North Korea-linked hackers moved $30 million in bitcoin through Hyperliquid, Arkham says

Arkham says the bitcoin entered Hyperliquid via HyperUnit, was swapped into ether and SOL, then moved across Tron, Solana, and Ethereum before ending up at Kraken, LBank, KuCoin, and several Tron-based services. For PSPs and exchanges, the useful part is not the headline number but the trail: cross-chain hops, mixer-like routing patterns, and venue-to-venue movement that testing teams are expected to catch.

1. According to Arkham, the funds first came into Hyperliquid through HyperUnit, where they were exchanged into ether and SOL. After that, the assets were moved between Tron, Solana, and Ethereum, which is the kind of multi-network routing that makes transaction screening harder in practice.
2. Arkham says the crypto was then sent to Kraken, LBank, and KuCoin, as well as to several services on the Tron network. The firm said it could not identify who controlled the recipient accounts on those platforms.
3. Some of those wallets, Arkham noted, were already linked in 2024 by the anonymous blockchain investigator ZachXBT to about $61 million in stolen funds. That gives compliance teams a reminder that old attribution clusters do not disappear just because the money takes a scenic route through new chains.
4. Kraken said it uses on-chain monitoring and blocks funds tied to sanctioned addresses before they are credited to the platform. LBank said tracking such transfers becomes harder when assets pass through multiple networks and services. KuCoin did not confirm the specific transactions without information from Arkham.
5. Separately, CertiK said North Korean hackers stole $6.75 billion in crypto assets over the past ten years, across 263 confirmed attacks. For operators in high-risk crypto, that is the scale of the screening problem, not a side note.