Lazarus Group Washed 30 Million USD in Bitcoin Through Hyperliquid While Washington Negotiates Its Regulated Arrival

Wallets tied to North Korea’s Lazarus Group have quietly sold more than 30 million USD in Bitcoin through the decentralized trading platform Hyperliquid over the past three weeks, according to on-chain data from Arkham Intelligence. The revelation lands at an awkward moment for the perp-focused exchange, which is simultaneously in talks to bring a regulated version of its products to American traders.

From stolen Bitcoin to Ethereum and Solana

Arkham’s blockchain analysis shows that the Lazarus-linked wallets sold the Bitcoin on Hyperliquid, then used the proceeds to buy Ethereum and Solana before shipping the assets off to centralized exchanges, including Kraken, LBank, and KuCoin. It is a classic laundering chain: convert one asset into more liquid ones on a permissionless venue, fragment the trail, and cash out where identity checks exist but arrive after the on-chain hop.

The addresses at the center of the activity are not new. Crypto investigator ZachXBT first flagged them back in 2024, and Arkham later applied its Lazarus labels to the cluster. Still, public blockchain records have limits — they prove transfers between addresses, but they cannot show who ultimately controls the receiving accounts at the exchanges.

CoinDesk, which reported on the flows, said it could not identify the account holders or determine whether the exchanges knew the reported source of the funds before the deposits landed.

Exchanges respond

Each of the named platforms pushed back in slightly different ways. Kraken said compliance sits at the center of its operations and that it continuously monitors blockchain activity with support from analytics providers, with controls designed to identify and block assets connected to sanctioned wallets before they reach the platform.

LBank said it uses industry-standard compliance tools for continuous monitoring, and framed illicit transfers across platforms, blockchains, and jurisdictions as an industry problem that no single company can independently detect and resolve.

KuCoin said it could not confirm the reported activity without reviewing the underlying wallet data, and cautioned that public blockchain records do not show every step taken after assets arrive at a centralized platform — including account restrictions, regulatory reports, and other risk controls that happen behind the scenes.

Why the US angle matters

The timing is what makes the story uncomfortable. The US Treasury Department has sanctioned Lazarus Group and identified it as a cyber organization controlled by North Korea’s government, linking it to some of the largest digital-asset thefts on record, including the 625 million USD Ronin Network attack in 2022. A sanctioned actor cycling funds through a venue that Washington is actively trying to bring inside the regulatory perimeter is exactly the kind of stress test regulators think about.

Former Defense Secretary Mark Esper recently cited North Korean hacking groups while arguing that regulated domestic crypto markets could give US law enforcement better access to customer and transaction records. Decentralized venues complicate that logic: Hyperliquid lets users connect a wallet and trade without opening a traditional brokerage account. There is no KYC counter to subpoena at the point of entry — only the public blockchain trail that firms like Arkham follow after the fact.

It cuts both ways. The protocol’s transparent ledger is precisely what allowed the three-week, 30-million-dollar shopping spree to be traced at all. And the presence of a sanctioned actor’s assets on a decentralized platform does not establish that Hyperliquid assisted the activity or knew who controlled the wallets.

Parallel track: the Payward talks

While the laundering story broke, Bloomberg reported that Kraken parent Payward is in advanced discussions with Hyperliquid Labs over offering selected perpetual contracts to American traders through Bitnomial, its CFTC-regulated derivatives business. Sources said Payward has already presented the Commodity Futures Trading Commission with an outline of the proposed structure. Any deal still requires regulatory approval, and financial terms remain unknown.

A Payward arrangement would route eligible US customers through a registered operator rather than Hyperliquid’s permissionless front door. That distinction is the entire point: commodity derivatives offered to American retail traders generally must run through CFTC-regulated entities, and wallet screening alone does not replace exchange, clearing, and brokerage requirements.

Payward already owns that infrastructure. It completed its Bitnomial purchase in May after agreeing to pay as much as 550 million USD in cash and stock, gaining control of a designated contract market, a derivatives clearing organization, and a futures commission merchant. Kraken followed up in June by launching regulated perpetuals for eligible US customers through Kraken Pro on Bitnomial’s structure.

Earlier in August, a deployer using Kraken’s name spun up a Hyperliquid testnet deployment that whitelisted ten wallets and tested controls for canceling orders, reducing positions, and moving collateral — a possible preview of how a permissioned Hyperliquid might look. Neither company confirmed ownership of the deployment.

The open question

Hyperliquid has processed a cumulative 5.19 trillion USD in perpetual trading volume, according to DefiLlama, making it the dominant force in decentralized perps. Its scale is exactly why US officials want a compliant path in — and exactly why sanctioned groups find it useful in the meantime.

For the analysts watching, the lesson of the past three weeks is straightforward: transparency on-chain is not the same as control. Hyperliquid’s ledger exposed the Lazarus flows in detail, but exposure after the fact is cold comfort if the Ethereum and Solana bought with those proceeds have already been absorbed into exchange order books. Any US entry deal will have to answer for both halves of that problem.