Arkham Traces $30M of Bitcoin Sales to Lazarus Wallets on Hyperliquid

Wallets that blockchain researchers tie to the Lazarus Group sold more than $30 million of bitcoin through Hyperliquid over three weeks, according to Arkham Intelligence analysis reported on 31 August. The proceeds bought ether and solana. Those tokens then moved to centralized exchanges, with Kraken, LBank and KuCoin each named as recipients. Hyperliquid had not commented at the time of writing. Every account gives the total in dollars, and none gives an amount in coins.

What the chain shows

Arkham's work rests on a cluster of addresses that the researcher known as ZachXBT identified in 2024, when the cluster was linked to about $61 million in stolen funds. Those addresses are still active. Bitcoin went in, ether and solana came out, and the converted proceeds were bridged across Tron, Solana and Ethereum before landing at exchange deposit addresses. Arkham described the sequence in flat terms.

"Proceeds from the bitcoin sales were used to acquire ether and Solana, which were subsequently transferred to the centralized exchanges," the Arkham analysis said.

The route matters because of what Hyperliquid is. It is a decentralized perpetual futures venue, meaning a trader connects a wallet and starts trading without the account checks a conventional exchange runs at sign-up. Selling there leaves a public trail and no counterparty to ask questions. This desk has covered the behaviour of thinly traded Hyperliquid markets before, though the earlier case involved pricing rather than provenance. Cross-chain hops of the kind Arkham describes have turned up in other incidents in recent days, including the six-chain hack Cosmos Labs said it had misgraded.

Two totals that do not reconcile

The figure itself is unsettled. CoinDesk, Crypto Briefing and BlockchainReporter all describe more than $30 million of bitcoin sold in the three weeks to 31 August. Crypto Daily, writing a day later, describes more than $30 million routed through HyperUnit, Hyperliquid's bridging service, and adds a separate $52 million across four identified outflows between 30 July and 28 August. Selling and routing are not the same act. The two windows do not line up either, and no account reconciles them. One report names the Arkham researcher behind the tally as Emmett Gallic; no other account carries a name.

What the exchanges said, and did not

Kraken said compliance "is foundational to how we operate" and that it monitors onchain activity continuously. LBank answered in general terms, calling the industry "inherently cross-platform, cross-chain, and cross-jurisdictional." Neither said whether it had frozen or returned anything. KuCoin's position does not appear in any of the accounts reviewed. None of the three has published a figure for what it received, so the split of the total across the three venues is unknown.

An older episode, a much larger venue

Hyperliquid has faced this once already. In December 2024 the platform drew scrutiny over Lazarus-linked wallets and saw roughly $250 million leave in a single day, and it said at the time that the reports did not reflect an exploit and that no user funds had been lost. No equivalent statement has followed the August activity. The venue is a great deal bigger now, carrying $13.3 billion in open interest by DefiLlama's count and about $205 billion of volume over 30 days. Whether any of the converted funds were stopped at the exchange end is the open question, and none of the firms involved has answered it.