Wallets linked to North Korea’s Lazarus Group have sold more than $30 million worth of Bitcoin through Hyperliquid over the past three weeks, converting the proceeds into Ethereum and Solana before transferring the assets to centralized exchanges, according to Arkham blockchain data.
Lazarus-linked wallets move Bitcoin into ETH and SOL
Arkham said wallets associated with the North Korean state-sponsored Lazarus Group sold more than $30 million in Bitcoin on Hyperliquid during the three-week period. The wallets then used the proceeds to buy Ethereum and Solana, sending the assets to exchanges including Kraken, LBank and KuCoin.
Crypto investigator ZachXBT first identified the addresses in 2024. Arkham later labeled them as connected to Lazarus.
Public blockchain records show transfers between addresses but do not identify the individuals or entities controlling receiving exchange accounts. CoinDesk reported that it could not determine who held the accounts or whether the exchanges knew about the reported source of the funds.
Kraken said compliance is central to its operations and that it continuously monitors blockchain activity with support from analytics providers. The exchange said its controls are designed to identify and block assets connected to sanctioned wallets before they reach the platform.
LBank said it uses industry-standard compliance tools for continuous monitoring. The exchange described illicit transfers across platforms, blockchains and jurisdictions as an industry-wide problem that no single company can independently detect or resolve.
KuCoin said it could not confirm the reported activity without reviewing the underlying wallet data. It also cautioned that public blockchain records do not reveal every action taken after assets arrive at a centralized platform, including account restrictions, regulatory reports and other risk controls.
Hyperliquid transfers raise U.S. sanctions concerns
The reported transfers have a direct U.S. regulatory dimension because the Treasury Department has sanctioned Lazarus Group and identified it as a cyber organization controlled by the North Korean government.
U.S. authorities have linked Lazarus to several digital-asset thefts, including the $625 million Ronin Network attack in 2022. As previously reported by crypto.news, former Defense Secretary Mark Esper recently cited North Korean hacking groups while arguing that regulated domestic crypto markets could give U.S. law enforcement better access to customer and transaction records.
Using a decentralized trading venue can complicate enforcement because Hyperliquid allows users to connect a wallet and trade without opening a traditional brokerage account. Its public blockchain still records transactions, enabling firms such as Arkham to trace transfers between labeled addresses.
However, the presence of assets linked to a sanctioned actor on a decentralized platform does not establish that Hyperliquid assisted the activity or knew who controlled the wallets. CoinDesk’s report also did not establish that Kraken, LBank or KuCoin credited the transferred assets to unrestricted customer accounts.
Any U.S. plan to offer Hyperliquid-linked products domestically would need to address sanctions screening, customer identification and account-level controls. Wallet checks can identify previously labeled addresses, but funds may pass through multiple assets or wallets before reaching another venue.
A recent Hyperliquid testnet deployment illustrated how a permissioned version of its infrastructure could operate. In August, a deployer using Kraken’s name whitelisted 10 wallets and tested controls for canceling orders, reducing positions and moving collateral.
Neither Kraken nor Hyperliquid had confirmed ownership of the deployment when the report appeared. Because Hyperliquid’s testnet allows outside deployments, the use of the Kraken name alone did not prove that the exchange created or operated it.
Payward explores regulated Hyperliquid access for U.S. traders
Bloomberg reported that Kraken parent company Payward is in advanced discussions with Hyperliquid Labs about offering selected perpetual contracts to American traders through Bitnomial, its CFTC-regulated derivatives business.
People familiar with the talks told Bloomberg that Payward had presented the Commodity Futures Trading Commission with an outline of the proposed structure. Any agreement would still require regulatory approval, while the financial terms remain unknown. Payward and Hyperliquid Labs declined to comment to Bloomberg.
President Donald Trump brought the potential U.S. expansion into public view during an Aug. 19 White House event. Referring to CFTC Chair Michael Selig, Trump said he understood that the regulator was working to bring Hyperliquid into the United States in a “fully compliant and legal fashion.”
A Payward arrangement would give eligible U.S. customers access through a registered operator rather than Hyperliquid’s permissionless interface. Commodity derivatives offered to American retail traders generally must use CFTC-regulated entities, and wallet screening alone does not replace exchange, clearing and brokerage requirements.
Payward already has the regulatory infrastructure required to operate in the U.S. derivatives market. The company completed its Bitnomial purchase in May after agreeing to pay as much as $550 million in cash and stock.
The acquisition gave Payward control of a designated contract market, a derivatives clearing organization and a futures commission merchant. Together, the three registrations cover trading, clearing and brokerage services under CFTC oversight.
Kraken launched regulated perpetuals for eligible U.S. customers in June. The service allows supported users to trade spot, margin, traditional futures and perpetual futures through Kraken Pro while using Bitnomial’s regulated structure.
Hyperliquid remains a leading decentralized perpetuals platform
Hyperliquid operates its main exchange through HyperCore, an on-chain trading system that handles order matching, margin calculations and liquidations. Users trade from connected crypto wallets, while the platform’s primary permissionless interface does not require a conventional brokerage account.
Perpetual futures differ from dated futures because they have no fixed expiry. Funding payments between long and short traders help keep contract prices close to the value of their underlying assets, allowing positions to remain open as long as traders meet margin requirements.
DefiLlama data showed that Hyperliquid had processed approximately $5.19 trillion in cumulative perpetual trading volume at the time of writing. Its perpetual markets recorded about $60.44 billion in seven-day volume and $204.95 billion during the previous 30 days.
Open interest stood at roughly $13.3 billion, representing the notional value of outstanding perpetual positions. DefiLlama also recorded more than $32.6 billion in cumulative liquidations on the platform, including approximately $2.25 billion during the preceding 30 days.
Beyond markets operated by the core protocol, Hyperliquid Improvement Proposal 3 allows outside developers to launch independent perpetual exchanges using HyperCore. Deployers select their contracts, collateral, leverage limits, funding settings and price sources after staking 500,000 HYPE.
Validators can slash the stake if a deployer manipulates an oracle or violates market rules. HIP-3 operators receive half of the trading fees generated by their markets, while newer permission tools tested on the network could allow individual deployers to restrict access to approved wallets.
