According to the data platform Arkham, wallets associated with the North Korean hacking group Lazarus sold over $30 million in Bitcoin through Hyperliquid in the past three weeks. The funds were then converted into ETH and SOL and transferred to centralized exchanges such as Kraken, LBank, and KuCoin.
Sell BTC first, then transfer to another exchange.
These addresses were first identified in 2024 by the on-chain investigator ZachXBT. Subsequently, Arkham marked them as related to Lazarus. Public on-chain records can only show the transfer paths between these addresses; it is not possible to directly confirm the actual controllers of the receiving accounts, nor can we determine whether the relevant platforms are aware of the source of the funds.
Kraken indicates that compliance is at the core of its operations. The company continuously monitors activities on the blockchain and utilizes external analysis tools to identify assets associated with sanctioned wallets. LBank states that it uses industry-standard monitoring tools to track suspicious transactions. KuCoin adds that it is not possible to confirm the activities mentioned in the reports without verifying the underlying wallet data.
Lack of licensed interfaces increases the difficulty of screening
As the US Treasury Department has listed Lazarus as a sanctioned cyber organization, the flow of these funds has also drawn attention from US regulatory authorities. US law enforcement agencies have previously linked Lazarus to several digital asset theft cases, including the incident in 2022 where Ronin Network had $625 million stolen from it.
The unauthorized trading interface of Hyperliquid allows users to directly connect to their wallets for transactions without the need to open a traditional brokerage account. This model increases the difficulty of implementing sanctions and identifying accounts. However, related transactions are still recorded on the public blockchain, allowing analytical institutions to track the transfer paths between marked addresses.
The report also points out that the fact that sanctioned funds appear on decentralized platforms does not necessarily mean that Hyperliquid is involved in or aware of such activities; likewise, there is no evidence to suggest that Kraken, LBank, or KuCoin have transferred these assets into unrestricted customer accounts.
Payward Discussing compliant access to the United States
While this capital flow was exposed, Bloomberg reported that the parent company of Kraken, Payward, is in deep discussions with Hyperliquid Labs and plans to offer some of the Hyperliquid perpetual contracts to American traders through its derivatives business Bitnomial, which is regulated by the U.S. Commodity Futures Trading Commission (CFTC).
According to informed sources, Payward has submitted a summary of the proposed structure to CFTC. The plan still requires regulatory approval, and the financial terms have not yet been disclosed. Trump also mentioned at a White House event on August 19 that regulators are pushing for Hyperliquid to enter the US market in a "completely compliant and legal" manner.
If the plan is implemented, eligible users in the United States will access the relevant products through the registration process with the operator, rather than using the unlicensed interface of Hyperliquid directly. For retail users in the U.S., commodity derivatives typically need to be provided through a trading, clearing, and brokerage system regulated by CFTC; mere wallet screening cannot replace these requirements.
The platform's cumulative trading volume has reached 5.19 trillion US dollars.
DefiLlama Data shows that as of press time, the cumulative trading volume of perpetual contracts on Hyperliquid is approximately 5.19 trillion US dollars, with a trading volume of about 60.44 billion US dollars in the past 7 days and about 204.95 billion US dollars in the past 30 days. The current open interest is around 13.3 billion US dollars.
In addition, the platform has accumulated a clearing volume of over $32.6 billion, with nearly $2.25 billion in the past 30 days. Besides the core protocol market, Hyperliquid also allows external developers to deploy independent perpetual exchanges based on HyperCore, and whitelist access control can be added to the new testing tools.
