Lazarus launders $30M BTC through Top DEX

TLDR

Wallets linked to North Koreas Lazarus Group have moved over $30 million in Bitcoin through the decentralized exchange Hyperliquid, raising fresh sanctions and DeFi compliance questions.

1. Lazarus-associated addresses sold around $30 million in BTC on Hyperliquid, routing proceeds through multiple chains and into major centralized exchanges.
2. The activity highlights how non-KYC DeFi venues can be used around sanctions controls just as Hyperliquid pursues regulated access to US users.
3. Regulators and exchanges are now under pressure to tighten monitoring of sanctioned wallets and cross-chain flows, which could reshape DeFi risk and access.

Deep Dive

1. What Actually Happened

Blockchain intelligence firm Arkham traced wallets tagged as Lazarus Group to more than $30 million in Bitcoin sales on Hyperliquid over roughly three weeks, as reported by Cointelegraph and others. These wallets sent BTC to Hyperliquid and its related venue HyperUnit, swapped into Ether (ETH) and Solana (SOL), then bridged assets out to networks like Tron, Solana and Ethereum before finally depositing them at KuCoin, Kraken, LBank and unlabeled Tron services. Public reporting notes that the addresses were first linked to Lazarus by investigator ZachXBT in 2024, then labeled accordingly by Arkham, making this a continuation of known state-linked hacking and laundering activity rather than a new actor.

2. Why It Matters For DeFi And Hyperliquid

Hyperliquid is a large decentralized perpetuals exchange without traditional know your customer or anti money laundering checks, which makes it accessible to anyone with a wallet and also attractive for sanctioned actors. Articles on the incident note that Lazarus exploited this openness to move funds while Hyperliquid is simultaneously in talks with Krakens parent Payward and US regulators about offering selected Hyperliquid-linked perps to US traders via the CFTC regulated Bitnomial platform. At the same time, the US Treasurys OFAC already sanctions Lazarus, and other jurisdictions, such as the UK, are explicitly warning crypto firms to tighten monitoring of sanctions evasion flows.

3. What To Watch Next

Several pressure points could change the landscape. First, whether OFAC or the CFTC publicly treat these Lazarus flows as a red flag for Hyperliquids US ambitions could drive tighter standards on any DeFi venue seeking regulated access. Second, centralized exchanges named in reports have stated they rely on screening tools to block funds from sanctioned wallets, but additional wallet tagging and retroactive freezes are still possible. Third, broader regulatory moves, like UK advisories ordering firms to review high risk networks for sanctions evasion, signal a trend toward closer scrutiny of cross chain routing and DeFi liquidity hubs.

Conclusion

Lazarus using Hyperliquid to move around $30 million in BTC shows how large state linked actors can exploit non KYC DeFi infrastructure while still ending at familiar centralized exchanges. As Hyperliquid and similar platforms seek regulated access, the tension between open access and sanctions enforcement is likely to push both regulators and venues toward stricter monitoring of wallets and flows, which could affect how easily capital moves through the wider crypto ecosystem.