North Korea Hackers Route $30 Million Through Hyperliquid

Published: September 1, 2026 – 15:07 UTC

How Did Lazarus-Linked Funds Move Through Hyperliquid?

Crypto wallets linked to North Korea’s state-backed Lazarus Group moved more than $30 million through Hyperliquid in recent weeks, putting fresh attention on sanctions controls at the decentralized derivatives platform just as it seeks a route into the U.S. market.Blockchain data shared by Arkham analyst Emmett Gallic showed Lazarus-tagged addresses sending Bitcoin to Hyperliquid and HyperUnit before converting the funds into Ether or Solana. The assets were then bridged to the Tron, Solana and Ethereum networks and ultimately sent toward several centralized exchanges and unlabeled Tron-based services.Kraken, KuCoin and LBank were among the exchanges identified in the transaction trail. Public blockchain records show where assets were sent, but they do not establish who controlled receiving accounts or what compliance action an exchange may have taken after the funds arrived.Kraken said its compliance program uses blockchain analytics providers to monitor onchain activity and identify assets associated with sanctioned wallets. LBank said it also uses industry-standard compliance tools, while noting that cross-chain and cross-platform activity can make illicit finance difficult for any single company to identify independently.KuCoin said it could not verify the specific activity without reviewing the underlying data and noted that account restrictions, regulatory reporting and other internal controls may not be visible through public blockchain transactions.

Why Does The Activity Matter For Hyperliquid?

The timing creates a regulatory problem for Hyperliquid. President Donald Trump said at a White House event on Aug. 19 that Commodity Futures Trading Commission Chairman Michael Selig was working on a pathway to bring Hyperliquid into the U.S. “in a fully compliant and legal fashion.”Payward, the parent company of Kraken, is also in advanced talks with Hyperliquid Labs over a structure that could provide U.S. traders with access to perpetual futures linked to Hyperliquid markets through Bitnomial, a CFTC-regulated derivatives business owned by Payward. Regulatory approval is still pending.A U.S. route would bring greater attention to how activity connected to sanctioned actors is handled. Hyperliquid allows traders to interact directly from crypto wallets rather than opening conventional brokerage accounts and completing the same customer onboarding used by centralized exchanges.That structure is central to the appeal of decentralized trading, but it also creates a difficult compliance question: how can a permissionless protocol preserve wallet-based access while satisfying sanctions, anti-money-laundering and market-surveillance requirements expected inside the regulated U.S. financial system?

Investor Takeaway

The $30 million transaction trail does not show that Hyperliquid was hacked or knowingly handled sanctioned funds. The investor risk is regulatory: Lazarus-linked activity gives U.S. authorities a live example of the compliance problems that must be addressed if Hyperliquid-linked trading is brought onshore.

Is North Korean Activity On Hyperliquid New?

The latest transactions are not Hyperliquid’s first encounter with wallets suspected of having North Korean links. In December 2024, MetaMask security researcher Taylor Monahan identified suspected North Korean wallets that had been trading on the platform since at least October.The disclosure sparked concerns that hackers could be testing the platform ahead of a potential attack and contributed to roughly $250 million of net withdrawals in a single day. Hyperliquid said at the time that it had not been exploited and that user funds were safe.Lazarus is already subject to U.S. sanctions and has been linked to some of the largest thefts in digital assets. The group was the main suspect in the 2025 attack on Bybit, which resulted in roughly $1.4 billion of crypto being stolen.North Korean actors have continued using exchanges, bridges and multiple blockchains to move stolen assets, forcing trading platforms to track not only directly sanctioned addresses but also the subsequent movement of funds across wallets and networks.

Could Sanctions Risk Complicate Hyperliquid’s U.S. Push?

Hyperliquid has grown into the largest decentralized venue for perpetual futures, processing more than $5 trillion of cumulative perpetual trading volume. That scale has made the platform increasingly relevant to both traditional derivatives companies and U.S. regulators.It has also increased scrutiny of its permissionless structure. Traditional regulated exchanges operate customer-identification systems and can restrict individual accounts directly. Blockchain protocols can be harder to control because users interact through wallets and transactions can move across several networks within minutes.The Lazarus transactions therefore arrive at a sensitive point. A regulated U.S. structure using Bitnomial could place customer onboarding and compliance obligations at the regulated intermediary rather than simply opening Hyperliquid’s existing interface to U.S. traders.For Hyperliquid, the challenge is no longer only winning trading volume from centralized competitors. Its potential U.S. expansion will depend on whether regulators are satisfied that a compliant access layer can prevent sanctioned actors from reaching regulated markets without removing the characteristics that made decentralized perpetual trading attractive in the first place.

Source: FinanceFeeds