiction.
Permissionless money can be remarkably difficult to stop.
It can also be remarkably difficult to make it forget.
