Wallets linked to North Korea’s Lazarus Group have sold more than $30 million in Bitcoin through Hyperliquid over three weeks as U.S. officials and Payward explore regulated access to the platform.
Lazarus-linked wallets convert Bitcoin into ETH and SOL
Arkham blockchain data, wallets associated with the North Korean state-sponsored Lazarus Group sold more than $30 million in Bitcoin on Hyperliquid during the past three weeks.
The wallets used proceeds from the Bitcoin sales to purchase Ethereum and Solana before sending the assets to centralized exchanges, including Kraken, LBank, and KuCoin, according to the blockchain analysis. Crypto investigator ZachXBT first identified the addresses in 2024, while Arkham later labeled them as connected to Lazarus.
Public blockchain records show transfers between addresses but do not reveal who controls the receiving exchange accounts. CoinDesk said it could not identify the account holders or determine whether the exchanges knew about the reported source of the funds.
Kraken said compliance sits at the center of its operations and that it continuously monitors blockchain activity with support from analytics providers. According to the exchange, its controls are designed to identify and block assets connected to sanctioned wallets before they reach the platform.
LBank said it uses industry-standard compliance tools for continuous monitoring. The exchange described illicit transfers across platforms, blockchains and jurisdictions as an industry problem that no single company can independently detect or resolve.
KuCoin said it could not confirm the reported activity without reviewing the underlying wallet data. The exchange also cautioned that public blockchain records do not show every step taken after assets arrive at a centralized platform, including account restrictions, regulatory reports and other risk controls.
Hyperliquid activity raises US sanctions questions
The reported transfers carry a direct U.S. angle because the Treasury Department has sanctioned Lazarus Group and identified it as a cyber organization controlled by North Korea’s government.
U.S. authorities have linked Lazarus to several digital-asset thefts, including the $625 million Ronin Network attack in 2022. As previously reported by crypto.news, former Defense Secretary Mark Esper recently cited North Korean hacking groups while arguing that regulated domestic crypto markets could give U.S. law enforcement better access to customer and transaction records.
Using a decentralized venue can complicate enforcement because Hyperliquid allows users to connect a wallet and trade without opening a traditional brokerage account. The protocol’s public blockchain still records transactions, allowing firms such as Arkham to trace transfers between labeled addresses.
The presence of a sanctioned actor’s assets on a decentralized platform does not establish that Hyperliquid assisted the activity or knew who controlled the wallets. CoinDesk’s report also did not establish that Kraken, LBank or KuCoin credited the transferred assets to unrestricted customer accounts.
For U.S. regulators, any plan to offer Hyperliquid-linked products domestically would need to address sanctions screening, customer identification and account-level controls. Wallet checks can identify previously labeled addresses, but funds may pass through several assets or addresses before arriving at another venue.
A recent Hyperliquid testnet deployment showed how a permissioned version of its infrastructure might operate. In August, a deployer using Kraken’s name whitelisted 10 wallets and tested controls for canceling orders, reducing positions, and moving collateral.
Neither Kraken nor Hyperliquid had confirmed ownership of that deployment when the report appeared. Because Hyperliquid’s testnet permits outside deployments, the Kraken name alone did not prove that the exchange created or operated it.
Payward discusses regulated Hyperliquid access
At the same time, Bloomberg reported that Kraken parent Payward is in advanced discussions with Hyperliquid Labs over offering selected perpetual contracts to American traders through Bitnomial, its CFTC-regulated derivatives business.
People familiar with the talks told Bloomberg that Payward had presented the Commodity Futures Trading Commission with an outline of the proposed structure. Any agreement would still require regulatory approval, while the financial terms remain unknown. Payward and Hyperliquid Labs declined to comment to Bloomberg.
President Donald Trump brought the possible U.S. entry into public view during an Aug. 19 White House event. Referring to CFTC Chair Michael Selig, Trump said he understood that the regulator was working to bring Hyperliquid into the United States in a “fully compliant and legal fashion.”
A Payward arrangement would give eligible U.S. customers access through a registered operator rather than through Hyperliquid’s permissionless interface. Commodity derivatives offered to American retail traders generally must use CFTC-regulated entities, and wallet screening alone does not replace exchange, clearing, and brokerage requirements.
Payward already has the regulatory infrastructure needed to operate in the domestic derivatives market. The company completed its Bitnomial purchase in May after agreeing to pay as much as $550 million in cash and stock.
The acquisition gave Payward control of a designated contract market, derivatives clearing organization and futures commission merchant. Together, the three registrations cover trading, clearing and brokerage services under CFTC oversight.
Kraken then launched regulated perpetuals for eligible U.S. customers in June. The service allows supported users to trade spot, margin, traditional futures and perpetual futures through Kraken Pro while using Bitnomial’s regulated structure.
Hyperliquid leads decentralized perpetual trading
Hyperliquid operates its principal exchange through HyperCore, an on-chain trading system that handles order matching, margin calculations and liquidations. Users trade from connected crypto wallets, while the platform’s main permissionless interface does not require a conventional brokerage account.
Perpetual futures differ from dated futures because they have no fixed expiry. Funding payments between long and short traders help keep contract prices close to the value of their underlying assets, allowing positions to remain open as long as margin requirements are met.
DefiLlama data showed Hyperliquid had processed approximately $5.19 trillion in cumulative perpetual volume at the time of writing. Its perpetual markets recorded about $60.44 billion in seven-day volume and $204.95 billion during the previous 30 days.
Open interest stood at roughly $13.3 billion, representing the notional value of outstanding perpetual positions. DefiLlama also recorded more than $32.6 billion in cumulative liquidations on the platform, including approximately $2.25 billion over the preceding 30 days.
Beyond markets operated by the core protocol, Hyperliquid Improvement Proposal 3 allows outside builders to launch independent perpetual exchanges using HyperCore. Deployers select their contracts, collateral, leverage limits, funding settings, and price sources after staking 500,000 HYPE.
Validators can slash the stake when a deployer manipulates an oracle or violates market rules. HIP-3 operators receive half of the trading fees generated by their markets, while newer permission tools tested on the network could let individual deployers restrict access to approved wallets.
