Blockchain analytics data shows wallets linked to North Korea’s state-sponsored Lazarus Group moved more than $30 million in bitcoin through the Hyperliquid decentralized derivatives platform over a recent three-week period. The activity involved sales of bitcoin that were converted into ether and solana before transfers to centralized exchanges.

Arkham identified the wallets based on earlier attribution by investigator ZachXBT from 2024. The funds entered the platform as bitcoin, underwent conversion, and then moved across networks including Tron, Solana and Ethereum. Destinations included Kraken, LBank and KuCoin, along with other services.

Platform Structure and Prior Activity

Hyperliquid operates as a permissionless venue for perpetual futures. Users connect wallets directly without traditional accounts or know-your-customer checks. The platform has processed more than $5 trillion in cumulative perpetual futures volume, with open interest near $13.3 billion and roughly $205 billion in volume over a recent 30-day span.

This is not the first appearance of North Korea-linked wallets on the platform. In December 2024, addresses suspected of ties to the group were detected trading there. Hyperliquid stated at the time that the platform had not been exploited and that no user funds were lost. The latest movements similarly show no evidence of a platform compromise.

The Lazarus Group has been sanctioned by the US Office of Foreign Assets Control since 2019. US authorities have long linked the group to large-scale cryptocurrency thefts used to fund weapons programs. North Korea-linked actors accounted for substantial shares of global crypto thefts in recent years, including figures reported in the billions for 2025 alone.

Exchange Responses and Compliance

Hyperliquid did not respond to requests for comment on the latest activity. Centralized exchanges that received funds issued statements on their monitoring practices.

A Kraken representative said the platform maintains partnerships with blockchain analytics providers to identify and block assets associated with sanctioned wallets before they enter the system. LBank noted the use of industry-standard tools while pointing to the cross-platform and cross-chain nature of crypto risks. KuCoin stated it could not verify the activity without reviewing the data and emphasized that public on-chain records do not always show subsequent account-level compliance actions.

US Regulatory Efforts and Market Context

The timing coincides with White House interest in bringing Hyperliquid into the regulated US market. At an event earlier in August, President Donald Trump stated that Commodity Futures Trading Commission Chairman Mike Selig was working to enable the platform’s entry “in a fully compliant and legal fashion.”

Singapore-based Hyperliquid Labs develops the network. Discussions involving Payward, parent of Kraken, have centered on potential access for US traders to limited Hyperliquid-related perpetual futures through Bitnomial, a CFTC-registered entity acquired by Payward. Traditional exchanges including CME Group and Intercontinental Exchange previously urged greater scrutiny of the platform over potential market manipulation and sanctions risks.

Hyperliquid’s native token reached a record high near $86.71 in late August. Market reaction to the wallet disclosures remained limited in the immediate aftermath. Regulatory filings for related investment products have previously noted that the platform’s structure does not compel users to undergo sanctions screening.

The developments underscore ongoing challenges for decentralized trading venues as authorities expand focus on infrastructure used to move funds linked to sanctioned entities.