North Korean hackers move $30 million in bitcoin on Hyperliquid as US weighs onshoring the platform

Wallets tied to North Korea’s state-backed Lazarus Group have sold more than $30 million in bitcoin on the decentralized trading platform Hyperliquid over the past three weeks, according to blockchain data reviewed by analytics firm Arkham.

The funds, moved through Hyperliquid, were used to buy ether and solana, which were then sent to other exchanges, including Kraken, LBank, and KuCoin. Hyperliquid, a platform for trading perpetual futures—a type of derivative contract with no expiration date—allows users to trade directly from crypto wallets without traditional identity checks.

Key numbers

• Over $30 million in bitcoin sold on Hyperliquid by Lazarus-linked wallets in three weeks.
• Hyperliquid has processed over $5 trillion in cumulative trading volume.
• Current open interest on the platform stands at around $13.3 billion.

Exchange responses

Kraken stated it uses blockchain analytics to block assets tied to sanctioned wallets before they enter its platform. LBank acknowledged the cross-platform nature of crypto risks and said it uses standard compliance tools. KuCoin noted that public blockchain data does not always reflect internal compliance actions and that it follows legal requirements for sanctions.

Hyperliquid did not respond to requests for comment.

US regulatory push

US President Donald Trump’s administration is exploring ways to bring Hyperliquid into the regulated US market. At a White House event earlier this month, Trump said the Commodity Futures Trading Commission (CFTC) is working on a compliant pathway for the platform. Kraken’s parent company, Payward, is reportedly in advanced talks with Hyperliquid Labs to offer its perpetual futures to US traders.

Previous North Korean activity

This is not the first time North Korea-linked wallets have been active on Hyperliquid. In December 2024, security researcher Taylor Monahan identified wallets suspected of being controlled by North Korean hackers trading on the platform since at least October 2024. The activity raised concerns but did not result in any reported loss of user funds.

Regulatory filings for investment products tied to Hyperliquid’s token, HYPE, have highlighted sanctions exposure as a risk, noting that the platform cannot force users to undergo identity or sanctions checks.

Why this matters

The use of Hyperliquid by sanctioned actors raises questions about compliance and enforcement as the platform considers entering the US market. North Korea has been accused by the US of using stolen crypto funds to support its weapons programs, and the Treasury has previously sanctioned wallets and services linked to the Lazarus Group.

Sources

• CoinDesk