Key highlights:

  • Lazarus Group-linked wallets moved $30M+ through Hyperliquid over three weeks, converting BTC into ETH and SOL before routing funds toward Kraken, LBank, and KuCoin
  • Trump backed CFTC efforts to bring Hyperliquid onshore, while the platform advances talks with Kraken's parent, Payward
  • North Korean hackers stole $2.02B in crypto in 2025 alone, raising key compliance questions ahead of any U.S. approval
     

Hyperliquid is facing a fresh compliance question after being linked to North Korea’s state-sponsored Lazarus Group, at a time when the platform is trying to establish a regulated presence in the United States.

President Donald Trump said at a White House event on Aug. 19 that Commodity Futures Trading Commission (CFTC) Chairman Michael Selig was working to bring the decentralized trading platform into the United States in a “fully compliant and legal fashion.”

However, over the past 3 weeks, wallets linked to Lazarus Group have moved more than $30 million through Hyperliquid, according to blockchain data identified by Arkham researcher Emmett Gallic. 

The activity continued through Aug. 31, with the funds moving from Bitcoin into other crypto assets before being transferred across several networks and, in some cases, sent toward centralized exchanges.

Lazarus-linked Bitcoin flowed through Hyperliquid before reaching major crypto exchanges

Arkham identified four Lazarus-linked outflows between July 30 and Aug. 28, including transfers of 244.148 BTC, worth about $19.42 million at the time, and 262.2 BTC valued at roughly $16.63 million.

Lazarus group Bitcoin transactions

According to Arkham’s tracking, the Bitcoin entered Hyperliquid before being converted into Ether and Solana. 

The assets were then bridged across Tron, Solana, and Ethereum before reaching centralized exchanges, including Kraken, LBank, and KuCoin, along with several unidentified services.

Notably, the wallets were previously linked to Lazarus by blockchain investigator ZachXBT in 2024. The identities of those controlling the receiving accounts have not been established.

The movements alone do not establish that Hyperliquid facilitated sanctions violations, or that any exchange knowingly accepted illicit funds, or that the assets were ultimately sold or used for a specific purpose.

Notably, many centralized exchanges said they maintain systems to detect suspicious transactions.

Kraken, LBank, and KuCoin reportedly said they use compliance and blockchain-monitoring systems to detect potentially sanctioned transactions, while stressing that public blockchain data alone cannot confirm whether specific accounts were restricted or other action was taken.

Hyperliquid’s U.S. expansion plan meets new regulatory and sanctions questions

The latest development now intersects directly with Hyperliquid's efforts to gain access to the U.S. market.

Bloomberg reported that the platform’s parent company, Hyperliquid Labs, and Payward, the parent company of Kraken, are in advanced discussions over a structure that could allow U.S. customers to trade a selection of Hyperliquid-linked perpetual futures through Bitnomial, a U.S.-regulated derivatives exchange and clearinghouse owned by Payward. 

Regulatory approval is still required, while financial terms remain undisclosed.

Under the proposed arrangement, U.S. customers would trade through Bitnomial rather than directly through Hyperliquid's permissionless interface.

The structure could provide a way for Hyperliquid-linked products to reach American traders while placing customer onboarding, clearing, and other regulatory functions inside a registered U.S. framework.

The timing makes the Lazarus-linked transactions particularly relevant to regulators.

U.S. sanctions generally prohibit Americans from dealing with property linked to designated entities such as Lazarus Group, while decentralized platforms face a different compliance challenge because users can interact with blockchain-based markets directly from their wallets.

North Korean hackers stole $2 billion in crypto in 2025 

North Korean crypto activity has remained a major concern, with Chainalysis estimating that hackers linked to the country stole at least $2.02 billion in cryptocurrency in 2025. 

North Korea crypto hacks

That brought the cumulative value of crypto stolen by North Korean operations to at least $6.75 billion by year-end.

The latest activity also revives earlier concerns over North Korean-linked wallets using Hyperliquid. 

In December 2024, MetaMask security researcher Taylor Monahan identified wallets suspected of being controlled by North Korean hackers trading on the platform. 

Hyperliquid later saw about $250 million in net outflows in a single day, although it said no user funds were lost.

Separate Bitcoin movements linked to the Lazarus Group were reported in August, including transfers of 262.2 BTC on Aug. 12 and 244.148 BTC on Aug. 28.

However, the transactions do not establish that the Bitcoin was sold or linked to funds on Hyperliquid, highlighting the limits of on-chain data.

For Hyperliquid, the key issue is therefore not simply whether Lazarus-linked wallets used its infrastructure, but how the platform and U.S. regulators address the compliance concerns as it pursues greater access to the American financial system.