Wallets linked to North Korea’s Lazarus Group have sold more than $30 million in bitcoin on the Hyperliquid derivatives platform over the past three weeks, according to blockchain data reviewed exclusively by the analytics firm Arkham, according to a CoinDesk report published August 31, 2026. The finding places a sanctioned, state-backed hacking group at the center of the largest decentralized perpetual futures venue at the same moment the Trump administration is working to bring that platform into the regulated U.S. financial system.
The analysis identified Lazarus-linked wallets moving tens of millions on Hyperliquid and converting proceeds into ether and Solana before routing them to centralized exchanges including Kraken, LBank and KuCoin. The wallets were first flagged by the on-chain investigator ZachXBT in 2024, extending a pattern in which North Korean actors use decentralized venues to convert and move stolen digital assets.
How the Funds Moved Through Hyperliquid
Arkham’s review, conducted at CoinDesk’s request, found that proceeds from the bitcoin sales were used to acquire ether and Solana, which were subsequently transferred to the centralized exchanges. CoinDesk has not established the identities of the accounts receiving the funds at those exchanges, or whether the platforms were aware of the funds’ origins before they arrived. Hyperliquid did not respond to a request for comment by publication time. Kraken said its compliance program is designed to identify and block assets associated with sanctioned wallets before they enter the platform, while LBank pointed to its use of industry-standard monitoring tools and KuCoin noted that public on-chain data alone does not reflect the risk-control actions a centralized platform may take after assets arrive.
The Onshoring Push Collides With Sanctions Risk
The activity surfaces as the White House explores how to bring Hyperliquid into the United States under regulatory oversight. President Trump said earlier this month that Commodity Futures Trading Commission Chairman Mike Selig was working on a pathway to bring the platform into the country in a fully compliant and legal fashion, and Bloomberg reported that Kraken parent Payward is in advanced talks with Hyperliquid Labs to offer its perpetual futures to U.S. traders. Bringing the venue onshore would require navigating derivatives rules, customer protections and market surveillance, along with the sanctions and anti-money-laundering risks that arise when users trade directly from wallets without know-your-customer checks. The tension echoes a wider policy dispute in which CME Group and ICE have urged officials to scrutinize the platform, even as a separate push has asked the CFTC to permit Hyperliquid’s perpetual products in the U.S.
A Recurring Pattern at the DeFi Venue
This is not the first time North Korea-linked wallets have appeared on Hyperliquid. In December 2024, MetaMask security researcher Taylor Monahan identified wallets suspected of being controlled by North Korean hackers that had been trading on the platform since at least October of that year, a disclosure that contributed to roughly $250 million of net outflows in a single day. Filings for proposed investment products tied to the platform’s HYPE token have since flagged sanctions exposure as a risk, including a Bitwise exchange-traded fund filing that said the network could potentially be used by sanctioned actors. The case also fits a broader trend in which crypto platforms have lost billions of dollars to hacks since 2025, with North Korea emerging as the most aggressive state actor in the space.
What Still Remains Unsettled
Several questions remain open. CoinDesk has not yet identified who controls the accounts that received funds at the centralized exchanges, and Hyperliquid has not commented on the activity. The value received by sanctioned entities jumped 694% during 2025, according to Chainalysis, underscoring how quickly state-backed activity has grown even as North Korean hackers have been tied to breaches at thousands of companies. For Hyperliquid, which has processed more than $5 trillion in cumulative perpetual futures volume and holds roughly $13.3 billion in open interest according to DefiLlama, the outcome will depend on how regulators weigh its growth against the compliance risks created by its permissionless structure.
