Blab Crypto
North Korean Hackers Move $30 Million of Bitcoin Through Hyperliquid as U.S. Eyes Onshore Crypto Platform
Wallets linked to North Korea’s state‑sponsored Lazarus Group have sold more than $30 million in bitcoin on the decentralized derivatives platform Hyperliquid in recent weeks, according to blockchain analytics firm Arkham. The sales were followed by purchases of ether using the proceeds.
Arkham’s analysis, reviewed exclusively for CoinDesk, identified the Lazarus‑associated wallets after the group’s activity was first flagged by crypto researcher ZachXBT in 2024. The data show the wallets moved bitcoin into Hyperliquid, sold it for cash, and then used the cash to buy ether. CoinDesk has not confirmed the identities of the accounts that received the funds, nor whether the exchanges that handled the transactions were aware of the wallets’ sanctioned status.
Hyperliquid, a Singapore‑based platform that allows users to trade perpetual futures directly from their crypto wallets, has not responded to requests for comment. The platform’s core development company, Hyperliquid Labs, is reportedly in talks with the U.S. Commodity Futures Trading Commission (CFTC) to bring its products to U.S. traders.
The U.S. administration has highlighted Hyperliquid’s potential for onshore regulation. At a White House event in early August, President Donald Trump said that CFTC Chair Mike Selig was working on a pathway to bring Hyperliquid into the United States “in a fully compliant and legal fashion.” Trump’s remarks followed a broader effort to position the United States as a hub for global crypto activity.
Hyperliquid’s business model differs from traditional exchanges. Users connect their own wallets and trade without opening a brokerage account or completing know‑your‑customer (KYC) checks. The platform has processed more than $5 trillion of cumulative perpetual futures volume and currently holds about $13.3 billion of open interest, according to DefiLlama. In the past 30 days, it handled roughly $205 billion of perpetual futures volume.
The platform’s growth has attracted attention from both Wall Street and regulators. Intercontinental Exchange CEO Jeffrey Sprecher described Hyperliquid as “bigger than Nasdaq” by trading activity. CME Group and ICE have urged U.S. officials to scrutinize Hyperliquid, citing concerns that the platform could facilitate market manipulation and sanctions evasion. CME Group is currently suing the CFTC over its push to allow crypto perpetual futures on U.S. exchanges.
The Lazarus Group’s use of Hyperliquid is not the first instance of North Korean‑linked wallets on the platform. In December 2024, MetaMask researcher Taylor Monahan identified wallets suspected of North Korean control that had been trading on Hyperliquid since October. Those wallets were linked to a single day net outflow of about $250 million. Hyperliquid stated that the exchange had not been exploited and that no user funds were lost.
Other exchanges have responded to the broader issue of sanctioned wallets. Kraken said it maintains a “best‑in‑class compliance program” and works with blockchain analytics providers to block assets linked to sanctioned wallets. LBank confirmed that it uses industry‑standard compliance tools but acknowledged that cross‑chain, cross‑platform activity poses ongoing challenges. KuCoin declined to comment on the specific activity until it could review the data, noting that on‑chain data does not reveal all compliance actions taken by a platform.
The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Lazarus in 2019 and has identified wallets and services used by the group to move stolen funds. OFAC’s focus has expanded from individual wallets to the infrastructure that facilitates the movement of illicit assets.
The incident underscores the tension between the decentralized nature of platforms like Hyperliquid and the regulatory framework that governs sanctioned actors. While Hyperliquid’s model offers users direct wallet access, it also creates a pathway for sanctioned actors to move funds without traditional KYC checks.
At present, the U.S. regulatory path for Hyperliquid remains under negotiation. The platform’s potential entry into the U.S. market would require compliance with derivatives exchange rules, customer protection standards, and anti‑money‑laundering requirements. The outcome of these discussions will shape how decentralized derivatives platforms operate in regulated jurisdictions.
The Lazarus Group’s recent activity on Hyperliquid, combined with the U.S. administration’s push to bring the platform onshore, highlights the ongoing challenge of aligning decentralized trading venues with sanctions enforcement and regulatory oversight.
Arkham’s analysis, reviewed exclusively for CoinDesk, identified the Lazarus‑associated wallets after the group’s activity was first flagged by crypto researcher ZachXBT in 2024. The data show the wallets moved bitcoin into Hyperliquid, sold it for cash, and then used the cash to buy ether. CoinDesk has not confirmed the identities of the accounts that received the funds, nor whether the exchanges that handled the transactions were aware of the wallets’ sanctioned status.
Hyperliquid, a Singapore‑based platform that allows users to trade perpetual futures directly from their crypto wallets, has not responded to requests for comment. The platform’s core development company, Hyperliquid Labs, is reportedly in talks with the U.S. Commodity Futures Trading Commission (CFTC) to bring its products to U.S. traders.
The U.S. administration has highlighted Hyperliquid’s potential for onshore regulation. At a White House event in early August, President Donald Trump said that CFTC Chair Mike Selig was working on a pathway to bring Hyperliquid into the United States “in a fully compliant and legal fashion.” Trump’s remarks followed a broader effort to position the United States as a hub for global crypto activity.
Hyperliquid’s business model differs from traditional exchanges. Users connect their own wallets and trade without opening a brokerage account or completing know‑your‑customer (KYC) checks. The platform has processed more than $5 trillion of cumulative perpetual futures volume and currently holds about $13.3 billion of open interest, according to DefiLlama. In the past 30 days, it handled roughly $205 billion of perpetual futures volume.
The platform’s growth has attracted attention from both Wall Street and regulators. Intercontinental Exchange CEO Jeffrey Sprecher described Hyperliquid as “bigger than Nasdaq” by trading activity. CME Group and ICE have urged U.S. officials to scrutinize Hyperliquid, citing concerns that the platform could facilitate market manipulation and sanctions evasion. CME Group is currently suing the CFTC over its push to allow crypto perpetual futures on U.S. exchanges.
The Lazarus Group’s use of Hyperliquid is not the first instance of North Korean‑linked wallets on the platform. In December 2024, MetaMask researcher Taylor Monahan identified wallets suspected of North Korean control that had been trading on Hyperliquid since October. Those wallets were linked to a single day net outflow of about $250 million. Hyperliquid stated that the exchange had not been exploited and that no user funds were lost.
Other exchanges have responded to the broader issue of sanctioned wallets. Kraken said it maintains a “best‑in‑class compliance program” and works with blockchain analytics providers to block assets linked to sanctioned wallets. LBank confirmed that it uses industry‑standard compliance tools but acknowledged that cross‑chain, cross‑platform activity poses ongoing challenges. KuCoin declined to comment on the specific activity until it could review the data, noting that on‑chain data does not reveal all compliance actions taken by a platform.
The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Lazarus in 2019 and has identified wallets and services used by the group to move stolen funds. OFAC’s focus has expanded from individual wallets to the infrastructure that facilitates the movement of illicit assets.
The incident underscores the tension between the decentralized nature of platforms like Hyperliquid and the regulatory framework that governs sanctioned actors. While Hyperliquid’s model offers users direct wallet access, it also creates a pathway for sanctioned actors to move funds without traditional KYC checks.
At present, the U.S. regulatory path for Hyperliquid remains under negotiation. The platform’s potential entry into the U.S. market would require compliance with derivatives exchange rules, customer protection standards, and anti‑money‑laundering requirements. The outcome of these discussions will shape how decentralized derivatives platforms operate in regulated jurisdictions.
The Lazarus Group’s recent activity on Hyperliquid, combined with the U.S. administration’s push to bring the platform onshore, highlights the ongoing challenge of aligning decentralized trading venues with sanctions enforcement and regulatory oversight.
