TLDR
- Wallets linked to North Korea’s Lazarus Group sold over $30 million in Bitcoin on Hyperliquid in three weeks
- Proceeds were converted to Ethereum and Solana, then sent to Kraken, LBank, and KuCoin
- Kraken’s parent company Payward is in advanced talks with Hyperliquid Labs to offer perpetual futures to U.S. traders
- President Trump said the CFTC is working to bring Hyperliquid into the U.S. “in a fully compliant and legal fashion”
- Hyperliquid has processed over $5.19 trillion in cumulative perpetual trading volume
Wallets tied to North Korea’s Lazarus Group sold more than $30 million in Bitcoin on Hyperliquid over three weeks, while Kraken’s parent company explores a deal to bring the platform to U.S. traders.
Lazarus-Linked Wallets Move Over $30M Through Hyperliquid as U.S. Explores Regulated Entry
Arkham researcher Emmett Gallic said addresses linked to the OFAC-sanctioned North Korean hacking group Lazarus Group have recently moved more than $30 million through Hyperliquid, with… pic.twitter.com/qZsHNZ7uQx
— Wu Blockchain (@WuBlockchain) August 31, 2026
Blockchain data from Arkham, reviewed by CoinDesk, identified wallets linked to the state-sponsored hacking group actively moving funds through the decentralized derivatives platform.
The wallets converted Bitcoin sales into Ethereum and Solana. Those assets were then transferred to centralized exchanges including Kraken, LBank, and KuCoin.
Crypto investigator ZachXBT first flagged the wallets in 2024. Arkham later labeled them as connected to Lazarus.
CoinDesk said it could not identify the owners of the receiving accounts or confirm whether the exchanges knew where the funds came from.
Exchanges Respond
Kraken said compliance is central to its operations and that it monitors blockchain activity using analytics providers. It said its controls are designed to block assets from sanctioned wallets before they reach the platform.
LBank acknowledged the challenge, saying illicit transfers across platforms, blockchains, and jurisdictions are an industry-wide problem no single company can solve alone.
KuCoin said it could not confirm the activity without seeing the underlying wallet data. The exchange added that public blockchain records do not always show compliance actions taken after assets arrive at a platform.
Hyperliquid did not respond to requests for comment.
The U.S. Treasury sanctioned Lazarus in 2019. The group has been linked to several crypto thefts, including the $625 million Ronin Network attack in 2022. Crypto activity linked to sanctioned states jumped 694% in 2025, according to Chainalysis.
Hyperliquid allows users to trade directly from a crypto wallet without opening a traditional brokerage account or going through KYC checks. That structure makes it harder for regulators to enforce sanctions screening at the account level.
This is not the first time North Korea-linked wallets have appeared on Hyperliquid. In December 2024, a MetaMask security researcher identified suspected North Korean wallets that had been trading on the platform since at least October that year. The news triggered roughly $250 million in net outflows in a single day.
Payward in Talks for U.S. Access
At the same time, Kraken’s parent Payward is in advanced talks with Hyperliquid Labs to offer selected perpetual contracts to U.S. traders through Bitnomial, its CFTC-regulated derivatives arm.
Bloomberg reported that Payward has shared an outline of the proposed structure with the CFTC. Any deal still needs regulatory approval. Both Payward and Hyperliquid Labs declined to comment.
President Trump referenced the effort at a White House event on August 19, saying the CFTC was working to bring Hyperliquid into the U.S. in a “fully compliant and legal fashion.”
Payward acquired Bitnomial in May for up to $550 million. That deal gave it a designated contract market, derivatives clearing organization, and futures commission merchant license. Kraken launched regulated perpetuals for eligible U.S. customers in June.
Hyperliquid has processed over $5.19 trillion in cumulative perpetual volume and held around $13.3 billion in open interest at the time of reporting.
