Wallets tied to the North Korean state-sponsored Lazarus Group have moved more than $30 million in bitcoin through Hyperliquid over the past three weeks, according to blockchain data reviewed exclusively by analytics firm Arkham. The activity, which involved converting bitcoin into ether and Solana before routing funds to centralized exchanges including Kraken, LBank and KuCoin, was first reported by CoinDesk.

The disclosure lands at a particularly sensitive moment. The Trump administration is actively working to bring Hyperliquid, the largest decentralized perpetual futures venue by trading activity, into the regulated US financial system. President Donald Trump said earlier this month that Commodity Futures Trading Commission Chairman Mike Selig was developing a pathway for the platform to operate in the United States in what he described as a fully compliant and legal manner.

The wallets identified by Arkham were first flagged in 2024 by the on-chain investigator known as ZachXBT, who had linked the addresses to approximately $61 million in stolen funds. Their continued use of Hyperliquid suggests that sanctioned actors have found the platform’s permissionless structure useful for moving large sums without the identity verification requirements common at centralized venues.

How the Funds Moved

According to Arkham’s analysis, the Lazarus-linked wallets sold bitcoin on Hyperliquid and used the proceeds to purchase ether and Solana. Those assets were then transferred to Kraken, LBank and KuCoin, among other destinations. CoinDesk reported that it has not been able to identify the owners of the accounts that received the funds at those exchanges, nor has it confirmed whether the platforms were aware of the funds’ origins before they arrived.

Hyperliquid did not respond to a request for comment by publication time.

Kraken said its compliance program is designed to identify and block assets associated with sanctioned wallets before they enter the platform. A company representative described compliance as the most fundamental element of its operations, noting that the exchange works with major blockchain analytics firms to continuously monitor on-chain activity.

LBank said it uses industry-standard compliance tools to monitor transactions, while acknowledging that the crypto industry’s cross-platform, cross-jurisdictional nature means risk is rarely confined to a single venue. KuCoin said it could not verify or comment on sanctioned wallet activity without first reviewing the underlying data, which CoinDesk did not share before publication. The exchange added that public on-chain data shows asset movements but does not fully reflect the compliance measures a centralized platform may take after funds arrive, such as account restrictions or regulatory reporting.

A Recurring Problem

This is not the first time North Korea-linked wallets have appeared on Hyperliquid. In December 2024, Taylor Monahan, a security researcher at MetaMask, identified wallets suspected of being controlled by North Korean hackers that had been trading on the platform since at least October of that year. That disclosure triggered roughly $250 million in net outflows from Hyperliquid in a single day, amid concerns the activity could be reconnaissance ahead of a future attack. Hyperliquid said at the time that the platform had not been breached and that no user funds were lost.

The latest episode underscores a structural tension at the heart of Hyperliquid’s business model. Unlike traditional exchanges, the platform allows users to connect their crypto wallets directly and trade perpetual futures without opening a brokerage account or undergoing know-your-customer checks. That design has driven explosive growth, but it also creates what compliance experts see as a screening gap that sanctioned actors can exploit.

The scale of Hyperliquid’s expansion is significant. According to DefiLlama, the platform has processed more than $5 trillion in cumulative perpetual futures volume, with open interest currently around $13.3 billion. Trading volume over the past 30 days reached approximately $205 billion. Jeffrey Sprecher, chief executive of Intercontinental Exchange, said in May that Hyperliquid was larger than Nasdaq in terms of trading activity.

Regulatory and Market Implications

The Lazarus Group’s activity on Hyperliquid could complicate the platform’s push into the US market. Bringing the venue onshore would require satisfying derivatives exchange regulations, customer protection standards and market surveillance requirements, while also addressing the sanctions and anti-money-laundering risks that stem from its wallet-based trading model.

Bloomberg reported that Payward, the parent company of Kraken, is in advanced talks with Hyperliquid Labs to offer perpetual futures to US investors. The discussions reportedly involve Bitnomial, a CFTC-regulated derivatives platform, as a potential intermediary. HYPE, Hyperliquid’s native token, surged nearly 50% following news of the US entry talks, according to Coin Bureau.

CME Group and ICE have urged US officials to scrutinize Hyperliquid, warning that the platform could be exploited for market manipulation and sanctions evasion. CME Group is also pursuing litigation against the CFTC over the agency’s efforts to permit crypto perpetual futures on US trading platforms.

The sanctions risk is already surfacing in regulatory filings. Bitwise, which launched an exchange-traded fund tied to HYPE, stated in a May filing that Hyperliquid’s developers and operators cannot force KYC, anti-money-laundering or sanctions screening on users who interact directly with the blockchain. The filing flagged the potential use of the network by sanctioned actors as a risk factor.

The US Treasury’s Office of Foreign Assets Control designated Lazarus Group as a sanctioned entity in 2019 and has since identified numerous wallets and services used by the group to move stolen funds. The Treasury has broadened its oversight focus beyond individual sanctioned wallets to include the infrastructure used to move illicit proceeds, raising the stakes for platforms like Hyperliquid.

According to Chainalysis, the value of crypto received by sanctioned entities jumped 694% in 2025, driven by increased adoption of digital assets by Russia, Iran and North Korea for state-level financial and security activities. North Korea is widely regarded as the most aggressive state actor in the crypto space, with US authorities alleging that Lazarus Group and other Pyongyang-backed organizations have stolen and laundered billions of dollars in digital assets to fund the regime’s weapons programs.

For Hyperliquid, the path forward will depend on how regulators weigh its remarkable growth against the compliance risks created by its permissionless design. The platform’s ability to address those concerns while preserving the features that attracted users in the first place will likely shape both its regulatory prospects and its standing with institutional counterparties.