Wallets linked to North Korea's Lazarus Group, a sanctioned hacking syndicate, moved about $30 million in cryptocurrency through the decentralized trading platform Hyperliquid over roughly three weeks, according to Arkham analyst Emitt Galili and Wu Blockchain.
Movement pattern. Arkham's analysis showed the funds entered Hyperliquid as Bitcoin, were swapped into Ethereum and Solana, then bridged to Tron, Solana, and Ethereum networks before being sent to KuCoin, LBank, Kraken, and unidentified Tron-based services. The cross-chain route is consistent with Lazarus Group laundering tactics designed to obscure the money trail before cashing out.
Background. Lazarus Group has been linked to the 2014 Sony Pictures hack, the WannaCry ransomware campaign, and major crypto thefts including the Ronin Bridge and Harmony Horizon Bridge attacks. Chainalysis estimates North Korea stole about $2 billion in crypto in 2025, while CertiK puts total DPRK-linked theft at roughly $6.75 billion across 263 incidents since 2016. The U.S. Treasury has sanctioned the group repeatedly.
US onshoring push. The transfers coincide with an effort by President Donald Trump and the CFTC to bring Hyperliquid into U.S. regulatory bounds. Hyperliquid Labs is in talks with Payward, Kraken's parent, for a U.S. route through Bitnomial, the CFTC-regulated clearinghouse Payward acquired for $550 million. The proposal would allow Bitnomial users access to selected Hyperliquid perpetual futures, but U.S. users would still not have the full application, and CFTC approval remains pending.
HYPE mechanics and market reaction. Hyperliquid allocates 99% of protocol fees to its Assistance Fund, which converts trading fees into HYPE and burns them. An SEC filing said 46.7 million HYPE, or 4.7% of initial supply, had been permanently removed as of August 23. HYPE reached an all-time high of $86.71 on August 27. After Trump's August 19 White House remarks describing CFTC Chairman Michael Selig's role in making Hyperliquid fully compliant, HYPE spiked nearly 17%.
Unresolved compliance risks. The reported on-chain movements do not prove receiving exchanges knew the assets were tied to Lazarus, and Hyperliquid has not publicly explained how its architecture can screen or block the flagged wallets. CME Group and ICE have pushed regulators to investigate Hyperliquid for price manipulation and sanctions exposure. Payward and Hyperliquid declined to comment, and no final registration terms or compliance framework are public. The episode leaves U.S. onshoring as a proposal rather than a clearance while supervisors weigh the illicit-finance risks they would be signing up to police.
