North Korean hackers move $30 million in Bitcoin through Hyperliquid

Blockchain data from Arkham reveals that North Korea's state-sponsored Lazarus Group laundered over $30 million in Bitcoin through the decentralized exchange Hyperliquid over a three-week period. The funds were converted to Ether and Solana before being routed to centralized exchanges like Kraken, LBank, and KuCoin. This disclosure emerges at a critical juncture, as President Donald Trump and CFTC Chairman Michael Selig explore pathways to onshore Hyperliquid. Hyperliquid Labs is currently negotiating with Kraken's parent, Payward, to offer regulated trading to U.S. users via its Bitnomial subsidiary, raising intense regulatory questions regarding decentralized compliance and sanctions enforcement.

Lazarus Group Hyperliquid laundering

• ▪The Lazarus-linked wallets used on Hyperliquid were identified by Arkham analyst Emmett Gallic, citing a 2024 attribution by crypto investigator ZachXBT
• ▪Wallets linked to North Korea's state-sponsored Lazarus Group laundered over $30 million in Bitcoin through the decentralized exchange Hyperliquid over a three-week period
• ▪Proceeds from the Lazarus Group's Bitcoin sales on Hyperliquid were converted to Ether and Solana before being transferred to centralized exchanges including Kraken, LBank, and KuCoin
• ▪In December 2024, MetaMask security researcher Taylor Monahan identified suspected North Korean hacker wallets trading on Hyperliquid, which triggered approximately $250 million in single-day net outflows

Hyperliquid US regulatory pathway

• ▪CME Group and Intercontinental Exchange urged U.S. regulators to investigate Hyperliquid for potential market manipulation and sanctions exposure, with CME Group suing the CFTC to block crypto perpetuals on U.S. platforms
• ▪Payward acquired Bitnomial on May 1 for $550 million, gaining access to Bitnomial's CFTC-registered derivatives clearing organization, designated contract market, and futures commission merchant licenses
• ▪President Donald Trump announced at an August 19 White House event that Commodity Futures Trading Commission Chairman Michael Selig is working to bring Hyperliquid into the United States legally
• ▪Hyperliquid Labs is in advanced talks with Kraken's parent company, Payward, to allow registered U.S. traders to trade a subset of Hyperliquid perpetual futures via the CFTC-regulated clearinghouse Bitnomial

North Korean crypto theft

• ▪According to Chainalysis, the North Korean regime stole approximately $2 billion in cryptocurrency in 2025, while CertiK reports the country has stolen $6.75 billion across 263 incidents since 2016
• ▪The U.S. Treasury's Office of Foreign Assets Control sanctioned the Lazarus Group in 2019 for its involvement in laundering stolen digital assets to fund North Korea's weapons programs
• ▪The Lazarus Group was linked to the 2022 Ronin Network breach and the $1.5 billion Bybit hack in 2025, which stands as the largest cryptocurrency theft on record

Exchange compliance monitoring responses

• ▪Kraken stated that its compliance program uses blockchain analytics to identify and block assets associated with sanctioned wallets before they enter the platform
• ▪KuCoin stated that public on-chain data does not reflect internal compliance actions, such as account restrictions or regulatory reporting, taken after assets reach a centralized exchange
• ▪LBank acknowledged that cross-platform and cross-chain risks represent an industry-wide challenge that cannot always be independently identified or addressed by a single platform

HYPE token price performance

• ▪Hyperliquid's native token, HYPE, reached an all-time high of $86.71 on August 27, and traded around $84 following the disclosures of North Korean wallet activity
• ▪Hyperliquid allocates 99% of its protocol fees to its Assistance Fund to buy back and permanently burn HYPE tokens, retiring $1.3 billion in supply since December 2024

4 sources