North Korea's Lazarus Group moved $30M+ through Hyperliquid while Washington courts the platform
Blockchain data from Arkham, reviewed by CoinDesk, shows wallets tied to North Korea's Lazarus Group sold over $30 million in bitcoin on Hyperliquid in three weeks, even as the Trump administration weighs bringing the platform onshore.
Wallets tied to North Korea's state-sponsored Lazarus Group sold more than $30 million in bitcoin on Hyperliquid over the past three weeks, according to blockchain data from analytics firm Arkham, reviewed at CoinDesk's request. The proceeds were rotated into ether and solana, then pushed out to centralized exchanges including Kraken, LBank and KuCoin. CoinDesk reported the wallets were among those first flagged by on-chain investigator ZachXBT in 2024, and says it has not established who controls the receiving accounts or whether the exchanges knew where the money came from.
The timing is the story. Hyperliquid — a decentralized perpetual-futures venue where users trade directly from a wallet with no account and no KYC checks — is simultaneously being courted by the U.S. government. At a White House event earlier in August, President Trump said CFTC Chairman Mike Selig was working on a pathway to bring Hyperliquid onshore "in a fully compliant and legal fashion." Kraken parent Payward is in advanced talks with Singapore-based Hyperliquid Labs to bring its perpetuals to U.S. traders, Bloomberg reported this week.
Two of the three exchanges named as recipients responded. Kraken said its compliance controls are "designed to identify and block any assets associated with sanctioned wallets before they enter our platform." KuCoin said public on-chain data shows asset movement but not the compliance actions a platform may take after funds arrive, and said it maintains sanctions policies. LBank said it uses industry-standard monitoring but that cross-chain risks are "an ongoing challenge faced by the industry as a whole." Hyperliquid did not respond to CoinDesk by publication.
Key facts
- Lazarus-linked wallets sold $30M+ in bitcoin on Hyperliquid in three weeks; proceeds moved into ETH and SOL, then to Kraken, LBank, KuCoin (Arkham data, via CoinDesk).
- Wallets first identified by ZachXBT in 2024 (CoinDesk).
- OFAC sanctioned Lazarus in 2019; value received by sanctioned entities rose 694% in 2025 (Chainalysis, via CoinDesk).
- Hyperliquid: $5T+ cumulative perp volume, ~$13.3B open interest, ~$205B 30-day volume (DefiLlama, via CoinDesk).
- Bitwise's May HYPE ETF filing flagged that the network "could potentially be used by sanctioned actors" (CoinDesk).
The real-world read This isn't new for Hyperliquid — MetaMask's Taylor Monahan flagged suspected North Korean wallets on the platform back in December 2024, alongside a single-day ~$250 million net outflow. What's changed is the political backdrop: an administration pushing to onshore a venue whose own core selling point — trade straight from a wallet, no KYC — is precisely what makes sanctions screening hard. Bitwise conceded as much in a securities filing. Note the receiving exchanges' careful phrasing: Kraken and KuCoin describe controls and policies, not that these specific funds were caught. And this rests on one analytics firm's read of the chain, reviewed by one outlet; the wallet-to-Lazarus attribution and the exchanges' actual handling remain unconfirmed. CME and ICE, both Hyperliquid rivals, have their own reasons to want it scrutinized — worth weighing when they warn regulators about it.
Not financial advice.
Sources
- CoinDesk (Tier 2, secondary), Aug 31 2026 — sole reporting for this item; commissioned Arkham's wallet analysis, gathered exchange statements, and supplied the DefiLlama, Chainalysis, Bitwise and historical context. Not marketing.