Blockchain data reviewed by CoinDesk shows wallets tied to North Korea’s Lazarus Group sold more than $30 million in bitcoin on the platform in the last three weeks alone.
- Wallets linked to North Korea’s state-sponsored hacking squad, the Lazarus Group, have sold more than $30 million in bitcoin on Hyperliquid in recent weeks, blockchain data from Arkham shows.
- Hackers’ use of the platform comes as U.S. President Donald Trump’s administration explores ways to bring Hyperliquid into the regulated U.S. market.
North Korean hackers are moving funds through Hyperliquid, selling more than $30 million in bitcoin on the decentralized derivatives trading platform in the past three weeks alone, according to blockchain data.
The data, which was reviewed exclusively by blockchain analytics firm Arkham at CoinDesk’s request, identified wallets linked to North Korea’s state-sponsored hacking squad, the Lazarus Group, actively moving funds through the platform. Proceeds from the hackers’ recent bitcoin sales were used to acquire ether and solana (SOL), which were subsequently transferred to other crypto exchanges, including Kraken, LBank and KuCoin.
The wallets that Arkham identified as being linked to Lazarus were first discovered by crypto sleuth ZachXBT in 2024.
CoinDesk has not yet established the identities of the owners of the accounts receiving funds at the centralized exchanges, or whether the platforms were aware of the funds’ origins.
Hyperliquid did not respond to CoinDesk’s requests for comment by publication time.
A representative for Kraken told CoinDesk that “compliance is foundational to how we operate. Kraken maintains a best-in-class compliance program, including partnerships with leading blockchain analytics providers that continuously monitor onchain activity. These controls are designed to identify and block any assets associated with sanctioned wallets before they enter our platform.”
LBank said it has consistently used industry-standard compliance tools to conduct ongoing monitoring, but acknowledged that the crypto industry is «inherently cross-platform, cross-chain, and cross-jurisdictional.»
«As a result,» the spokesperson added, «relevant risks are often not generated by, or capable of being independently identified and addressed by, any single platform, but instead represent an ongoing challenge faced by the industry as a whole.»
Meanwhile, a representative from KuCoin said they could not verify or comment on the sanctioned wallet activity without first seeing the data, which CoinDesk declined to share ahead of publication.
“We would also note that public onchain data reflects the movement of assets but does not necessarily provide a complete picture of compliance actions taken by a centralized platform after assets reach the platform. Measures such as account restrictions, regulatory reporting, or other risk-control actions may occur at the account or platform level and may not be visible from public blockchain data alone,» the representative said, adding that the exchange «maintains sanctions compliance policies and procedures designed to meet applicable legal and regulatory requirements.»
The Lazarus Group’s use of Hyperliquid, which could potentially put it in hot water with authorities for running afoul of U.S. sanctions laws, comes as the Trump administration has been exploring how the platform could be brought into the regulated U.S. financial system.
Trump wants Hyperliquid onshore
At a White House event earlier this month, Trump said that Commodity Futures Trading Commission (CFTC) Chairman Mike Selig was working on a pathway to bring Hyperliquid into the U.S. “in a fully compliant and legal fashion.”
The comments align with Trump’s broader effort to make the U.S. the center of the global crypto industry and to encourage businesses that have historically operated offshore to establish themselves under U.S. regulatory oversight.
Singapore-based Hyperliquid Labs is the core development company behind the Hyperliquid network.
Bringing the platform into the U.S. would require navigating rules governing derivatives exchanges, customer protections and market surveillance, while also addressing sanctions and anti-money-laundering risks that can arise when users trade directly from crypto wallets.
Kraken’s parent company, Payward, is in advanced talks with Hyperliquid Labs to bring its perpetual futures to U.S. traders, Bloomberg reported Monday.
Hyperliquid’s rapid rise
Hyperliquid has emerged as the dominant decentralized venue for perpetual futures, derivatives contracts that allow traders to speculate on asset prices without an expiration date.
Unlike a conventional exchange, users can connect crypto wallets directly to the platform rather than opening a traditional brokerage account. The platform also allows users to trade directly from a wallet without opening an account or undergoing traditional know-your-customer (KYC) checks.
Its growth has been extraordinary.
Hyperliquid has processed more than $5 trillion of cumulative perpetual futures trading volume and currently has around $13.3 billion of open interest, according to data from DefiLlama. The exchange handled about $205 billion of perpetual futures volume over the past 30 days.
That success has increasingly put Hyperliquid on the radar of both Wall Street and U.S. regulators. Intercontinental Exchange CEO Jeffrey Sprecher said in May that Hyperliquid was “bigger than Nasdaq” by trading activity and noted its dominance of decentralized perpetual futures.
But its structure has also raised regulatory questions. CME Group and ICE both urged U.S. officials to scrutinize Hyperliquid earlier this year, warning that the platform could facilitate market manipulation and sanctions evasion, Bloomberg reported in May. CME Group is currently suing the CFTC in an effort to block the regulator’s push to pave the way for crypto perpetual futures to be offered on U.S. trading platforms.
North Korean activity isn’t new
It is not the first time North Korea-linked wallets have surfaced on Hyperliquid.
In December 2024, MetaMask security researcher Taylor Monahan identified wallets suspected of being controlled by North Korean hackers that had been trading on the platform since at least October of that year. The disclosure raised concerns that the activity could signal reconnaissance ahead of a potential attack and contributed to roughly $250 million of net outflows from Hyperliquid in a single day. The exchange said at the time that the platform had not been exploited and no user funds had been lost.
More recent regulatory filings for proposed investment products related to Hyperliquid’s token HYPE have explicitly identified sanctions exposure as a risk.
For example, Bitwise, the crypto asset manager that launched an exchange-traded fund for HYPE, said in a filing in May that Hyperliquid’s developers and operators cannot compel users interacting directly with the blockchain to undergo know-your-customer (KYC), anti-money-laundering (AML) or sanctions screening, meaning the network could potentially be used by sanctioned actors.
North Korea has become the single most aggressive state actor operating in the crypto space. The U.S. government has accused the Lazarus Group and other state-backed organizations of stealing and laundering billions of dollars in digital assets to generate revenue for Pyongyang and its weapons programs. OFAC sanctioned Lazarus in 2019 and has subsequently identified crypto wallets and services used by the group to move stolen funds.
The issue has become increasingly important for crypto platforms as the Treasury expands its focus from individual sanctioned wallets to the infrastructure used to move their money.
Crypto activity linked to sanctioned states surged in 2025, with Russia, Iran and North Korea increasingly using digital assets as part of state-backed financial and security operations. The value received by sanctioned entities jumped 694% during the year, according to Chainalysis.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
Anvil: The Missing Collateral Layer
Anvil: The Missing Collateral Layer
Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.
Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.
Why it matters:
Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.
NYSE owner ICE taps tZERO for tokenized securities push, takes stake in firm
Ireland bars crypto from new tax-advantaged investment accounts
Bitmine makes largest ether purchase since June as Tom Lee points to crypto’s strong Q3
Kalshi lays down first lifetime ban for ex-member of Congress George Santos
NYSE owner ICE taps tZERO for tokenized securities push, takes stake in firm
